Installing Continuum Local

Continuum Local ships as Debian and RHEL packages, a Windows installer, a container image, a Helm chart, and a single JavaScript file for a host that already runs Node.js. Every format runs the same agent file. Install the format your estate already manages, give it an enrolment token from Blueprintr, run continuum-local check, then start it.

Before you start

Sizing

The agent runs up to four relay and probe jobs at a time (maxConcurrentJobs, 1 to 16) and one network sweep alongside them. It ships with these limits:

Run one copy of each agent. Two processes sharing one enrolled identity take work from the same queue, which adds no redundancy. For another site or network segment, create another agent. An organisation or team may register up to 25 agents, and a revoked agent counts until you delete it.

Download and verify

Download from the download page while signed in to an account on an Enterprise plan; for anyone else the page reports not found. Check the signature before you install. The page prints the commands for the release you are viewing, and Releases and verification explains them.

The commands below use $V for the version you downloaded, for example V=0.2.0.

Linux packages

Debian and Ubuntu

sudo apt install ./continuum-local_${V}_amd64.deb
sudo cp /etc/continuum-local/config.example.json /etc/continuum-local/config.json
sudo -e /etc/continuum-local/config.json
sudo chown root:continuum-local /etc/continuum-local/config.json
sudo chmod 640 /etc/continuum-local/config.json
sudo continuum-local check /etc/continuum-local/config.json
sudo systemctl enable --now continuum-local

On arm64, install the _arm64.deb. What to put in config.json is under Enrol the agent. The package creates a continuum-local system account and a systemd unit, and leaves the service disabled until you enable it.

RHEL, Rocky and Alma

sudo dnf install ./continuum-local-${V}-1.x86_64.rpm

On arm64, install the .aarch64.rpm. Then follow the Debian steps from cp onwards.

What the packages install

The service runs as the unprivileged continuum-local account, with no capabilities and a read-only filesystem apart from its state directory. Its logs are in the journal: journalctl -u continuum-local.

Run the continuum-local command with sudo. As root it reads /etc/continuum-local/environment the way systemd does, then switches to the continuum-local account, so check sees the same proxy, certificates and file permissions as the service.

Proxy settings

Put proxy variables in the environment file, or set proxy and noProxy in config.json, which take precedence:

sudo -e /etc/continuum-local/environment

HTTPS_PROXY=http://proxy.corp.example:3128
NO_PROXY=localhost,.corp.example

sudo systemctl restart continuum-local

The agent sends only its traffic to Blueprintr through the proxy. Its connections to your own systems stay direct. If the proxy re-signs TLS, set the proxy's root certificate as extraCaFile in config.json: the agent trusts that file for Blueprintr and never for your own systems. Variables used in env: references also go in the environment file, such as SOLARWINDS_PASSWORD for "password": "env:SOLARWINDS_PASSWORD".

Windows

Copy-Item "C:\Program Files\Continuum Local\config.example.json" `
  "C:\ProgramData\Continuum Local\config.json"
notepad "C:\ProgramData\Continuum Local\config.json"

& "C:\Program Files\Continuum Local\runtime\node.exe" `
  "C:\Program Files\Continuum Local\continuum-local.mjs" `
  check "C:\ProgramData\Continuum Local\config.json"

Set-Service -Name ContinuumLocal -StartupType Automatic
Start-Service -Name ContinuumLocal

The installer gives C:\ProgramData\Continuum Local its own access list: the service reads config.json but cannot change it, and writes only to state\ and logs\. Service logs are in C:\ProgramData\Continuum Local\logs. Set a proxy with proxy and noProxy in config.json, because environment variables added to the service are replaced on every upgrade.

Docker

docker run -d --name continuum-local --restart=unless-stopped \
  -v /etc/continuum-local:/etc/continuum-local:ro \
  -v continuum-local-state:/var/lib/continuum-local \
  ghcr.io/blueprintr-io/continuum-local:$V

The image runs as the unprivileged node user (uid 1000) and reads /etc/continuum-local/config.json, so uid 1000 needs read access to that file on the host. The continuum-local-state volume keeps the enrolled identity. Without it, a new container enrols again and fails, because the token is already spent. Check the configuration with the same mounts:

docker run --rm \
  -v /etc/continuum-local:/etc/continuum-local:ro \
  -v continuum-local-state:/var/lib/continuum-local \
  ghcr.io/blueprintr-io/continuum-local:$V check

Give a proxy as -e HTTPS_PROXY=... -e NO_PROXY=..., or in the configuration. Once you have verified the image, run it by the digest that cosign verify prints: a tag can be moved, a digest cannot.

Kubernetes

kubectl create secret generic continuum-local-config --from-file=config.json
helm install agent oci://ghcr.io/blueprintr-io/charts/continuum-local \
  --version $V --set existingSecret=continuum-local-config

To install from a file instead, use continuum-local-helm-chart-<version>.tgz from the download page in place of the oci:// address.

The chart runs one replica with the Recreate strategy, as a non-root user with a read-only root filesystem, and creates no Service or Ingress. Its main values:

Without existingSecret or config, the agent does not start. After you edit the Secret, restart the agent:

kubectl rollout restart deployment/agent-continuum-local

A host with Node.js

Requires Node.js 24 or later. Download continuum-local-<version>.mjs, write config.json beside it, owned by the account that runs the agent with mode 0600, then:

node continuum-local-$V.mjs check ./config.json
node continuum-local-$V.mjs ./config.json

Run it under whatever supervises long-running processes on that host. It exits cleanly on SIGTERM or SIGINT.

Configuration and state locations

The state directory contains the enrolled identity (agent-state.json, mode 0600) and any integrations configured from Blueprintr. statePath in the configuration overrides it on every format. Without it, the agent uses CONTINUUM_LOCAL_STATE_DIR when set, then a systemd StateDirectory=, then %ProgramData%\Continuum Local\state on Windows, then /var/lib/continuum-local for /etc/continuum-local/config.json on Linux, and otherwise the configuration file's own directory.

Enrol the agent

{
  "apexUrl": "https://blueprintr.io",
  "displayName": "DC1 agent",
  "enrollmentToken": "the token you copied"
}

An expired, spent or revoked token gets the same refusal. Issue another with New token on the agent, or for a revoked agent, create a new agent. If the owning organisation's plan is inactive, enrolment is refused with a message that says so, and the token is not spent.

Next, add your on-premise connections in Blueprintr and copy the configuration block the panel prints for each into integrations: see Continuum Local. Every setting is in the configuration reference.

Running the check

Run continuum-local check on every new install, after every configuration change and before you contact support. It tests the configuration, the state directory, the certificate roots, the route to Blueprintr and a TLS handshake with each integration host, without enrolling or spending the token.