Shadowrocket for Linux: How to Install DEB, RPM, and AppImage

At a glance

For Ubuntu and Debian, start with DEB; for Fedora and other dnf-based systems, start with RPM. Choose AppImage if you want to keep the program as a standalone file. This guide covers checking your distribution and CPU architecture, installing a local package, setting execute permissions, first launch, and connection testing. It assumes you already have a subscription from your provider. Installing the app does not configure a network connection.

1. Check your distribution, architecture, and package

Shadowrocket for Linux is free. Choose a package from the Linux section of the download page. DEB, RPM, and AppImage are package formats—not different subscriptions—and the file extension alone does not tell you whether a package matches your processor. Before downloading, check your distribution, package architecture, and the system requirements listed on the page.

Open a terminal and run these two commands. /etc/os-release identifies your distribution; uname -m reports the architecture of the running kernel. Common values such as x86_64 and aarch64 are not interchangeable. Package managers may use the names amd64 and arm64 instead.

cat /etc/os-release
uname -m

Ubuntu, Debian, and compatible distributions: Choose DEB and install the local file with apt so the package manager can resolve dependencies.
Fedora and other dnf-based distributions: Choose RPM and install it with dnf. An RPM extension does not mean every RPM-based distribution can use the same package.
Other desktop distributions: Check the AppImage architecture and system requirements. AppImage is not guaranteed to run on every Linux environment.

2. Install a local DEB package with apt

Run these commands in Bash. Put the downloaded DEB file somewhere easy to find, then copy its full absolute path—for example, by checking the file's properties in your file manager. Don't add quotation marks around the path or use the browser's download link as a local path. The variable in the command handles spaces in the path.

read -r -p "Paste the full absolute path to the DEB file: " pkg
test -f "$pkg" && sudo apt install "$pkg"

A local file path after apt install tells apt to install that file rather than search the software repositories for an app with the same name. Using an absolute path avoids errors caused by being in the wrong directory. If the terminal asks for a password, enter your current Linux account password. You usually won't see characters as you type.

Check the file

Choose the DEB package on the download page and wait for the browser to finish downloading it. Make sure the file is not a temporary, still-downloading file, and check that its architecture matches the page listing.
Install the package

Paste the full path at the terminal prompt and press Enter. Review the packages apt plans to install, upgrade, or remove, then confirm to continue.
Resolve dependencies

If apt reports unmet dependencies, run sudo apt update and retry the install command. If it still fails, note the missing dependency names rather than ignoring them.
Launch the app

After installation, search for Shadowrocket in your desktop's app menu and launch it as a regular user. If it doesn't appear right away, log out of your desktop session and back in, then check again.

If the system reports an architecture mismatch, return to the download page and choose the correct package instead of forcing installation. If a library version is too old, refreshing the software repositories may not help: your distribution may not provide a recent enough system library. Check the supported environment, and don't replace core system libraries just to install one app.

3. Install a local RPM package with dnf

On dnf-based systems, the approach is the same as for DEB: specify the downloaded local file and let the distribution's package manager resolve dependencies. The command below uses an absolute path. You don't need to rename the file or assume a particular download filename.

read -r -p "Paste the full absolute path to the RPM file: " pkg
test -f "$pkg" && sudo dnf install "$pkg"

Review the confirmation list: Check where dependencies will come from and review the transaction. Continue only if it won't unexpectedly remove important desktop components.
Dependencies not found: Make sure your system's software repositories are available. Refresh the metadata with sudo dnf makecache --refresh, then retry the installation.
Architecture or distribution not supported: Stop the installation and check the download page requirements. Don't bypass the error by skipping dependencies or forcing replacement of system files.
Integrity, signature, or trust error: Keep the original error message, confirm the file came from this site's download page, and download it again. Don't disable the package manager's security checks.

A successful installation means the package files and dependencies were added to your system; it doesn't mean the proxy is enabled. Launch Shadowrocket from the app menu, then import your subscription and configure the connection. Troubleshoot “installation failed” separately from “installation succeeded, but requests fail” to avoid masking a network issue with repeated reinstalls.

4. Run an AppImage after adding execute permissions

An AppImage usually runs as a standalone file rather than being registered as a system package through apt or dnf. Move it to a permanent folder in your home directory, then add execute permissions. Avoid launching it from the browser's temporary download folder, where it could be deleted when you clear downloads.

read -r -p "Paste the full absolute path to the AppImage file: " app
if test -f "$app"; then
  chmod u+x "$app" && "$app"
fi

chmod u+x adds execute permission for the file's owner only; the next command runs the file directly. You don't need to prefix a normal launch with sudo. If nothing happens in the desktop, keep the terminal open and check its error output—it can help identify the problem more reliably than repeatedly double-clicking.

AppImage requirements

Execute permissions: Add with chmod u+x
File location: Keep it in a permanent folder in your home directory
CPU architecture: Must match the download page and your system
Run as: A regular desktop user

A standalone file still depends on a compatible host system.

Common error clues

Permission denied: Check execute permissions and mount options
Exec format error: First check the architecture and whether the file is intact
FUSE-related errors: Check which runtime components your distribution supports
Missing shared libraries: Check the system requirements and library versions

Troubleshoot based on the error; don't run the entire app with elevated privileges as a substitute for diagnosis.

If the file is on a partition mounted with the noexec option, it may not launch even after you add execute permissions. Move it to an executable folder in your home directory and try again. FUSE component names vary by distribution, so check your system's package information first. Don't copy installation commands for another distribution directly onto your system.

5. Import a subscription and test routing after launch

First, make sure the app opens and displays its window normally. Then configure the network. Get your subscription link from your provider and treat it as sensitive information. If the interface provides the option, tap “+” in the top-right corner of Home, set Type to Subscribe, enter the link, save, and update the subscription. Desktop layouts may differ from mobile; use the option shown in your current interface.

After importing, check that the expected entries appear in the list, then select an existing entry to connect. Seeing a subscription name doesn't confirm that the update succeeded; if the list is empty, troubleshoot the subscription request first. A configuration file in Config and a server entry in Home are different things. Importing servers does not automatically ensure that the rules suit your needs.

Config

Recommended

Routes intercepted requests according to the selected configuration. Rules are matched from top to bottom; whether traffic uses a proxy or a direct connection depends on the matching rule and policy, not a fixed regional setting.

Best for: everyday routing with a configuration you've reviewed

Proxy

Routes intercepted requests through the proxy. Useful for a quick comparison with Config. This does not automatically intercept traffic from apps that weren't already routed through the proxy.

Best for: separating proxy connection issues from rule-matching issues

Direct

Routes intercepted requests directly. To compare direct and proxy paths, test the same destination in the same app after switching.

Best for: a quick direct-connection comparison

Start by checking what the three lines below mean. This is a syntax example, not a complete configuration file. PROXY must refer to a valid policy in your current configuration. Don't replace an existing configuration with this example or use it to decide which route a real website should take.

DOMAIN-SUFFIX,example.com,PROXY
IP-CIDR,192.168.0.0/16,DIRECT
FINAL,PROXY

DOMAIN-SUFFIX: Matches the specified domain suffix. The example domain is for syntax illustration only.
IP-CIDR: Matches a destination IP range. The example range is a private address block.
FINAL: The fallback policy used when no earlier rule matches. It should appear at the end of the rules.

On Linux, distinguish between “the proxy app is running” and “the target app is using the proxy.” Whether the app intercepts system traffic or you need to configure a browser or terminal separately depends on the active network mode. If the interface shows a local listening address and port, use those exact values; don't assume a fixed port number.

6. Troubleshoot common post-install issues

Double-clicking the AppImage does nothing. Should I reinstall it?

Run it from a terminal as described in section four and check the error output. For “Permission denied,” check execute permissions and noexec; for FUSE or shared library errors, install the required runtime components for your distro. Don’t assume the download is faulty without an error message.

A system permission prompt appears on first launch. What should I allow?

Check who is requesting permission and what action it will perform. Administrator authorization to install a package is different from permission to change network settings at runtime. Confirm only when you've just initiated the relevant action and the prompt matches it. Don't run the entire graphical app as root just to dismiss prompts.

Websites open in the browser, but terminal requests fail. Why?

Check whether the terminal is still using a direct connection or has old proxy environment variables set. Run env | grep -i proxy to check, then compare the result with the current listening address and port. HTTP and SOCKS proxies are different types; don't mix them up. After changing a setting, test again in the same terminal session.

Subscription update failed. Should I switch package formats?

Not as a first step. Check that the subscription link is complete and hasn't expired, and that your current network can reach its address. Then ask your provider to verify the response. When sharing an error, redact tokens and other credentials in the link. Never include the full subscription URL in a screenshot or log.

Change one condition at a time when testing. In the same browser, test the same destination with Direct, then Proxy, then check the rules in Config. If the browser works but the terminal doesn't, first check differences in the apps' proxy settings. If both fail, check the connection status, DNS, and the configuration from your provider rather than reinstalling right away.

7. Updating and removing the app

Installing a local DEB or RPM package does not automatically subscribe your system to an app update repository. When you need a newer package, check this site's download page and install it using the relevant method after closing the app. An AppImage remains a standalone file. Before replacing one, close the old process and check that desktop shortcuts no longer point to the old path.

Before updating: Back up your configuration and keep your subscription details secure. Updating program files with a package manager does not back up your personal configuration.
Remove a DEB or RPM: Find the package name in your graphical software manager's installed-app list before removing it. Don't guess the system package name from the app's display name.
Remove an AppImage: Exit the app, delete the file, and check any shortcuts you created. Removing the program file may not delete your user configuration.
Reset network settings: If you manually configured a local proxy for your browser or terminal, restore those settings after closing the app. Otherwise, requests may still be sent to a listening port that's no longer active.

Choose a package format that matches your distribution, architecture, and maintenance preferences. For installation problems, check package manager or terminal errors; for connection problems, check the subscription, traffic interception, and routing settings. Keeping these troubleshooting paths separate can prevent unnecessary reinstalls and preserve useful diagnostic information.