Deploying AnchoreCTL

AnchoreCTL is the CLI binary that lets you manage and inspect every aspect of your Anchore Enterprise deployment via the Anchore Enterprise API.

It can be utilized as an interactive CLI tool for manual administration and inspection, or as a streamlined automation tool for CI/CD pipelines.

Requirements

AnchoreCTL is a single binary. Operations that use a local container daemon need a daemon that supports Docker Engine API version 1.40 or later, such as Docker Engine v19.03 or later:

STIG evaluation (anchorectl stig and anchorectl image add --stig)
Analyzing an image from a local Docker or Podman daemon with --from docker or --from podman

Analyzing images from a registry or from a docker-archive file does not need a container daemon.

Installation

AnchoreCTL’s major and minor release version coincides with the release version of Anchore Enterprise, however patch versions may differ. For example,

Enterprise v6.3.1
AnchoreCTL v6.3.2

AnchoreCTL should be version-aligned with Anchore Enterprise for major/minor releases. Please refer to the Enterprise Release Notes for the supported version of AnchoreCTL.

The AnchoreCTL bundle can be downloaded directly from Anchore or from your local Anchore Enterprise Deployment.

To download a specific version directly from Anchore, you may swap 6.3.2 for the version you need.
You can verify the version of your AnchoreCTL with anchorectl --version.

Download Links

To download AnchoreCTL v6.3.2 directly from Anchore in your browser, choose your platform:

Operating System	Architecture	Download
Linux	Intel/AMD64	anchorectl_6.3.2_linux_amd64.tar.gz
MacOS	Intel/AMD64	anchorectl_6.3.2_darwin_amd64.tar.gz
MacOS	ARM/M-Series	anchorectl_6.3.2_darwin_arm64.tar.gz
Windows	Intel/AMD64	anchorectl_6.3.2_windows_amd64.zip

After downloading, extract the anchorectl binary (anchorectl.exe on Windows) and move it to a directory in your PATH. Then run anchorectl --version to confirm it works.

To download the version that matches your own Anchore Enterprise deployment, use the “From your local Anchore deployment” examples below.

Command Line Installation

The following examples can be used to quickly install AnchoreCTL to your local system.

NOTE: Some of these examples add a directory to your PATH. Your method may vary depending on your environment.

Linux

Intel/AMD64

# Directly from Anchore
mkdir -p ~/.local/bin
curl -o anchorectl.tar.gz -L "https://anchorectl-releases.anchore.io/anchorectl/v6.3.2/anchorectl_6.3.2_linux_amd64.tar.gz" && \
tar -xvf anchorectl.tar.gz -C ~/.local/bin/ anchorectl
anchorectl --version

# From your local Anchore deployment
ANCHORE_URL="anchore.my-domain.com"
mkdir -p ~/.local/bin
curl -o anchorectl.tar.gz -X GET "https://$ANCHORE_URL/v2/system/anchorectl?operating_system=linux&architecture=amd64" -H "accept: */*" && \
tar -zxf anchorectl.tar.gz -C ~/.local/bin anchorectl
anchorectl --version

MacOS

These examples use ~/.local/bin as the binary path which can be used by a non-privileged user but isn’t standard on MacOS.
You may use the best configuration for your environment.

Intel/AMD64

# Directly from Anchore
mkdir -p ~/.local/bin
curl -o anchorectl.tar.gz -L "https://anchorectl-releases.anchore.io/anchorectl/v6.3.2/anchorectl_6.3.2_darwin_amd64.tar.gz" && \
tar -xf anchorectl.tar.gz -C ~/.local/bin anchorectl
# Include in your PATH
export PATH="$HOME/.local/bin:$PATH" # Consider adding to your ~/.zshrc for permanent usage
anchorectl --version

# From your local Anchore deployment
ANCHORE_URL="anchore.my-domain.com"
mkdir -p ~/.local/bin
curl -o anchorectl.tar.gz -X GET "https://$ANCHORE_URL/v2/system/anchorectl?operating_system=darwin&architecture=amd64" -H "accept: */*" && \
tar -zxf anchorectl.tar.gz -C ~/.local/bin anchorectl
# Include in your PATH
export PATH="$HOME/.local/bin:$PATH" # Consider adding to your ~/.zshrc for permanent usage
anchorectl --version

ARM/M-Series

# Directly from Anchore
mkdir -p ~/.local/bin
curl -o anchorectl.tar.gz -L "https://anchorectl-releases.anchore.io/anchorectl/v6.3.2/anchorectl_6.3.2_darwin_arm64.tar.gz" && \
tar -xf anchorectl.tar.gz -C ~/.local/bin anchorectl
# Include in your PATH
export PATH="$HOME/.local/bin:$PATH" # Consider adding to your ~/.zshrc for permanent usage
anchorectl --version

# From your local Anchore deployment
ANCHORE_URL="anchore.my-domain.com"
mkdir -p ~/.local/bin
curl -o anchorectl.tar.gz -X GET "https://$ANCHORE_URL/v2/system/anchorectl?operating_system=darwin&architecture=arm64" -H "accept: */*" && \
tar -zxf anchorectl.tar.gz -C ~/.local/bin anchorectl
# Include in your PATH
export PATH="$HOME/.local/bin:$PATH" # Consider adding to your ~/.zshrc for permanent usage
anchorectl --version

Windows

Intel/AMD64

# Directly from Anchore
New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\bin" | Out-Null
Invoke-WebRequest -Uri "https://anchorectl-releases.anchore.io/anchorectl/v6.3.2/anchorectl_6.3.2_windows_amd64.zip" -OutFile "anchorectl.zip"
Expand-Archive -Path "anchorectl.zip" -DestinationPath "$env:USERPROFILE\bin" -Force
# Add $USERPROFILE\bin to your user PATH, refresh PATH and test anchorectl
[Environment]::SetEnvironmentVariable("Path", "$env:USERPROFILE\bin;" + [Environment]::GetEnvironmentVariable("Path", "User"), "User")
$env:Path = [Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [Environment]::GetEnvironmentVariable("Path", "User")
anchorectl --version

# From your local Anchore deployment
$AnchoreUrl = "https://anchore.my-domain.com"
New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\bin" | Out-Null
Invoke-WebRequest -Uri "$AnchoreUrl/v2/system/anchorectl?operating_system=windows&architecture=amd64" -Headers @{ "accept" = "*/*" } -OutFile "anchorectl.zip"
Expand-Archive -Path "anchorectl.zip" -DestinationPath "$env:USERPROFILE\bin" -Force
# Add $USERPROFILE\bin to your user PATH, refresh PATH and test anchorectl
[Environment]::SetEnvironmentVariable("Path", "$env:USERPROFILE\bin;" + [Environment]::GetEnvironmentVariable("Path", "User"), "User")
$env:Path = [Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [Environment]::GetEnvironmentVariable("Path", "User")
anchorectl --version

Installation Script

For Linux or MacOS, you have the option of using the automated installation script.
Be sure to specify a destination folder by replacing <DESTINATION_DIR>. A specified version is also required.

curl -sSfL https://anchorectl-releases.anchore.io/anchorectl/install.sh | sh -s -- -b <DESTINATION_DIR> v6.3.2

Configuration

After AnchoreCTL has been installed, it will need to be configured. See AnchoreCTL Configuration for details.

Next Steps

For every command, subcommand, and flag AnchoreCTL accepts, see the AnchoreCTL Command Reference.

Last modified November 11, 2026