Linux

Packages

APT repository

On Ubuntu 22.04+ and Debian 12+, add the ZShot repository once and updates arrive through apt upgrade:

sudo install -d -m755 /etc/apt/keyrings
curl -fsSL https://releases.zshot-app.com/apt/zshot-archive-keyring.gpg | sudo tee /etc/apt/keyrings/zshot-archive-keyring.gpg >/dev/null
echo "deb [arch=amd64,arm64 signed-by=/etc/apt/keyrings/zshot-archive-keyring.gpg] https://releases.zshot-app.com/apt stable main" | sudo tee /etc/apt/sources.list.d/zshot.list
sudo apt update && sudo apt install zshot

Verify the key:

curl -fsSL https://releases.zshot-app.com/apt/zshot-archive-keyring.gpg | gpg --show-keys

The fingerprint must be:

853909A7ADB62E00A338253230C60E18C85C245C

Direct downloads

The .deb installs on Ubuntu 22.04+ and Debian 12+ with apt-get install ./zshot-VERSION-linux-ARCH.deb.

The .tar.gz runs on any distro with glibc 2.35 or newer, including Fedora and Arch. It bundles INSTALL.txt and DEPENDENCIES.txt, which list the install steps and required system packages.

Both include shell completions for bash, zsh, and fish.

The Docker image should be used on systems that do not provide Xvfb.

Hardening

The .deb and the tarball on a bare host use Chromium’s sandbox with no setup. chrome-sandbox ships setuid there as Chromium’s fallback for kernels with user namespaces disabled. In a container the sandbox needs a seccomp profile: Docker hardening covers the profile and the recommended runtime settings, and Kubernetes the manifests.

Environment

On Linux ZShot rewrites its environment before Chromium starts. Helper processes see time zone and locale (TZ, LANG, LANGUAGE, LC_*), DISPLAY, HOME, USER, TMPDIR, PATH, fontconfig and proxy variables, and nothing else. License keys, server tokens, and provider API keys never reach them, and credential flag values show as * in the process command line. A variable meant for Chromium, such as GPU driver tuning, does not pass through; Chromium switches go through --chromium-arg.

GPU rendering

ZShot renders on the GPU by default and falls back to CPU rendering with --software-rendering. Ensure that the user running the app has access to any GPU device nodes ( /dev/nvidia*, et al).