Install

Install envctl on macOS or Linux with the install script, by hand from a checked download, or from source.

envctl is a single binary for macOS and Linux, on Apple silicon, arm64 and x86-64. It’s both the CLI and envd, the agent that makes your machine a sandbox, so there’s nothing else to install.

Install script

curl -fsSL https://envlink.projectinwork.com/install/install.sh | sh

The script:

1. picks the build for your operating system and processor;
2. downloads it with SHA256SUMS and refuses to install if the checksum doesn’t match;
3. puts envctl in /usr/local/bin when it’s writable, or in ~/.local/bin otherwise, and tells you if that folder isn’t on your PATH.

Choose the folder yourself with ENVLINK_INSTALL_DIR:

curl -fsSL https://envlink.projectinwork.com/install/install.sh | ENVLINK_INSTALL_DIR="$HOME/bin" sh

Check it:

envctl version

Download by hand

Every build is listed at envlink.projectinwork.com/install:

System	File
macOS, Apple silicon	envctl-darwin-arm64.gz
macOS, Intel	envctl-darwin-amd64.gz
Linux, arm64	envctl-linux-arm64.gz
Linux, x86-64	envctl-linux-amd64.gz

curl -fsSLO https://envlink.projectinwork.com/install/envctl-darwin-arm64.gz
curl -fsSLO https://envlink.projectinwork.com/install/SHA256SUMS
shasum -a 256 -c SHA256SUMS --ignore-missing
gunzip envctl-darwin-arm64.gz && chmod +x envctl-darwin-arm64
sudo mv envctl-darwin-arm64 /usr/local/bin/envctl

Build from source

With Go 1.27 or newer, from a checkout of the repository:

go build -o envctl ./cmd/envctl

Upgrade and uninstall

Run the install script again to upgrade; it replaces the binary in place. To remove envctl and everything it keeps on your machine:

envctl sandbox down --forget   # deregister this machine and leave the tailnet
rm "$(command -v envctl)"
rm -rf ~/.envlink              # credentials and the sandbox's state

What envctl keeps on your machine

Path	What it is
~/.envlink/credentials.json	The API address and your token, mode 0600
~/.envlink/sandbox/	The sandbox’s envd: configuration, tailnet identity, keyring, logs and socket
.remote/<environment>/	Results fetched back from an environment, in the folder you ran sandbox up from