> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/runtime-security/install/deploy-defender/container.md). # Deploy Container Defender Install Container Defender on each host that you want Prisma Cloud to protect. Single Container Defenders can be configured in the Console UI, and then deployed with a curl-bash script. Alternatively, you can use [twistcli to configure](/content-collections/runtime-security/install/deploy-defender/container/single-defender-cli.md) and deploy Defender directly on a host. Prisma Cloud Defender requires real-time access to kernel events on the workloads it protects. The use of third-party runtime protection software, such as Microsoft Defender, may block access to these kernel events and disrupt the expected functionality of Prisma Cloud Defender. Ensure that workloads that are protected by Prisma Cloud Defender don’t have such third-party software installed. Deployments that have third-party runtime protection (or similar software that block access to kernel events) installed alongside Prisma Cloud Defender aren’t supported. ## Install a single Container Defender (Console UI) Configure how a single Container Defender will be installed, and then install it with the resulting curl-bash script. **Prerequisites**: * Your system meets all minimum [system requirements](/content-collections/runtime-security/install/system-requirements.md). * Ensure your host can access the Prisma Cloud console the network. * Port 443 is open for outgoing traffic from your host. * You have sudo access to the host where you want to deploy the Defender. 1. Verify that the host machine where you install Defender can connect to the Prisma Cloud console. 1. Copy the path to the value under **Path to Console** from **Runtime Security > Manage > System > Utilities**. 2. Complete the following command with copied value. ``` curl -sk -D - /api/v1/_ping ``` 3. Run the command on your host system. If curl returns an HTTP response status code of 200, you have connectivity to Console. 2. Go to **Runtime Security > Manage > Defenders > Deployed Defenders** and select **Manual deploy**.
install defender deploy page
3. Under **Deployment method**, select **Single Defender**. 4. Select your desired **Defender type**. When you select **Container Defender - Linux** option as the Defender type, **Container Runtime Type** field appears. 5. In **Container Runtime Type**, select **Podman** or **Docker**. When you select Podman, the installation script includes the `--install-podman` argument. If your infrastructure uses a custom Podman runtime socket path, you can specify it using the `--podman-socket` argument. For example, to use Podman with a custom runtime socket path, the final command would look like this: `curl -sSL --header "###" -X POST /api/v1/scripts/defender.sh | sudo bash -s — -c "stage-consoles-cwp.cloud.twistlock.com" -v --install-podman --podman-socket ""` 6. Under **The name that Defender will use to connect to this Console** select the correct item from the list of IP addresses and hostnames pre-populated in the drop-down list. After adding a SAN, your IP address or hostname will be available in the drop-down list. Selecting an IP address in a evaluation setup is acceptable, but using a DNS name is more resilient. If you select Console’s IP address, and Console’s IP address changes, your Defenders will no longer be able to communicate with Console. 7. Under **Defender and Console communication** enter the following optional configuration. 1. Set a custom communication port for the Defender to use. 2. Set a proxy for the Defender to use for the communication with the Prisma Cloud console. 8. Under **Advanced Settings**, you can enter the following additional network configurations. 1. Set **Assign globally unique names to Hosts** to **ON** when you have multiple hosts that can have the same hostname. After setting the toggle to **ON**, Prisma Cloud appends a unique identifier, such as ResourceId, to the host’s DNS name. For example, an AWS EC2 host would have the following name: `Ip-171-29-1-244.ec2internal-i-04a1dcee6bd148e2d`. 9. Copy the installation script command from the right-side panel, which is generated based on the options you have selected. On the target host where Defender is to be installed, paste the command into a shell window and execute it. The `HOST_FIM_MOUNTS` parameter permits Defender to specify additional host mounts to be monitored. This facilitates the tracking of an expanded set of mount points on the host, in addition to those monitored by default. To configure the `HOST_FIM_MOUNTS` environment variable and install the container defender on a tenant, perform the following steps: 1. Select all the options as per requirement till step 7 above, and copy the install scripts command from the right side panel with details of all options you have selected: ``` curl -sSL -k --header "authorization: "#########" -X POST https://app0.cloud.twistlock.com/app0panwdev-1234/api/v1/scripts/defender.sh -d '{"port":123}' | sudo bash -s -- -c "app0.cloud.twistlock.com" --install-podman. ``` 2. Remove the tenant and podman(if selected) details from the command to download the defender.sh file using the following command: ``` curl -sSL -k --header "authorization: "#########" -X POST https://app0.cloud.twistlock.com/app0panwdev-1234/api/v1/scripts/defender.sh -d '{"port":123} > defender.sh ``` 3. Edit the downloaded defender.sh to include the `env` variable in the following command: ``` cat twistlock.sh | bash -s -- ${additional_defender_parameters} -s -a "${console_cn}" --env "HOST_FIM_MONUTS=/mnt/mountpoint1:/mnt/mountpoint2" -b "#########" "${defender_type}" ``` 4. (Optional) If you have selected Podman in the consolue UI, include\`--install-podman\` argument as below to the install the defender. ``` sudo defender.sh -c --install-podman ``` 5. (Optional) If your infrastructure uses a custom Podman runtime socket path, you can specify it using the `--podman-socket` argument. For example, to use Podman with a custom runtime socket path, the final install command would look like this: ``` sudo defender.sh -c --install-podman --podman-socket "" ``` 6. If Podman details are not inlcuded, execute the following command to install the defender on the tenant. ``` sudo defender.sh -c ``` ## Verify the install Verify that Defender is installed and connected to Console. Defender can be deployed and run with full functionality when dockerd is configured with SELinux enabled (--selinux-enabled=true). All features will work normally and without any additional configuration steps required. Prisma Cloud automatically detects the SELinux configuration on a per-host basis and self-configures itself as needed. No action is needed from the user. 1. In Console, go to **Manage > Defenders > Deployed Defenders**. Your new Defender should be listed in the table, and the status box should be green and checked. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/runtime-security/install/deploy-defender/container.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.