This guide is for users installing Shadowrocket on a Linux desktop. First check your distro and CPU architecture, then choose a DEB, RPM, or AppImage package and follow the steps to install it, set execute permissions, and check the first connection. Use the full path to the file you downloaded rather than assuming a fixed package name. Connection setup assumes you already have a service provider and configuration of your own.
1. Check Your Linux Distribution and CPU Architecture
Shadowrocket is available for Linux. There are two ways to get it: iPhone and iPad versions cost $2.99 as a one-time App Store purchase; the developer is Shadow Launch Technology Limited, and system requirements are as listed on the App Store page. Versions for Mac (Apple silicon and Intel), Windows, Android, and Linux are free. Choose an installer from the all-platform downloads page; do not construct download URLs in terminal commands.
A file extension tells you the package format, not the CPU architecture. Even on Linux, x86_64 and aarch64 packages are not interchangeable. Run these read-only commands in a terminal to note your distro, version, and machine architecture, then check the package details currently listed on the downloads page.
cat /etc/os-release
uname -mDistribution details
- Where to check
/etc/os-release- ID
- Identifies distributions such as Ubuntu, Debian, and Fedora.
- ID_LIKE
- If available, helps identify the distribution family.
- VERSION_ID
- Records the system version, useful when troubleshooting runtime library compatibility.
Being in the same distribution family does not guarantee that every release can run the same binary.
Architecture details
- Command
uname -m- x86_64
- Common 64-bit Intel / AMD architecture; package identifiers are usually amd64 or x86_64.
- aarch64
- 64-bit ARM architecture; package identifiers are usually arm64 or aarch64.
- How to choose
- Use the architectures actually listed on the downloads page. Do not mix packages just because they share a file extension.
AppImage files also require a matching architecture; they do not convert software between CPU architectures.
2. Choose Between DEB, RPM, and AppImage
Prefer the package format supported by your distribution's package manager. It tracks the installation and can resolve dependencies available from your configured repositories. AppImage is useful if you do not want to install the application itself into system directories, but it still depends on system libraries, the desktop environment, and filesystem mount options. It is not guaranteed to run with a double-click on every Linux system.
| Format | Common systems | Install or launch | Notes |
|---|---|---|---|
| deb | Debian, Ubuntu, and compatible distributions | apt install with a local file path | Use a path containing a slash; a full path is recommended. |
| rpm | Fedora and compatible distributions that use dnf | dnf install with a local file path | Dependencies and package management commands may differ on other RPM-based systems. |
| AppImage | Linux desktops that meet the package's runtime requirements | Add execute permission, then run the file | Requires a matching architecture, an executable mount location, and the necessary runtime libraries. |
Identify your system
Run
cat /etc/os-releaseanduname -m. Do not identify your distribution by desktop appearance alone.Choose a format
Open the Linux section of the downloads page, choose a file for your distribution and available architecture, and wait for the browser download to finish.
Note the file path
Use your file manager to view the file properties and note its full path, including the filename. When prompted for a path in the terminal steps below, do not add quotation marks yourself.
Install
Follow the relevant section below. Review the changes listed by the package manager and continue only if no unexpected system components will be removed.
Check that it launches
After installation, open the app from your applications menu. For AppImage, run it from a terminal and keep any error output for troubleshooting.
3. Debian / Ubuntu: Install a Local DEB with apt
Run these commands in a Bash terminal. At the first prompt, enter the full path to the downloaded DEB, such as the path copied from its file properties. Enter the path only; you do not need to add quotation marks if it contains spaces. Later commands protect the variable with double quotes. Check the package details first, then use apt to install it.
read -r -p 'Enter the full path to the DEB file: ' pkg
dpkg-deb --field "$pkg" Package Version Architecture
sudo apt update
sudo apt install "$pkg"apt update refreshes your system's package index; it does not update Shadowrocket settings or subscriptions. apt install reads the local DEB and tries to install dependencies from your enabled repositories. Use the full path: if you enter only a filename without a slash, apt may search for it as a package in the repositories.
- If you see a file-not-found error, check the path with
ls -l -- "$pkg"and make sure you did not select an incomplete download. - If dependencies cannot be satisfied, check that your system version matches your repositories. Do not add repositories for another distribution to your system to resolve a single dependency.
- If the architecture does not match, compare the package's
Architecturewithuname -m, then return to the downloads page and choose the right package. - If the package manager reports that a lock is in use, wait for system updates or other package manager tasks to finish. Do not delete the lock file.
4. Fedora and Other dnf Systems: Install a Local RPM
On systems that use dnf, let the package manager handle local RPM files rather than forcing installation with a low-level tool. Read the package details first and check its name and architecture, then install it. The variable here is separate from the DEB section, so you can run these commands in a fresh Bash terminal.
read -r -p 'Enter the full path to the RPM file: ' pkg
rpm -qp --queryformat '%{NAME}\n%{VERSION}-%{RELEASE}\n%{ARCH}\n' "$pkg"
sudo dnf install "$pkg"dnf resolves dependencies using your currently enabled repositories. Using RPM format does not mean a system has exactly the same dependency versions as Fedora. If you see nothing provides, check the missing library name and version requirements against your distribution's compatibility requirements instead of skipping the dependency.
- If repository access fails, resolve the system's repository connectivity issue first. Having the package file locally does not mean all its dependencies are available locally.
- If the transaction summary says it will remove essential desktop components, cancel and check package compatibility with your system.
- If installation succeeds but the app does not appear in the menu, search for Shadowrocket again in the applications menu. If necessary, log out of your desktop session and back in.
- Do not use
--nodepsto hide dependency errors. A successful installation record does not mean the system has a working runtime environment for the app.
5. AppImage: Execute Permission, File Location, and Launching
An AppImage usually runs as a single file without being registered through apt or dnf. Store it in a permanent directory you can write to, so it is not accidentally deleted when you clean out your downloads folder. The steps below prompt for the full path, add execute permission for the file owner only, and launch the app as your regular user.
read -r -p 'Enter the full path to the AppImage file: ' app
ls -l -- "$app"
chmod u+x -- "$app"
"$app"chmod +x is a common way to add execute permission. Here, chmod u+x explicitly limits the change to the file owner. Do not run the app with sudo by default: it can create root-owned files in your user configuration directory, preventing you from saving settings when you launch it normally.
Why do I still get Permission denied after adding execute permission?
First run ls -l -- "$app" to check the owner's execute bit, then use findmnt -T "$app" to inspect the mount point. If the mount options include noexec, move the file to a local user directory that allows execution and try again. Do not weaken the security settings for an entire external drive just to run one file.
The terminal reports that libfuse.so.2 is missing. What should I install?
Some AppImage runtimes require a FUSE 2 compatibility library. Use apt or dnf to search for a compatible library available for your distribution, then check the system documentation before installing it. Package names may include libfuse2, libfuse2t64, or another name. Do not remove existing FUSE components without checking first.
I get Exec format error. Is the file missing execute permission?
Check the binary architecture first. Run file -- "$app" and compare the result with uname -m. Running chmod again will not convert an x86_64 program to ARM. If the file type looks wrong, also check whether the download completed successfully.
Nothing happens when I double-click. How can I see the error?
Run "$app" from a terminal and keep the first error message. Missing shared libraries, an unavailable graphical session, and sandbox initialization failures are different issues; do not try to fix them all by disabling the sandbox or running as root.
6. First Connection: Distinguish Installation, Connectivity, and Rules
A window opening only confirms that the app has launched; it does not mean a connection is available. Shadowrocket does not include a connection service, and this site does not provide, sell, or recommend nodes or subscriptions. Use settings or a subscription from a provider you already use. Verify the source before importing, and do not expose full subscription URLs in public screenshots, logs, or terminal history.
Check imported items and the current selection in Home, the active configuration in Config, and relevant options in Settings. Navigation may vary by platform; follow the interface you see instead of applying phone VPN authorization steps to Linux. If the system requests network permissions, read what they are for before following the system prompt.
Global Routing → Config
RecommendedHandle intercepted requests according to the current configuration. Make sure the configuration is enabled, then check which rules match. For example, DOMAIN-SUFFIX matches domain suffixes, and FINAL provides a fallback policy.
Best for: Using a reviewed configuration with rules for everyday traffic.
Global Routing → Proxy
Route intercepted requests through the proxy. This can help temporarily distinguish connection issues from rule issues. It does not mean that all traffic from every program on the system is automatically intercepted.
Best for: Temporarily checking whether rules affect access when you already have a working connection.
Global Routing → Direct
Connect intercepted requests directly. If a site opens in this mode, that only confirms the direct connection works; it does not prove the proxy service is working.
Best for: Comparing direct access to isolate problems with the proxy route.
If behavior differs between your browser and terminal, check whether the cause is the system proxy, the app's own proxy settings, or environment variables. Terminal programs may not use the desktop system proxy. Do not assume the local listening port is a fixed number; use the protocol, address, and port shown in the current settings.
env | grep -iE '^(http|https|all|no)_proxy='This command only displays proxy environment variables already set in the current terminal; it does not change any settings. No output does not mean Shadowrocket is not running. If variables are shown, check that the specified local port is actually listening. Change one setting at a time and record the results before and after.
7. Update and Uninstall: Use the Original Installation Method
For later DEB or RPM updates, get a package compatible with your system from this site's downloads page, then install it with apt or dnf as appropriate. Manually installing a local package does not subscribe you to an application update repository, so routine system updates are not guaranteed to update Shadowrocket. Updating the app package and refreshing a subscription in Home are also separate: the former replaces the application, while the latter refreshes connection details for a service you already use.
- Remove a DEB: Get the actual package name from the output of
dpkg-deb --field "$pkg" Package, then pass that name tosudo apt remove. Do not guess the package name from the product's display name. - Remove an RPM: Get the package name with
rpm -qp --queryformat '%{NAME}\n' "$pkg", then pass it tosudo dnf remove. Review the transaction summary before continuing. - Update an AppImage: Exit the app and save your configuration, then replace the old file. You may need to run
chmod u+xon the new file. - Remove an AppImage: Exit the app, then delete the file and any desktop shortcuts you created. User configuration may be stored separately; do not blindly clear the entire configuration directory.