@localctl/cli 0.4.1 → 0.5.0-beta.1

package/README.md

@@ -73,26 +73,80 @@ JSON file per app.
 
 | Requirement | Notes |
 |---|---|
-| **macOS** or **Windows** | Windows commands run in PowerShell. |
+| **macOS**, **Windows** or **Linux** | Windows commands run in PowerShell. Linux support is [experimental](#linux-experimental). |
 | **Node.js 18+** | Needed to install the CLI from npm. |
-| **Container engine** | [Podman Desktop](https://podman-desktop.io/), running. See [supported container engines](#supported-container-engines). |
-| **Homebrew** or **winget** | Used once by `localctl setup` to install missing tools. |
+| **Container engine** | [Podman Desktop](https://podman-desktop.io/) (or Docker Desktop / Rancher Desktop), running. See [supported container engines](#supported-container-engines). |
+| **Homebrew** (macOS) or **winget** (Windows) | Used once by `localctl setup` to install missing tools. Linux needs only `curl`. |
 
 `localctl setup` installs `k3d`, `kubectl`, `tilt`, `mkcert` and `helm` for you if they're missing.
+On Windows, Tilt isn't on winget, so it's downloaded from its GitHub release into
+`~\.localctl\tools` and added to your user PATH. On Linux, all five tools are downloaded as
+official release binaries into `~/.localctl/tools` (no sudo, no distro packages).
 
 ### Supported container engines
 
 | Engine | Status |
 |---|---|
 | [Podman Desktop](https://podman-desktop.io/) | ✅ Tested |
-| [Docker Desktop](https://www.docker.com/products/docker-desktop/) | 🧪 Experimental — not yet tested |
+| [Docker Desktop](https://www.docker.com/products/docker-desktop/) | 🧪 Experimental — setup and app deploy verified on Windows |
 | [Rancher Desktop](https://rancherdesktop.io/) | 🧪 Experimental — not yet tested |
+| Docker Engine / native Podman (Linux) | 🧪 Experimental — see [Linux](#linux-experimental) |
 
 Experimental engines are detected and should work, since k3d only needs a Docker-compatible API,
 but they haven't been through a full test cycle yet. `localctl setup` and `localctl doctor` print
 a warning when one is in use. If you try one, please
 [report how it went](https://github.com/psilvmoreira/localctl/issues/new).
 
+### Required tools
+
+What has to be on your machine **before** `localctl setup`, and what `setup` installs for you:
+
+| | You install | `localctl setup` installs |
+|---|---|---|
+| **All platforms** | **Node.js 18+** (to install and run the CLI), a **container engine** | `k3d`, `kubectl`, `tilt`, `mkcert`, `helm` |
+| **macOS** | [Homebrew](https://brew.sh) | via `brew` (plus `nss` for Firefox, optional) |
+| **Windows** | `winget` (ships with Windows) | via `winget`, Tilt from its GitHub release |
+| **Linux** | `curl` and `tar`, `sudo` (hosts file, CA trust) | downloaded as release binaries into `~/.localctl/tools` |
+
+`localctl setup` needs administrator rights once, for the `*.local.test` hosts entry and the local
+CA trust.
+
+### Linux (experimental)
+
+Linux support is **experimental**: it hasn't been through a full test cycle (CI only runs the
+smoke tests there), and `setup`/`doctor` print a warning. It's published on the `beta` dist-tag:
+
+```sh
+npm install -g @localctl/cli@beta
+```
+
+Targeted distributions, all with systemd and a mkcert-supported trust store:
+
+| Family | Distributions | Docker Engine install |
+|---|---|---|
+| Debian | Ubuntu, Debian, Linux Mint, Pop!_OS | `localctl setup --install-docker` (Docker's official script) |
+| Red Hat | Fedora, RHEL, Rocky, AlmaLinux, CentOS Stream | `localctl setup --install-docker` (Docker's official script) |
+| Arch | Arch, Manjaro, EndeavourOS | `localctl setup --install-docker` (`pacman`) |
+| SUSE | openSUSE Leap/Tumbleweed | `localctl setup --install-docker` (`zypper`) |
+
+Other distributions (Alpine, Void, Gentoo, NixOS, immutable/atomic desktops) may work if you
+bring Docker (or Podman) and Node.js yourself, but aren't targeted. WSL needs the Windows hosts
+file edited too.
+
+What's different on Linux:
+
+- **Docker Engine** is the recommended engine (root daemon, nothing else to configure). If none is
+  running, `localctl setup --install-docker` installs it for the families above. It needs `sudo`,
+  and you must **log out and back in** afterwards so your user joins the `docker` group.
+- **Podman** runs natively, no VM. The insecure-registry entry goes in
+  `~/.config/containers/registries.conf.d/` (no sudo, no restart). k3d needs Podman's API socket:
+  `systemctl --user enable --now podman.socket`. Rootless Podman also can't bind :80/:443 by
+  default: `sudo sysctl net.ipv4.ip_unprivileged_port_start=80`.
+- **Firefox/Chromium trust** needs `certutil` (`libnss3-tools` on Debian/Ubuntu, `nss-tools` on
+  Fedora). `setup` prints the command for your distro; install it and re-run `mkcert -install`.
+
+Hit a problem? [Open an issue](https://github.com/psilvmoreira/localctl/issues/new).
+
 ## Installation
 
 ```sh
@@ -106,7 +160,9 @@ the local image registry, trusts the `*.local.test` certificate, and updates you
 is idempotent: run it again any time to repair your environment.
 
 You'll see up to two one-time prompts during setup: **mkcert** asking to trust its local
-certificate authority, and **sudo/Administrator** to write the `*.local.test` hosts entries.
+certificate authority, and **admin rights** to write the `*.local.test` hosts entries (your
+`sudo` password on macOS, a UAC prompt on Windows). Approve both: without the hosts entries, apps
+run but their addresses don't resolve.
 
 **Pre-releases** are published under the `beta` tag: `npm install -g @localctl/cli@beta`.
 
@@ -120,7 +176,8 @@ Update available: 0.2.0 -> 0.3.0
 Run npm install -g @localctl/cli to update.
 ```
 
-Update with `npm install -g @localctl/cli`. The check never slows a command down, is skipped in
+Update with `npm install -g @localctl/cli`. On a pre-release you're also told about newer
+versions on your own channel (e.g. `beta`). The check never slows a command down, is skipped in
 CI, and can be turned off with `LOCALCTL_NO_UPDATE_CHECK=1`.
 
 <details>
@@ -204,6 +261,16 @@ localctl app down
 
 This removes only that app. The shared cluster keeps running for everything else.
 
+<details>
+<summary><b>App is ready but <code>https://&lt;app&gt;.local.test</code> doesn't open?</b></summary>
+
+If `localctl app status` shows `1/1` but the browser can't reach the address, the hosts file
+entry is missing: the `sudo` or UAC prompt was declined or missed. Run `localctl hosts sync` and
+approve the prompt. More cases, with cause and fix:
+[**Troubleshooting**](https://psilvmoreira.github.io/localctl/troubleshooting/).
+
+</details>
+
 > **Tip:** no app of your own yet? Clone the repo and try a ready-made example:
 > [`node-app`](https://github.com/psilvmoreira/localctl/tree/master/examples/node-app) (Node.js + Postgres),
 > [`python-app`](https://github.com/psilvmoreira/localctl/tree/master/examples/python-app) (Python + Redis), or
@@ -211,7 +278,8 @@ This removes only that app. The shared cluster keeps running for everything else
 
 ## Commands
 
-Run `localctl <command> --help` for every option.
+Run `localctl <command> --help` for every option, or see the full
+[**CLI reference**](https://psilvmoreira.github.io/localctl/cli-reference/).
 
 <details open>
 <summary><b>Machine setup</b></summary>
@@ -220,7 +288,7 @@ Run `localctl <command> --help` for every option.
 |---|---|
 | `localctl setup` | Install or repair the infrastructure: container engine, cluster, TLS, hosts. Idempotent. |
 | `localctl doctor` | Health check of the active project's environment. |
-| `localctl hosts sync` / `list` | Manage the `*.local.test` entries in your hosts file. |
+| `localctl hosts sync` / `list` | Write or list the `*.local.test` entries in your hosts file. Asks for admin rights when needed. |
 | `localctl uninstall [-y]` | Remove every cluster, registry, hosts entry, certificate and state file `localctl` created. |
 
 </details>
@@ -235,7 +303,7 @@ Run `localctl <command> --help` for every option.
 | `localctl app down` | Stop the dev loop and remove the app. Keeps its data. |
 | `localctl app reload [-a <name>]` | Force a rebuild and redeploy without waiting for a file change. |
 | `localctl app status [-a <name>] [-A]` | One app's detail inside its repository, or a table of every app. |
-| `localctl app logs <name> [-f]` | Show or follow an app's logs. |
+| `localctl app logs [name] [-f]` | Show or follow an app's logs. Inside its repository the name is optional. |
 | `localctl app exec [cmd...]` | Open a shell (default `sh`) in the app's pod. |
 | `localctl app prune [-y]` | Delete leftover data (volumes, secrets) of apps already taken down. |
 | `localctl app secrets set <KEY> [value]` | Store a secret as a Kubernetes Secret, never in `config.json`. |
@@ -324,6 +392,7 @@ The full documentation lives at **[psilvmoreira.github.io/localctl](https://psil
 | [Adding tools](https://psilvmoreira.github.io/localctl/adding-tools/) | Write your own per-app or cluster-wide addon |
 | [Troubleshooting](https://psilvmoreira.github.io/localctl/troubleshooting/) | Known issues, with cause and fix |
 | [Uninstalling](https://psilvmoreira.github.io/localctl/uninstalling/) | Full teardown reference |
+| [Contributing](https://psilvmoreira.github.io/localctl/contributing/) | Local setup, tests, pull requests, dependency policy, docs site |
 | [Releasing](https://psilvmoreira.github.io/localctl/releasing/) | How versions are cut and published |
 
 ## Releases and versioning
@@ -334,16 +403,21 @@ The full documentation lives at **[psilvmoreira.github.io/localctl](https://psil
   with notes and the package tarball.
 - Versions follow [Semantic Versioning](https://semver.org). Before `1.0.0`, minor versions may
   contain breaking changes.
-- npm releases are published from GitHub Actions with
+- Every pull request shows a **release preview**: the version that merging it would publish,
+  including any unreleased commits already on `master`.
+- npm releases are published from GitHub Actions through
+  [trusted publishing](https://docs.npmjs.com/trusted-publishers) (no npm tokens) with
   [provenance](https://docs.npmjs.com/generating-provenance-statements). The npm package page links
   each version to the exact commit and workflow run that built it.
+- Dependencies and GitHub Actions are kept up to date by Dependabot, with every action pinned to a
+  commit SHA.
 
 ## Contributing
 
 Issues and pull requests are welcome. The full guide (constraints, dependency policy, working on
 the docs site) is in [**Contributing**](https://psilvmoreira.github.io/localctl/contributing/).
 
-1. Fork the repository and create a branch.
+1. Fork the repository and create a branch from an up-to-date `master`.
 2. Make your change and run the tests:
    ```sh
    cd cli
@@ -352,15 +426,19 @@ the docs site) is in [**Contributing**](https://psilvmoreira.github.io/localctl/
    npm run test:pack   # the published package installs and runs
    ```
 3. Open a pull request with a [Conventional Commits](https://www.conventionalcommits.org/) title.
-   The title decides the next version:
+   PRs are squash-merged, so the title decides the next version. GitHub pre-fills it from the
+   branch name, which fails the title check: edit it.
 
    | Title | Release |
    |---|---|
-   | `fix: ...` | Patch (`0.2.0` → `0.2.1`) |
-   | `feat: ...` | Minor (`0.2.1` → `0.3.0`) |
-   | `feat!: ...` | Major (`0.3.0` → `1.0.0`) |
+   | `fix: ...`, `perf: ...` | Patch (`0.4.0` → `0.4.1`) |
+   | `feat: ...` | Minor (`0.4.1` → `0.5.0`) |
+   | `feat!: ...` | Major (`0.5.0` → `1.0.0`) |
    | `docs:` `chore:` `ci:` `refactor:` `test:` | No release |
 
+4. Check the **release preview** on the `pr-title` check and wait for every check to pass
+   (title, tests on Linux/macOS/Windows × Node 18/22, docs build, non-empty diff).
+
 <details>
 <summary><b>Repository layout</b></summary>
 
@@ -376,8 +454,10 @@ localctl/
 ├── cluster/manifests/   cluster-level manifests (TLS store, addon namespace)
 ├── schema/              JSON Schema for .local/config.json
 ├── examples/            ready-to-run sample apps
-├── docs/                documentation site (MkDocs Material, deployed to GitHub Pages)
-└── bin/                 bootstrap and uninstall scripts for source installs
+├── docs/                documentation pages (MkDocs Material, deployed to GitHub Pages)
+├── overrides/           docs site template overrides (landing page)
+├── bin/                 bootstrap and uninstall scripts for source installs
+└── .github/             CI, release and docs workflows, Dependabot config
 ```
 
 </details>
@@ -390,8 +470,10 @@ npm uninstall -g @localctl/cli  # the CLI itself
 ```
 
 `localctl uninstall` asks for confirmation (skip with `-y`) and is safe to re-run. It leaves the
-shared tools (`k3d`, `kubectl`, `tilt`, `mkcert`, `node`) and mkcert's root CA installed, since
-other projects may use them. It prints the exact commands to remove them too. Installed from
+shared tools (`k3d`, `kubectl`, `tilt`, `mkcert`, `helm`, `node`) and mkcert's root CA installed,
+since other projects may use them. It prints the exact commands to remove them for your OS
+(`brew uninstall ...` on macOS; `winget uninstall ...` plus the `~.localctl	ools` folder for
+Tilt on Windows). Installed from
 source with the bootstrap script? Use `./bin/uninstall.sh` or `./bin/uninstall.ps1` instead.
 Details: [**Uninstalling**](https://psilvmoreira.github.io/localctl/uninstalling/).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@localctl/cli",
-  "version": "0.4.1",
+  "version": "0.5.0-beta.1",
   "description": "localctl - local Kubernetes dev platform CLI",
   "keywords": [
     "kubernetes",
@@ -48,6 +48,11 @@
     "node": ">=18"
   },
   "localctl": {
+    "platforms": {
+      "darwin": "tested",
+      "win32": "tested",
+      "linux": "experimental"
+    },
     "containerEngines": {
       "podman": "tested",
       "docker": "experimental",

package/src/commands/doctor.js

@@ -1,5 +1,7 @@
 const { commandExists, capture } = require('../lib/exec');
-const { detectEngine, warnIfExperimental } = require('../lib/engine');
+const { detectEngine, warnIfExperimental, warnIfExperimentalPlatform } = require('../lib/engine');
+const { ensurePodmanSocket, blockedPrivilegedPorts, engineMemoryMb } = require('../lib/podman');
+const { DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT } = require('../lib/constants');
 const { getActive, clusterNameFor } = require('../lib/profileStore');
 const ui = require('../lib/ui');
 const logger = require('../lib/logger');
@@ -21,6 +23,7 @@ module.exports = (program) => {
     .description('Check the local environment for missing/broken pieces')
     .action(() => {
       logger.step('Checking environment...');
+      warnIfExperimentalPlatform();
       const detected = detectEngine();
       check(`container engine available${detected ? ` (${detected.engine})` : ''}`, () => Boolean(detected));
       if (detected) warnIfExperimental(detected.engine);
@@ -38,6 +41,18 @@ module.exports = (program) => {
         const res = capture('k3d', ['cluster', 'list']);
         return res.stdout.split('\n').some((line) => line.trim().split(/\s+/)[0] === activeCluster);
       });
+      if (process.platform === 'linux' && detected && detected.engine === 'podman') {
+        check('podman API socket available (needed by k3d)', () => ensurePodmanSocket() === null);
+        check('rootless podman can bind :80/:443', () => blockedPrivilegedPorts([DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT]).length === 0);
+      }
+      if (detected) {
+        // One k3s cluster idles around 0.6-0.7 GB, and apps/addons come on top. Below ~3 GB the
+        // engine's VM starts swapping and the API server times out.
+        const mb = engineMemoryMb(detected.bin);
+        if (mb !== null) {
+          check(`engine has at least 3 GB of memory (${(mb / 1024).toFixed(1)} GB available)`, () => mb >= 3000);
+        }
+      }
       check('kubectl context reachable', () => capture('kubectl', ['cluster-info']).status === 0);
       logger.step(`Fix any ${ui.cross} above, or run "localctl setup" (or "localctl profiles switch ${active}" for a non-default project) to (re)install/repair.`);
     });

package/src/commands/setup.js

@@ -3,8 +3,17 @@ const { syncHosts } = require('../lib/hostsFile');
 const { setActive } = require('../lib/profileStore');
 const { DEFAULT_CLUSTER_NAME, DEFAULT_HTTP_PORT, DEFAULT_HTTPS_PORT, DOMAIN, REGISTRY_HOST_PORT } = require('../lib/constants');
 const logger = require('../lib/logger');
+const { detectEngine } = require('../lib/engine');
+const { installDocker } = require('../lib/linuxDistro');
 
-function setup() {
+function setup(opts) {
+  if (opts.installDocker) {
+    if (process.platform !== 'linux') {
+      throw new Error('--install-docker is only available on Linux. Install Docker Desktop or Podman Desktop instead.');
+    }
+    if (detectEngine()) logger.success('A container engine is already running, nothing to install');
+    else installDocker();
+  }
   provisionCluster({
     clusterName: DEFAULT_CLUSTER_NAME,
     httpPort: DEFAULT_HTTP_PORT,
@@ -32,5 +41,6 @@ module.exports = (program) => {
   program
     .command('setup')
     .description('One-click local infra setup for the default project: container engine, tools, k3d cluster, TLS, hosts')
+    .option('--install-docker', 'Linux only: install Docker Engine first if no container engine is running (needs sudo)')
     .action(setup);
 };

package/src/commands/uninstall.js

@@ -24,7 +24,7 @@ async function uninstall(opts) {
   console.log('This will remove everything "localctl setup"/"localctl profiles" set up:');
   console.log(`  - Every project's k3d cluster (${projects.map((p) => p.cluster).join(', ')}) and everything deployed in them`);
   console.log('  - Their local image registry containers');
-  console.log('  - Podman VM insecure-registry config (Podman only, if present)');
+  console.log('  - Podman insecure-registry config (Podman only, if present)');
   console.log('  - The *.local.test block in your hosts file');
   console.log('  - Any background dev loop `localctl app up` left running, and its state');
   console.log('  - ~/.localctl/certs, the app registry state, and the project registry (~/.localctl/profiles.json)');
@@ -94,6 +94,8 @@ async function uninstall(opts) {
   if (process.platform === 'win32') {
     console.log('  winget uninstall k3d.k3d Kubernetes.kubectl FiloSottile.mkcert Helm.Helm   # only if nothing else needs them');
     console.log('  Remove-Item -Recurse -Force ~\\.localctl\\tools   # tilt, if localctl installed it');
+  } else if (process.platform === 'linux') {
+    console.log('  rm -rf ~/.localctl/tools   # k3d, kubectl, tilt, mkcert and helm, if localctl installed them');
   } else {
     console.log('  brew uninstall k3d kubectl tilt mkcert helm   # only if nothing else needs them');
   }

package/src/lib/clusterProvision.js

@@ -3,11 +3,12 @@ const fs = require('fs');
 const path = require('path');
 const yaml = require('js-yaml');
 const { run, capture, sleepSync, commandExists } = require('./exec');
-const { detectEngine, warnIfExperimental } = require('./engine');
-const { installIfMissing, installTiltWindows } = require('./toolInstall');
-const { ensureInsecureRegistry } = require('./podman');
+const { detectEngine, warnIfExperimental, warnIfExperimentalPlatform } = require('./engine');
+const { installIfMissing, installTiltWindows, nssInstallHint } = require('./toolInstall');
+const { ensureInsecureRegistry, ensurePodmanSocket, blockedPrivilegedPorts } = require('./podman');
 const { DOMAIN } = require('./constants');
 const logger = require('./logger');
+const { detectDistro, dockerInstallSteps } = require('./linuxDistro');
 
 // Cluster-level manifests: bundled under cli/assets/ in the npm package (copied there by
 // scripts/sync-assets.js at pack time), or read straight from the repo root in a git checkout.
@@ -16,6 +17,15 @@ const MANIFESTS_DIR = fs.existsSync(BUNDLED_MANIFESTS_DIR)
   ? BUNDLED_MANIFESTS_DIR
   : path.resolve(__dirname, '..', '..', '..', 'cluster', 'manifests');
 
+function isWsl() {
+  if (process.platform !== 'linux') return false;
+  try {
+    return /microsoft/i.test(fs.readFileSync('/proc/version', 'utf8'));
+  } catch (e) {
+    return false;
+  }
+}
+
 function registryNameFor(clusterName) {
   return `${clusterName}-registry`;
 }
@@ -27,16 +37,78 @@ function clusterExists(clusterName) {
     .includes(clusterName);
 }
 
+// k3d writes the API server as https://0.0.0.0:<port> into kubeconfig. Linux and Windows treat
+// 0.0.0.0 as "this host", but macOS refuses to connect to it ("can't assign requested address"),
+// so every kubectl call fails. Selects the cluster's context and points it at 127.0.0.1 instead,
+// which also repairs clusters created before this fix.
+function useClusterContext(clusterName) {
+  const context = `k3d-${clusterName}`;
+  run('kubectl', ['config', 'use-context', context], { stdio: 'ignore' });
+  const server = capture('kubectl', [
+    'config', 'view', '--minify', '-o', 'jsonpath={.clusters[0].cluster.server}',
+  ]).stdout;
+  if (server.includes('//0.0.0.0:')) {
+    run('kubectl', [
+      'config', 'set-cluster', context, `--server=${server.replace('//0.0.0.0:', '//127.0.0.1:')}`,
+    ], { stdio: 'ignore' });
+  }
+}
+
+// Generated fresh per call, not a static file: every Main project needs its own cluster name,
+// ports, and registry mirror name baked in.
+function buildK3dConfig({ clusterName, httpPort, httpsPort, registryName }) {
+  return {
+    apiVersion: 'k3d.io/v1alpha5',
+    kind: 'Simple',
+    metadata: { name: clusterName },
+    servers: 1,
+    agents: 0,
+    ports: [
+      { port: `${httpPort}:80`, nodeFilters: ['loadbalancer'] },
+      { port: `${httpsPort}:443`, nodeFilters: ['loadbalancer'] },
+    ],
+    options: {
+      k3s: {
+        // metrics-server only feeds `kubectl top` and HPAs, which a local dev loop doesn't use;
+        // dropping it saves memory. servicelb must stay: it's what opens :80/:443 on the node for
+        // Traefik's LoadBalancer Service, so disabling it would break every ingress.
+        extraArgs: [{ arg: '--disable=metrics-server', nodeFilters: ['server:*'] }],
+      },
+    },
+    // Plain container + mirror config, not k3d's built-in `registries.create`: that hard-codes
+    // attaching to a network literally named "bridge", which Docker has by default but Podman
+    // does not, breaking cluster creation there.
+    registries: {
+      config: yaml.dump({ mirrors: { [`${registryName}:5000`]: { endpoint: [`http://${registryName}:5000`] } } }),
+    },
+  };
+}
+
 // Brings up (idempotently) one Main project's cluster: container engine + tool checks, the k3d
 // cluster itself (own ports, since two clusters can't both bind host :80/:443), its own local
 // registry container, and the shared *.local.test TLS cert wired into its Traefik. Used by both
 // `localctl setup` (the "default" profile, unchanged ports/names from before multi-project
 // support) and `localctl profiles new`/`switch` (any other Main project).
 function provisionCluster({ clusterName, httpPort, httpsPort, registryPort }) {
+  warnIfExperimentalPlatform();
+  if (isWsl()) {
+    logger.warn('WSL detected: browsers on Windows read C:\\Windows\\System32\\drivers\\etc\\hosts, not this distro\'s /etc/hosts, and WSL may regenerate /etc/hosts on restart. Add the *.local.test entries to the Windows hosts file too (localctl prints them), or run localctl from Windows instead.');
+  }
   logger.step('Detecting container engine...');
   const detected = detectEngine();
   if (!detected) {
-    throw new Error('No running container engine found. Start Docker Desktop, Podman, or Rancher Desktop and re-run.');
+    let linuxHint = '';
+    if (process.platform === 'linux') {
+      const steps = dockerInstallSteps(detectDistro().family);
+      linuxHint = '\nOn Linux: if Docker is installed, make sure the service runs and your user can reach it' +
+        ' (member of the "docker" group, then log out and in).';
+      if (steps) {
+        linuxHint += `\nTo install Docker Engine, run "localctl setup --install-docker", or by hand:\n  ${steps.join('\n  ')}`;
+      } else {
+        linuxHint += '\nInstall Docker Engine for your distro: https://docs.docker.com/engine/install/';
+      }
+    }
+    throw new Error(`No running container engine found. Start Docker Desktop, Podman, or Rancher Desktop and re-run.${linuxHint}`);
   }
   const { engine, bin: engineBin } = detected;
   logger.success(`Using container engine: ${engine} (${engineBin} CLI)`);
@@ -47,6 +119,14 @@ function provisionCluster({ clusterName, httpPort, httpsPort, registryPort }) {
   // exist, but re-running it per registry port is cheap and idempotent.
   if (engine === 'podman') {
     ensureInsecureRegistry(registryPort);
+    if (process.platform === 'linux') {
+      const socketProblem = ensurePodmanSocket();
+      if (socketProblem) logger.warn(socketProblem);
+      const blocked = blockedPrivilegedPorts([httpPort, httpsPort]);
+      if (blocked.length) {
+        logger.warn(`Rootless Podman can't bind host port(s) ${blocked.join(', ')}. Allow it with: sudo sysctl net.ipv4.ip_unprivileged_port_start=80 (add it to /etc/sysctl.d/ to persist).`);
+      }
+    }
   }
 
   installIfMissing('k3d', 'k3d', 'k3d.k3d');
@@ -54,39 +134,58 @@ function provisionCluster({ clusterName, httpPort, httpsPort, registryPort }) {
   installIfMissing('tilt', 'tilt', installTiltWindows);
   installIfMissing('mkcert', 'mkcert', 'FiloSottile.mkcert');
   installIfMissing('helm', 'helm', 'Helm.Helm');
+  // mkcert can only add its CA to Firefox's trust store when NSS's certutil is present. It's
+  // optional (Safari/Chrome don't need it), so a failed or impossible install - e.g. no Homebrew -
+  // only warns. macOS installs it automatically; Linux needs sudo, so it only prints the command.
+  if (!commandExists('certutil')) {
+    if (process.platform === 'darwin') {
+      if (commandExists('brew')) {
+        try {
+          installIfMissing('certutil', 'nss');
+        } catch (e) {
+          logger.warn(`Couldn't install nss (${e.message}). Firefox won't trust the local CA until you run "brew install nss && mkcert -install".`);
+        }
+      } else {
+        logger.warn('Homebrew not found, skipping nss. Firefox won\'t trust the local CA until certutil is installed and "mkcert -install" is re-run.');
+        logger.info('Tip: install Homebrew (https://brew.sh) so localctl can install missing tools for you, then run "brew install nss".');
+      }
+    } else if (process.platform === 'linux') {
+      logger.warn(`certutil not found, so Firefox/Chromium won't trust the local CA. Install it with: ${nssInstallHint()} - then re-run "mkcert -install".`);
+    }
+  }
 
   const registryName = registryNameFor(clusterName);
 
   if (clusterExists(clusterName)) {
     logger.success(`k3d cluster '${clusterName}' already exists`);
+    // A reboot or engine restart leaves the cluster stopped; `start` is a no-op when it's running.
+    run('k3d', ['cluster', 'start', clusterName, '--wait'], { stdio: 'ignore', allowFail: true });
   } else {
     logger.step(`Creating k3d cluster '${clusterName}'...`);
-    // Generated fresh per call, not a static file: every Main project needs its own cluster
-    // name, ports, and registry mirror name baked in.
-    const k3dConfig = {
-      apiVersion: 'k3d.io/v1alpha5',
-      kind: 'Simple',
-      metadata: { name: clusterName },
-      servers: 1,
-      agents: 0,
-      ports: [
-        { port: `${httpPort}:80`, nodeFilters: ['loadbalancer'] },
-        { port: `${httpsPort}:443`, nodeFilters: ['loadbalancer'] },
-      ],
-      // Plain container + mirror config, not k3d's built-in `registries.create`: that hard-codes
-      // attaching to a network literally named "bridge", which Docker has by default but Podman
-      // does not, breaking cluster creation there.
-      registries: {
-        config: yaml.dump({ mirrors: { [`${registryName}:5000`]: { endpoint: [`http://${registryName}:5000`] } } }),
-      },
-    };
+    const k3dConfig = buildK3dConfig({ clusterName, httpPort, httpsPort, registryName });
     const tmpConfig = path.join(os.tmpdir(), `localctl-k3d-config-${clusterName}.yaml`);
     fs.writeFileSync(tmpConfig, yaml.dump(k3dConfig));
     run('k3d', ['cluster', 'create', '--config', tmpConfig, '--wait']);
     fs.rmSync(tmpConfig, { force: true });
     logger.success('Cluster created');
   }
-  run('kubectl', ['config', 'use-context', `k3d-${clusterName}`], { stdio: 'ignore' });
+  useClusterContext(clusterName);
+
+  // Right after a (re)start the load balancer can accept connections before the API server is
+  // answering (EOF / connection refused), so wait for it before the first real kubectl call.
+  logger.step('Waiting for the Kubernetes API...');
+  // After an engine restart the server container can get a new IP while the load balancer
+  // (nginx, resolves upstreams only at startup) keeps the old one, so the API never answers.
+  // Restarting the load balancer once re-resolves it.
+  let lbRestarted = false;
+  for (let i = 0; i < 60; i += 1) {
+    if (capture('kubectl', ['get', '--raw', '/readyz']).status === 0) break;
+    if (i === 5 && !lbRestarted) {
+      lbRestarted = true;
+      run(engineBin, ['restart', `k3d-${clusterName}-serverlb`], { stdio: 'ignore', allowFail: true });
+    }
+    sleepSync(2000);
+  }
 
   const registryNetwork = `k3d-${clusterName}`;
   const existingNames = capture(engineBin, ['ps', '-a', '--format', '{{.Names}}']).stdout.split('\n');
@@ -165,7 +264,7 @@ function ensureClusterUp(clusterName, profileName) {
     const fix = profileName === 'default' ? 'localctl setup' : `localctl profiles switch ${profileName}`;
     throw new Error(`No cluster running for project "${profileName}". Run "${fix}" to start it.`);
   }
-  run('kubectl', ['config', 'use-context', `k3d-${clusterName}`], { stdio: 'ignore' });
+  useClusterContext(clusterName);
 }
 
-module.exports = { provisionCluster, teardownCluster, clusterExists, registryNameFor, ensureClusterUp };
+module.exports = { buildK3dConfig, provisionCluster, teardownCluster, clusterExists, registryNameFor, ensureClusterUp };

package/src/lib/engine.js

@@ -4,8 +4,8 @@ const logger = require('./logger');
 // Support status per engine lives in cli/package.json ("localctl.containerEngines"), so marking an
 // engine as tested is a one-word config change, not a code change. "tested" means verified end to
 // end; anything else (or an engine missing from the map) gets the experimental warning.
-const { localctl: { containerEngines = {} } = {} } = require('../../package.json');
-const ENGINE_LABELS = { docker: 'Docker Desktop', podman: 'Podman', 'rancher-desktop': 'Rancher Desktop' };
+const { localctl: { containerEngines = {}, platforms = {} } = {} } = require('../../package.json');
+const ENGINE_LABELS = { docker: 'Docker', podman: 'Podman', 'rancher-desktop': 'Rancher Desktop' };
 const ISSUES_URL = 'https://github.com/psilvmoreira/localctl/issues';
 
 // Returns { engine, bin } - `engine` names what's actually running (docker/podman/rancher-desktop),
@@ -33,4 +33,14 @@ function warnIfExperimental(engine) {
   logger.warn(`If something breaks, please report it: ${ISSUES_URL}`);
 }
 
-module.exports = { detectEngine, warnIfExperimental };
+const PLATFORM_LABELS = { darwin: 'macOS', win32: 'Windows', linux: 'Linux' };
+
+// Same idea as warnIfExperimental(), for the operating system: platform status lives in
+// cli/package.json ("localctl.platforms").
+function warnIfExperimentalPlatform() {
+  if (!platforms[process.platform] || platforms[process.platform] === 'tested') return;
+  logger.warn(`${PLATFORM_LABELS[process.platform] || process.platform} support is experimental - it hasn't been through a full test cycle yet.`);
+  logger.warn(`If something breaks, please report it: ${ISSUES_URL}`);
+}
+
+module.exports = { detectEngine, warnIfExperimental, warnIfExperimentalPlatform };

package/src/lib/hostsFile.js

@@ -24,6 +24,20 @@ function listApps() {
   return Object.keys(registry);
 }
 
+// The Windows counterpart of `sudo cp`: copies src over the hosts file from an elevated
+// PowerShell, which raises a UAC prompt. Returns false if the prompt is declined or the copy
+// fails. The inner command goes through -EncodedCommand so paths need no nested quoting.
+function copyElevatedWindows(src) {
+  const quote = (s) => `'${s.replace(/'/g, "''")}'`;
+  const inner = `Copy-Item -LiteralPath ${quote(src)} -Destination ${quote(HOSTS_PATH)} -Force`;
+  const encoded = Buffer.from(inner, 'utf16le').toString('base64');
+  const res = spawnSync('powershell', [
+    '-NoProfile', '-NonInteractive', '-Command',
+    `Start-Process powershell -Verb RunAs -Wait -WindowStyle Hidden -ArgumentList '-NoProfile','-NonInteractive','-EncodedCommand','${encoded}'`,
+  ], { stdio: 'ignore' });
+  return res.status === 0;
+}
+
 function writeHosts(next, current) {
   if (next === current) {
     logger.info('Hosts file already up to date.');
@@ -38,8 +52,13 @@ function writeHosts(next, current) {
     const tmp = path.join(os.tmpdir(), 'localctl-hosts-new');
     fs.writeFileSync(tmp, next);
     if (process.platform === 'win32') {
-      logger.warn('Need Administrator rights to update the hosts file. Run in an elevated PowerShell:');
-      console.log(`  Copy-Item "${tmp}" "${HOSTS_PATH}" -Force`);
+      logger.warn('Need Administrator rights to update the hosts file. Approve the Windows prompt to continue.');
+      if (copyElevatedWindows(tmp) && fs.readFileSync(HOSTS_PATH, 'utf8') === next) {
+        logger.success(`Updated ${HOSTS_PATH}`);
+      } else {
+        logger.warn('Hosts file not updated, so *.local.test addresses won\'t resolve. Run in an elevated PowerShell:');
+        console.log(`  Copy-Item "${tmp}" "${HOSTS_PATH}" -Force`);
+      }
     } else {
       logger.warn('Need sudo to update the hosts file.');
       const res = spawnSync('sudo', ['cp', tmp, HOSTS_PATH], { stdio: 'inherit' });

package/src/lib/linuxDistro.js

@@ -0,0 +1,102 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { run, commandExists } = require('./exec');
+const logger = require('./logger');
+
+// Families localctl knows how to give exact commands for. Anything else is "unknown" and gets
+// generic guidance instead of a guess.
+const FAMILY_BY_ID = [
+  ['debian', ['debian', 'ubuntu']],
+  ['rhel', ['fedora', 'rhel', 'centos', 'rocky', 'almalinux']],
+  ['arch', ['arch']],
+  ['suse', ['suse', 'opensuse']],
+  ['alpine', ['alpine']],
+];
+
+// Reads ID and ID_LIKE from os-release, so derivatives resolve to their parent (Mint, Pop!_OS ->
+// debian; Rocky, Alma -> rhel; Manjaro -> arch).
+function detectDistro() {
+  let release = '';
+  try {
+    release = fs.readFileSync('/etc/os-release', 'utf8');
+  } catch (e) {
+    return { id: 'unknown', family: 'unknown' };
+  }
+  const value = (key) => {
+    const m = release.match(new RegExp(`^${key}=(.*)$`, 'm'));
+    return m ? m[1].replace(/"/g, '').trim() : '';
+  };
+  const id = value('ID') || 'unknown';
+  const ids = [id, ...value('ID_LIKE').split(/\s+/)].filter(Boolean);
+  const match = FAMILY_BY_ID.find(([, names]) => names.some((n) => ids.includes(n)));
+  return { id, family: match ? match[0] : 'unknown' };
+}
+
+function hasSystemd() {
+  return fs.existsSync('/run/systemd/system');
+}
+
+function isRoot() {
+  return typeof process.getuid === 'function' && process.getuid() === 0;
+}
+
+// What `localctl setup --install-docker` would do, as printable steps. Shown in the "no engine"
+// error too, so the user can run them by hand. Returns null for families without a known recipe.
+function dockerInstallSteps(family) {
+  const sudo = isRoot() ? '' : 'sudo ';
+  const user = os.userInfo().username;
+  let install;
+  if (family === 'debian' || family === 'rhel') {
+    install = [`curl -fsSL https://get.docker.com -o get-docker.sh && ${sudo}sh get-docker.sh`];
+  } else if (family === 'arch') {
+    install = [`${sudo}pacman -S --noconfirm docker`];
+  } else if (family === 'suse') {
+    install = [`${sudo}zypper --non-interactive install docker`];
+  } else {
+    return null;
+  }
+  const steps = [...install];
+  if (hasSystemd()) steps.push(`${sudo}systemctl enable --now docker`);
+  if (!isRoot()) steps.push(`${sudo}usermod -aG docker ${user}`);
+  return steps;
+}
+
+// Runs dockerInstallSteps() for real. The download goes to a temp file first (never piped into a
+// shell) and Docker's official script is the only remote code involved. Needs sudo, so it only
+// ever runs on an explicit `--install-docker`.
+function installDocker() {
+  const { family, id } = detectDistro();
+  if (!dockerInstallSteps(family)) {
+    throw new Error(`No automatic Docker install for "${id}". Install Docker Engine for your distro (https://docs.docker.com/engine/install/) and re-run.`);
+  }
+  if (!commandExists('curl') && (family === 'debian' || family === 'rhel')) {
+    throw new Error('curl is needed to download the Docker install script. Install it and re-run.');
+  }
+  logger.step(`Installing Docker Engine (${id}). This needs sudo and will prompt for your password...`);
+  const sudo = isRoot() ? [] : ['sudo'];
+  const exec = (cmd, args) => run(sudo.length ? sudo[0] : cmd, sudo.length ? [cmd, ...args] : args);
+
+  if (family === 'debian' || family === 'rhel') {
+    const script = path.join(os.tmpdir(), 'localctl-get-docker.sh');
+    run('curl', ['-fsSL', 'https://get.docker.com', '-o', script]);
+    try {
+      exec('sh', [script]);
+    } finally {
+      fs.rmSync(script, { force: true });
+    }
+  } else if (family === 'arch') {
+    exec('pacman', ['-S', '--noconfirm', 'docker']);
+  } else if (family === 'suse') {
+    exec('zypper', ['--non-interactive', 'install', 'docker']);
+  }
+  if (hasSystemd()) exec('systemctl', ['enable', '--now', 'docker']);
+  if (!isRoot()) exec('usermod', ['-aG', 'docker', os.userInfo().username]);
+
+  logger.success('Docker installed.');
+  if (!isRoot()) {
+    logger.warn('Group membership only applies to new sessions: log out and back in (or run "newgrp docker"), then re-run "localctl setup".');
+  }
+}
+
+module.exports = { detectDistro, hasSystemd, dockerInstallSteps, installDocker };

package/src/lib/podman.js

@@ -1,8 +1,46 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
 const { run, capture } = require('./exec');
 const logger = require('./logger');
 
 const CONF_PATH = '/etc/containers/registries.conf.d/999-local-dev.conf';
 
+// Native Podman (Linux) has no VM: its registries.conf lives on the host. Rootless Podman reads
+// the per-user drop-in directory (no sudo needed); root reads the system one.
+function nativeConfPath() {
+  if (typeof process.getuid === 'function' && process.getuid() === 0) return CONF_PATH;
+  const configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+  return path.join(configHome, 'containers', 'registries.conf.d', '999-local-dev.conf');
+}
+
+// Linux native Podman: no `podman machine`. Containers-image re-reads registries.conf on every
+// invocation, so unlike the VM case there's nothing to restart.
+function ensureInsecureRegistryNative(hostPort) {
+  const file = nativeConfPath();
+  const current = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : '';
+  if (current.includes(`location = "localhost:${hostPort}"`)) {
+    logger.success(`Podman already trusts localhost:${hostPort} as an insecure registry`);
+    return;
+  }
+  logger.step(`Marking localhost:${hostPort} as an insecure registry for Podman (${file})...`);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  const next = `${current.trimEnd()}\n\n${registryBlock(hostPort)}`.trim().concat('\n');
+  fs.writeFileSync(file, next);
+  logger.success('Podman registry config updated');
+}
+
+function teardownInsecureRegistryNative() {
+  const file = nativeConfPath();
+  if (!fs.existsSync(file)) return;
+  fs.rmSync(file, { force: true });
+  logger.success(`Removed insecure-registry config ${file}`);
+}
+
+function isNativePodman() {
+  return process.platform === 'linux';
+}
+
 function machineName() {
   const res = capture('podman', ['machine', 'list', '--format', '{{.Name}}']);
   const [first] = res.stdout.split('\n').filter(Boolean);
@@ -34,7 +72,10 @@ function registryBlock(hostPort) {
 // something tried to use it. One file, one block per port ever provisioned on this machine.
 function ensureInsecureRegistry(hostPort) {
   const machine = machineName();
-  if (!machine) return;
+  if (!machine) {
+    if (isNativePodman()) ensureInsecureRegistryNative(hostPort);
+    return;
+  }
 
   const current = capture('podman', ['machine', 'ssh', machine, `cat ${CONF_PATH} 2>/dev/null`]).stdout;
   if (current.includes(`location = "localhost:${hostPort}"`)) {
@@ -57,7 +98,10 @@ function ensureInsecureRegistry(hostPort) {
 
 function teardownInsecureRegistry() {
   const machine = machineName();
-  if (!machine) return;
+  if (!machine) {
+    if (isNativePodman()) teardownInsecureRegistryNative();
+    return;
+  }
 
   const exists = capture('podman', ['machine', 'ssh', machine, `test -f ${CONF_PATH} && echo yes`]).stdout;
   if (exists.trim() !== 'yes') return;
@@ -69,4 +113,50 @@ function teardownInsecureRegistry() {
   logger.success('Podman VM config removed and machine restarted');
 }
 
-module.exports = { ensureInsecureRegistry, teardownInsecureRegistry };
+// k3d talks to the container engine through the Docker API socket. Docker exposes it by default;
+// Podman only when its socket service is running, and k3d finds it through DOCKER_HOST. Points
+// DOCKER_HOST at Podman's socket when it exists, and returns a problem description (or null).
+function ensurePodmanSocket() {
+  if (process.env.DOCKER_HOST) return null;
+  const res = capture('podman', ['info', '--format', '{{.Host.RemoteSocket.Path}}']);
+  const socket = res.status === 0 ? res.stdout.replace(/^unix:\/\//, '') : '';
+  if (socket && fs.existsSync(socket)) {
+    process.env.DOCKER_HOST = `unix://${socket}`;
+    logger.info(`Using the Podman socket at ${socket} (DOCKER_HOST)`);
+    return null;
+  }
+  return 'Podman\'s API socket isn\'t running, which k3d needs. Start it with: systemctl --user enable --now podman.socket';
+}
+
+// Rootless Podman can't bind host ports below net.ipv4.ip_unprivileged_port_start (1024 by
+// default), and the cluster maps host :80/:443. Returns the ports that will fail to bind.
+function blockedPrivilegedPorts(ports) {
+  const rootless = capture('podman', ['info', '--format', '{{.Host.Security.Rootless}}']).stdout === 'true';
+  if (!rootless) return [];
+  let start = 1024;
+  try {
+    start = parseInt(fs.readFileSync('/proc/sys/net/ipv4/ip_unprivileged_port_start', 'utf8'), 10);
+  } catch (e) {
+    // keep the default
+  }
+  return ports.filter((p) => p < start);
+}
+
+// Memory (MB) available to containers: the Podman VM on macOS/Windows, the host on native Linux.
+// Returns null when it can't be determined. Docker Desktop's VM size comes from `docker info`.
+function engineMemoryMb(engineBin) {
+  const res = capture(engineBin, ['info', '--format', '{{.MemTotal}}']);
+  const bytes = parseInt(res.stdout, 10);
+  if (res.status === 0 && Number.isFinite(bytes) && bytes > 0) return Math.round(bytes / 1024 / 1024);
+  const info = capture(engineBin, ['info', '--format', '{{.Host.MemTotal}}']);
+  const hostBytes = parseInt(info.stdout, 10);
+  return info.status === 0 && Number.isFinite(hostBytes) && hostBytes > 0 ? Math.round(hostBytes / 1024 / 1024) : null;
+}
+
+module.exports = {
+  engineMemoryMb,
+  ensureInsecureRegistry,
+  teardownInsecureRegistry,
+  ensurePodmanSocket,
+  blockedPrivilegedPorts,
+};

package/src/lib/toolInstall.js

@@ -1,7 +1,9 @@
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
-const { commandExists, run } = require('./exec');
+const { commandExists, run, capture } = require('./exec');
 const logger = require('./logger');
+const { detectDistro } = require('./linuxDistro');
 const { HOME_STATE_DIR } = require('./paths');
 
 // Tools that have no package-manager package on a platform get downloaded here instead. The
@@ -65,6 +67,141 @@ function installTiltWindows() {
   logger.success(`tilt installed in ${TOOLS_DIR} (added to your PATH for new terminals)`);
 }
 
+
+// ---- Linux ----
+// There's no single package manager to lean on across distros, so missing tools are fetched as
+// the vendors' own release binaries straight into TOOLS_DIR (no sudo, no distro packages). That
+// directory is on this process's PATH via addToolsDirToPath(), so setup carries on immediately.
+// Needs only curl (and tar for tilt/helm), which every mainstream distro ships.
+
+const LINUX_ARCH = { x64: 'amd64', arm64: 'arm64' };
+
+function linuxArch() {
+  const arch = LINUX_ARCH[process.arch];
+  if (!arch) throw new Error(`Unsupported CPU architecture "${process.arch}". Install the tool manually.`);
+  return arch;
+}
+
+function requireLinuxDownloadTools(...tools) {
+  const missing = tools.filter((t) => !commandExists(t));
+  if (missing.length) {
+    throw new Error(`${missing.join(' and ')} ${missing.length > 1 ? 'are' : 'is'} needed to download missing tools. Install ${missing.length > 1 ? 'them' : 'it'} with your package manager and re-run.`);
+  }
+}
+
+function download(url, dest) {
+  logger.info(`Downloading ${url}`);
+  run('curl', ['-fsSL', '--retry', '3', '-o', dest, url]);
+}
+
+// Final path segment of the URL a redirect lands on, e.g. ".../releases/tag/v0.33.0" -> "v0.33.0".
+function latestGitHubTag(repo) {
+  const res = capture('curl', [
+    '-fsSLI', '-o', '/dev/null', '-w', '%{url_effective}',
+    `https://github.com/${repo}/releases/latest`,
+  ]);
+  const tag = res.stdout.split('/').pop();
+  if (res.status !== 0 || !/^v?\d/.test(tag)) throw new Error(`Couldn't resolve the latest ${repo} release.`);
+  return tag;
+}
+
+function makeExecutable(file) {
+  fs.chmodSync(file, 0o755);
+}
+
+function installBinaryLinux(bin, url) {
+  fs.mkdirSync(TOOLS_DIR, { recursive: true });
+  const dest = path.join(TOOLS_DIR, bin);
+  download(url, dest);
+  makeExecutable(dest);
+}
+
+// Downloads a .tar.gz and moves one file out of it into TOOLS_DIR.
+function installFromTarballLinux(bin, url, innerPath) {
+  fs.mkdirSync(TOOLS_DIR, { recursive: true });
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), `localctl-${bin}-`));
+  try {
+    const archive = path.join(tmp, 'archive.tar.gz');
+    download(url, archive);
+    run('tar', ['-xzf', archive, '-C', tmp]);
+    const dest = path.join(TOOLS_DIR, bin);
+    fs.copyFileSync(path.join(tmp, innerPath), dest);
+    makeExecutable(dest);
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+const LINUX_INSTALLERS = {
+  k3d() {
+    installBinaryLinux('k3d', `https://github.com/k3d-io/k3d/releases/latest/download/k3d-linux-${linuxArch()}`);
+  },
+  kubectl() {
+    const version = capture('curl', ['-fsSL', 'https://dl.k8s.io/release/stable.txt']).stdout;
+    if (!/^v\d/.test(version)) throw new Error("Couldn't resolve the latest kubectl release.");
+    installBinaryLinux('kubectl', `https://dl.k8s.io/release/${version}/bin/linux/${linuxArch()}/kubectl`);
+  },
+  mkcert() {
+    installBinaryLinux('mkcert', `https://dl.filippo.io/mkcert/latest?for=linux/${linuxArch()}`);
+  },
+  helm() {
+    const version = capture('curl', ['-fsSL', 'https://get.helm.sh/helm-latest-version']).stdout;
+    if (!/^v\d/.test(version)) throw new Error("Couldn't resolve the latest helm release.");
+    const arch = linuxArch();
+    installFromTarballLinux('helm', `https://get.helm.sh/helm-${version}-linux-${arch}.tar.gz`, `linux-${arch}/helm`);
+  },
+  tilt() {
+    const version = latestGitHubTag('tilt-dev/tilt').replace(/^v/, '');
+    const arch = process.arch === 'arm64' ? 'arm64' : 'x86_64';
+    installFromTarballLinux('tilt', `https://github.com/tilt-dev/tilt/releases/download/v${version}/tilt.${version}.linux.${arch}.tar.gz`, 'tilt');
+  },
+};
+
+// Tools land in TOOLS_DIR, which localctl puts on its own PATH, but a terminal opened later (to
+// run `kubectl` by hand, say) wouldn't see them. Persist it in the shell's rc file, with the same
+// marker bin/bootstrap.sh uses so bin/uninstall.sh cleans it up. bash and zsh only: other shells
+// get the line to add themselves.
+function persistToolsDirOnPath() {
+  const shell = path.basename(process.env.SHELL || '');
+  const rcName = { zsh: '.zshrc', bash: '.bashrc' }[shell];
+  const line = 'export PATH="$HOME/.localctl/tools:$PATH"';
+  if (!rcName) {
+    logger.info(`Add ${TOOLS_DIR} to your PATH to use these tools from your own terminal: ${line}`);
+    return;
+  }
+  const rc = path.join(os.homedir(), rcName);
+  const current = fs.existsSync(rc) ? fs.readFileSync(rc, 'utf8') : '';
+  if (current.includes('.localctl/tools')) return;
+  fs.appendFileSync(rc, `\n# Added by localctl bootstrap\n${line}\n`);
+  logger.info(`Added ${TOOLS_DIR} to PATH in ~/${rcName} - open a new terminal to pick it up.`);
+}
+
+function installLinux(bin) {
+  const installer = LINUX_INSTALLERS[bin];
+  if (!installer) {
+    throw new Error(`"${bin}" is missing and automatic install isn't supported for it on Linux. Install it with your package manager.`);
+  }
+  requireLinuxDownloadTools('curl', ...(bin === 'helm' || bin === 'tilt' ? ['tar'] : []));
+  logger.step(`Installing ${bin} from its official release (no sudo, into ${TOOLS_DIR})...`);
+  installer();
+  addToolsDirToPath();
+  persistToolsDirOnPath();
+  logger.success(`${bin} installed in ${TOOLS_DIR}`);
+}
+
+// Distro-specific command for the NSS tools (certutil), which mkcert needs to trust its CA in
+// Firefox/Chromium. Not installed automatically: it needs sudo, and it's optional.
+function nssInstallHint() {
+  const { family } = detectDistro();
+  return {
+    debian: 'sudo apt install libnss3-tools',
+    rhel: 'sudo dnf install nss-tools',
+    arch: 'sudo pacman -S nss',
+    suse: 'sudo zypper install mozilla-nss-tools',
+    alpine: 'sudo apk add nss-tools',
+  }[family] || "your distro's NSS tools package (provides certutil)";
+}
+
 // macId: Homebrew formula name. winId: winget package id, or a function that installs the tool
 // when winget doesn't have it.
 function installIfMissing(bin, macId, winId) {
@@ -92,9 +229,11 @@ function installIfMissing(bin, macId, winId) {
       '--accept-package-agreements', '--accept-source-agreements',
     ]);
     addWingetLinksToPath();
+  } else if (process.platform === 'linux') {
+    installLinux(bin);
   } else {
     throw new Error(`"${bin}" is missing and automatic install isn't supported on this platform. Install it manually.`);
   }
 }
 
-module.exports = { installIfMissing, installTiltWindows, addToolsDirToPath, TOOLS_DIR };
+module.exports = { installIfMissing, installTiltWindows, addToolsDirToPath, nssInstallHint, TOOLS_DIR };