Latest stable · v0.7.36 · released 2026-05-21

Run MeshHold anywhere you own a CPU.

All binaries are reproducible builds from the same Go source tree. Pick your platform, verify the SHA-256 if you're paranoid (and you should be), and you're a single command away from your first node.

Laptop, phone, and mini server connected by a teal light filament
Pick your platform

One binary, every box you own

MeshHold ships as a single self-contained daemon. The same code runs whether it's a 32-watt Raspberry Pi or a 64-core dedicated server.

Linux

🎩

RHEL / Rocky / Alma / Fedora

.rpm · amd64 / arm64
SHA-256:
📦

Raw binary

Drop it anywhere — no package manager required
SHA-256:
static · CGO_DISABLED=1
# Ubuntu / Debian — installs daemon, systemd unit, and config skeleton.
sudo apt-get install -y ./meshhold-0.7.36-amd64.deb
sudo systemctl status meshhold

# Set a password for the web UI — the daemon stays running.
sudo -u meshhold meshhold set-password -c /etc/meshhold/config.yaml

# Open the web UI — self-signed TLS by default, accept the warning once.
xdg-open https://$(hostname -f):8080/

Docker

🐳

Docker container

distroless · non-root · amd64 / arm64 · single image, no compose
Not yet available
SHA-256:
runs as uid 65532 · Docker Hub coming soon
# amd64 host (arm64: swap -amd64 for -arm64 in the URL and image tag).
# `gunzip | docker load` avoids writing the tarball to disk twice.
curl -fsSL # | gunzip | docker load

# Persist Badger store + blocks across container restarts. Named
# volume picks up the image's 65532:65532 ownership automatically;
# a bind-mounted host path needs `chown 65532:65532` first.
docker volume create meshhold-data

# MESHHOLD_PASSWORD is only consulted on the first run when no
# password hash exists yet; later runs ignore it silently.
docker run -d --name meshhold --restart unless-stopped \
  -p 7777:7777 -p 8080:8080 \
  -v meshhold-data:/var/lib/meshhold \
  -e MESHHOLD_PASSWORD=$(openssl rand -base64 24 | tr -d '=/+' | head -c 32) \
  meshhold:0.7.36-amd64

# Then: open https://<host>:8080/ — self-signed TLS, accept once.

Windows

🪟

Windows 10 / 11

MSI installer · WiX 3 · per-user, no UAC
SHA-256:
tray app + WebView2 native window
:: Silent install — drops binaries in %LOCALAPPDATA%\Programs\MeshHold,
:: registers the meshhold:// protocol, and adds a tray icon at logon.
msiexec /i MeshHoldSetup-0.7.36.msi /qn

Android

📱

Phones & tablets

arm64-v8a · the one almost everyone wants
SHA-256:
Foreground Service · UnifiedPush
🧪

Emulator / x86_64

For desktop Android emulators
SHA-256:
📦

F-Droid (planned)

Not yet — reproducible-build metadata is in review.
Coming soon
Expected: a future release

Build from source

Reproducible — every release tag is matched by a GitHub Actions run that produces byte-identical binaries to the artifacts above. Verify with sha256sum.
# Requires Go ≥ 1.22 and Node ≥ 18 for the web bundle.
git clone https://github.com/your-org/meshhold && cd meshhold
make tools         # protoc + buf, only needed if you edit .proto files
make web           # builds React bundle into internal/api/webui_dist
make build         # cross-compiles to ./bin/
./bin/meshhold --version

Looking for an older version? Browse the release archive for every published stable build and its changelog. Want the bleeding edge? The nightly build is rebuilt on every push.
Programmatic consumers: stable manifest at /api/manifest.json, nightly at /api/nightly/manifest.json.

Got it running?

Walk through the Setup Wizard, create your first vault, and add a second node from your phone in under five minutes.