The live disk

The boot media is the Machine. The first partition carries the kernel, the packages and the saved state that is this Machine's identity; the second, ext4, is /data. Everything else is RAM, rebuilt at every boot.

Download and verify

The image is pipeos-usb.img.xz; its digest file is pipeos-usb.img.xz.sha256. Both are on downloads.

$ sha256sum -c pipeos-usb.img.xz.sha256
pipeos-usb.img.xz: OK

The same image boots from USB, SATA or NVMe; the media is found by its PIPEOS label. It is written to a whole disk, never a partition, and erases everything on it. First boot carves the rest of the disk into /data.

One line, macOS or Linux

The flasher lists your removable disks, asks which one, fetches the latest release, verifies its digest and writes it; your operating system asks for your password once.

$ curl -sSf https://pipe.online/flash.sh | sh

Windows

Use Rufus (rufus.ie); it reads the compressed image as it is. Pick your stick under Device, SELECT pipeos-usb.img.xz, START. Everything on the stick is erased.

By hand

Read the device path twice: dd to the wrong disk is irreversible.

$ xz -dc pipeos-usb.img.xz | sudo dd of=/dev/sdX bs=4M conv=fsync

Then boot the box UEFI with Secure Boot off and open http://pipeos.local/: first boot. A stick made any of these ways is nobody's until the first visitor claims it.

From a Machine you already run

pipeos flash check	compare the running image with the latest release; the Live disk row under System reads the same
pipeos flash fetch	download into `/data` and verify against the release's digest (about 2 GB down, 6 GB free needed)
pipeos flash apply	rewrite this Machine's boot partition in place, keeping identity and `/data`. Flash a new live disk runs this; automatic updates run it hourly (persistence and updates)
pipeos flash apply --to /dev/sdX	write the released image and this Machine's identity onto a spare whole disk: this Machine's next stick

--to makes a replacement stick for this Machine: the new disk boots as this box, with its claim, users, sign-ins and sealed vault. It is not a way to make a stick for another box; that is the generic image, written from any computer as above. The typed confirmation is the device path.

/data is not copied. pipeos restore-work /data --onto /dev/sdX2 copies it onto the new stick before the swap, or pipeos restore-work /dev/<old>2 brings it from the old stick afterwards. Then:

$ pipeos save                # state as of now, onto the current stick
$ poweroff
# remove the old stick, boot from the new one

Remove the old stick before booting the new one. Both carry the same labels and the box mounts by label; two attached at boot is a coin toss. Keep the old stick until the new one has booted and saved once. What can go wrong is under recovery.