Install Shadowrocket on Linux: Choose a deb, rpm, or AppImage

Check your distribution, architecture, and package format

deb, rpm, and AppImage are distribution formats, not proxy protocols. Ubuntu, Debian, and compatible derivatives generally use deb packages; distributions such as Fedora that use dnf generally use rpm. AppImage is useful if you want to keep the app as a standalone file without installing it through the system package manager, but it still depends on compatible CPU architecture and system runtime requirements.

cat /etc/os-release
uname -m

The first command shows details such as ID and ID_LIKE; the second checks your machine's architecture. Common architectures x86_64 and aarch64 are not interchangeable. The architecture offered on the download page must match your device. The availability of a package format does not mean it will run on every distribution or architecture.

Download the Linux file for your system

Open the Shadowrocket download page, choose a format for your system in the Linux section, and note where your browser saves the file. This guide doesn't assume a fixed filename; the commands below prompt you for the actual path, so they also work with filenames that include a version or architecture suffix.

1. Check your system

   Open a terminal, run the two commands above, and note your distribution and architecture. Don't identify your system as Ubuntu or Fedora based only on how the desktop looks.

2. Choose a format

   Go to Download → Linux, choose deb, rpm, or AppImage for your system, and check that the listed architecture matches your device.

3. Locate the file

   Open the file's location from your browser's download history and check its absolute path in the file properties. Don't try to install the file before the download is complete.

4. Run the command

   In a Bash terminal, use the command in the relevant section. When prompted for a path, paste the absolute path without quotes or a shortened tilde path, then press Enter.

Install a deb package with apt and resolve dependencies

On Debian, Ubuntu, and compatible systems, use apt to install the local deb package. Compared with simply unpacking it, this also lets apt try to install required dependencies from your configured system repositories. The input below is stored only in a shell variable for the current terminal session. Before running it, make sure the path points to a deb file downloaded from this site.

read -r -p 'Enter the absolute path to the deb file: ' DEB
if [ -f "$DEB" ]; then
  sudo apt install "$DEB"
else
  printf '%s\n' 'File not found. Check the absolute path and try again.'
fi

When apt displays the installation plan, review which packages will be added, upgraded, or removed before confirming. The terminal usually won't show any characters when you enter your sudo password; this doesn't mean your keyboard isn't working. If a dependency can't be found, check your repositories, network connection, and distribution support first. Don't install system libraries with the same name from untrusted sources.

• If you see an architecture mismatch, compare uname -m with the architecture listed for the download. Don't use options to force installation while ignoring the mismatch.
• If a package manager lock is in use, wait for system updates or other installation tasks to finish. Don't delete the lock file.
• If the path is invalid, make sure it is an absolute path beginning with / and that the file has finished downloading.

After installation, search for Shadowrocket in your desktop app list and launch it. Installing a local deb package doesn't add a software repository for app updates. To update later, download the appropriate file from this site's download page and install it with apt.

Install an rpm package with dnf on Fedora

Fedora users can install a local rpm package with dnf, which also resolves dependencies from system repositories. Other rpm-based distributions may use different package manager commands and dependency names. The same file extension doesn't mean every step for Fedora will apply.

read -r -p 'Enter the absolute path to the rpm file: ' RPM
if [ -f "$RPM" ]; then
  sudo dnf install "$RPM"
else
  printf '%s\n' 'File not found. Check the absolute path and try again.'
fi

If you encounter a dependency conflict, note the package name and error in the terminal output, then check whether the package matches your distribution. Don't skip dependency checks, disable security policies, or force-replace system components just to continue. After installation, you can usually launch the app from the app list. If the menu hasn't refreshed, reopen it before considering signing out of your desktop session.

• Choose either deb or rpm. Prefer your system's native format and don't convert packages to install them again.
• Quit Shadowrocket normally before upgrading so you don't mistake an old running process for the new installation.
• To uninstall, find Shadowrocket in your system's package manager and follow the recorded installation details. Don't guess the internal package name.

Run an AppImage after making it executable

An AppImage is a standalone application file. Move it to a location where you plan to keep it, then make it executable. Don't leave it in a temporary browser download directory. Files on removable drives, shared directories, or mounts that restrict execution may not run even if the permission bit is set correctly.

read -r -p 'Enter the absolute path to the AppImage file: ' APPIMAGE
if [ -f "$APPIMAGE" ]; then
  chmod u+x -- "$APPIMAGE" && "$APPIMAGE"
else
  printf '%s\n' 'File not found. Check the absolute path and try again.'
fi

chmod u+x adds execute permission for the file owner only. You don't need to make the file writable by everyone or use sudo to launch the graphical app. Keep the terminal window open for the first test: if double-clicking does nothing, the terminal may show the specific error.

• Keep the double quotes in the command above if the file path contains spaces. When entering the path at the prompt, don't add extra quotes.
• Some AppImages require FUSE compatibility support. If the error specifically mentions FUSE, install the relevant compatibility package using your distribution's documentation. Don't copy package names from a different distribution.
• To update an AppImage, quit the app, download the new file, make it executable again, and then launch it.

After installation, distinguish routing settings from connection details

A successful launch only means the app can run; it doesn't mean you have a working connection. Use connection details or a subscription you already have and understand, then check the imported results in Home and Config. For full import and update instructions, see the user guide. Updating a subscription refreshes connection details; it doesn't update the Linux application package.

Before troubleshooting connectivity, check Home → Global Routing. The options below describe Shadowrocket's routing behavior. They don't replace server address, port, authentication, or protocol settings, and they don't change AppImage file permissions.

For example, DOMAIN-SUFFIX,example.com,DIRECT applies DIRECT to the specified domain suffix. FINAL,DIRECT sets the final policy for requests that didn't match earlier rules. These are examples of rule syntax, not instructions to overwrite your existing configuration. When troubleshooting installation, change one setting at a time to avoid confusing configuration changes with system permission issues.

First launch blocked? Troubleshoot the specific error

There is no single “allow” button that works across all Linux distributions. First determine whether the issue is missing execute permission, a mount that prohibits execution, an architecture mismatch, or a desktop or system security policy. Don't assume every launch failure is a security block, and don't bypass errors by disabling system-wide protections.

The variables above are only available in the original terminal. If you open another terminal, enter the file path again. For further troubleshooting, note your distribution, architecture, package format, commands run, and full error message. Remove subscription addresses, authentication details, and other sensitive information before sharing logs. This helps separate launch problems from connection problems.