UEFI x86-64
Cix is UEFI-only. For Proxmox, use OVMF with Q35 rather than legacy BIOS/i440fx.
Prebuilt for
Download.
Verify. Boot.
You do not need to compile Cix to use it. Start with the prebuilt installer, verify its detached signature on a machine you already trust, and boot it on a UEFI system.
InstallerCix
Architecture
Image size
Environment
ServiceLAN staging cache
01 / Verify the download
Trust the signature,
not the download server.
The ISO and its detached minisign signature come from Cix Cache. The public key is pinned separately on this website; one key signs current media. Verify both files before writing the image or booting it.
minisign -Vm \
cix-installer-2.55.16-1-x86_64.iso \
-p cix-release-2026-09.pub- ISO SHA-256
- a7a3f056632431af2f6b0d229bbad9d0
d4e59032edd9d407f7f950b151bca3f9 - Signature SHA-256
- d8ff7e4c10dcaa63f95c3dcdc2672cd9
e1d646ff19f62baf417ed9aa2f72d95e
Release keys
One key signs current media.
Installers published from 6 September 2026 onward are signed by cix-release-2026-09.pub, key id 0b19db46b2b6db6c. That is the key the command above pins, and the only key that verifies the current installer.
The earlier key, cix-release.pub, is retired: its private half was lost when the release host was reinstalled, so no new artefact is signed with it. It stays published because every ISO it already signed still verifies against it. A retired key is kept, never deleted.
02 / Install
Know the current target.
These are documented constraints, not an implied compatibility list.
Target storage
Documented paths include VirtIO Block, SATA/PATA, NVMe, and software RAID. VirtIO-SCSI is not currently covered.
Management network
The installer takes a static IP, prefix, gateway, and interface. That bootstrap network is API-managed after first boot.
Console
Video and serial installation are supported. Secure Boot enrolment has a specific, ordered first-boot procedure.
03 / First use
From boot to useful.
Short, task-focused manuals live with the source. Use the path that matches what you want to do next; the website stays the orientation layer, while the repository remains the technical reference.
Install and connect
Write the verified ISO, complete the UEFI install, set the management address, and make the first API request.
Open quickstart →Run a workload
Use the API to define an image, attach storage and networking, start a container, and check readiness.
Open administration guide →Build or update
Follow the source-first build path, understand cache hits and misses, and update the host or kernel safely.
Open build guide →Cix Cache
Source-defined.
Prebuilt when available.
Cix does not make you choose between source provenance and practical installation speed. Git carries versioned recipes and their approved artefact checksums. Cix Cache carries compiled bytes. The host fetches the exact artefact named by its recipe, verifies it independently, and installs it without compiling.
Like Cix itself, the cache is API-first: cixcached owns the REST contract; its dashboard and cix-cache client are clients of that API.
The distribution loop
A cache, never a catalogue.
Losing the registry costs build time—not source truth. Cix already knows what it intends to install before it asks the cache for bytes.
Verified cache hits
A prebuilt archive is accepted only when its SHA-256 matches the checksum declared by the Git recipe.
Source fallback
No server, a genuine miss, or a failed artefact fetch falls through to the normal source fetch and build path.
Self-publishing builds
With push enabled, a genuine fresh build queues its reproducible archive for Cix Cache; downloaded artefacts are never needlessly republished.
API-driven registry
Publishing, retrieval, observation, garbage collection, and removal are REST operations; the CLI and dashboard use the same contract.
Download boundary
The website is public.
The cache is not.
Cix.world is the public project site, but the installer and artefact cache still runs on the Cix LAN. Public visitors can read the source and verification instructions here; do not expect the current download links to work outside that network until a public cache endpoint is configured.
Browse the LAN staging cache →