Shadowrocket for Linux: Install DEB, RPM, or AppImage

At a glance

For Debian and Ubuntu, choose DEB; for Fedora and other dnf-based systems, choose RPM. Use AppImage when you want a single-file application. First check your distribution and CPU architecture, then install the local package, set execute permissions, and verify the first launch. This guide is for Linux desktop users who already have their own server or subscription configuration.

1. Check your distribution and architecture before choosing a package

Package format and CPU architecture are separate considerations. DEB and RPM identify package formats; they do not tell you whether a file supports your processor. AppImage files are not architecture-independent either. Run these commands to note your distribution’s ID, ID_LIKE, and architecture, then check the download page for a matching package.

cat /etc/os-release
uname -m

The uname -m command typically returns x86_64 for x64 or amd64, and aarch64 for ARM64. If the download page does not list a matching architecture, don’t try to run a file based on its extension alone or rename a package for another architecture. Use the table below to choose a format.

System	Preferred format	How to install
Debian, Ubuntu, and compatible distributions	deb	Use apt to install the local package and resolve available dependencies
Fedora and dnf-based distributions	rpm	Use dnf to install the local package and check dependencies
Other Linux desktop environments	AppImage	Check the architecture and runtime requirements, then grant execute permission

Not every RPM-based system uses dnf. If your distribution uses another package manager, follow its instructions for installing local packages. AppImage is convenient to store and move, but it still depends on system libraries, mount support, and the desktop environment; it is not guaranteed to run on every Linux system.

2. Prepare the file and check before installing

Open the Linux section of the download guide and choose the file that matches your system and architecture. Once it has downloaded, open the folder containing the file in your file manager and use a system option such as “Open in Terminal.” Don’t assume your downloads folder is named Downloads; its path may vary with your desktop language and browser settings.

Check your system

Run cat /etc/os-release and uname -m to check your distribution family and CPU architecture.
Choose a format

Go to the Linux section of this site’s download guide, choose a DEB, RPM, or AppImage for your system, and save it to a directory you can access as your current user.
Organize the file

To make the commands below easier to follow, rename the downloaded file to Shadowrocket.deb, Shadowrocket.rpm, or Shadowrocket.AppImage. Rename only the format you actually downloaded.
Check the directory

Open a terminal in the directory containing the file. Run pwd and ls -lh to confirm the current path and that the download is complete, then use the command for your file format.

The short filenames below are local renaming examples, not the names used on the download server or separate versions to look for. If you keep the original filename, replace the example with the actual name. Put the entire path in quotes if it contains spaces. Don’t use a broad wildcard that could install several old packages from the same directory.

Package manager installation

Local DEB package: ./Shadowrocket.deb
Local RPM package: ./Shadowrocket.rpm
Installation permissions: Run the package manager with sudo
Launch for everyday use: Use your regular desktop account

Installation requires administrator privileges; the graphical application should not run as root.

Run an AppImage

Local file: ./Shadowrocket.AppImage
Execute permission: chmod u+x
Location: A local directory owned by your user
How to launch: Run it in a terminal or open it in your file manager

After granting execute permission, the file system must also allow execution and support the required mount options.

3. Install a DEB package with apt

On Debian- and Ubuntu-based systems, use apt to install a local DEB package. The ./ in the command means “a file in the current directory.” Without it, apt may search for a package by name instead of reading the installation file you downloaded.

sudo apt update
sudo apt install ./Shadowrocket.deb

The first command refreshes the index for your configured package sources. The second reads the local package and attempts to resolve its dependencies. Review apt’s summary before proceeding. If it proposes removing major desktop components, reports unresolved dependencies, or identifies an architecture mismatch, cancel and check your distribution, package sources, and file architecture. Don’t force the installation past dependency checks.

File not found: Run ls -lh ./Shadowrocket.deb and check that you’re in the right directory and that the filename’s capitalization matches.
Unable to fetch dependencies: First check that your system’s package sources update successfully. This is a package manager or system dependency issue, not a Shadowrocket connection configuration issue.
Package manager is locked: Wait for the system updater to finish. Don’t delete lock files or run multiple installation processes at once.
Installation complete: Search for Shadowrocket in your desktop’s application list and launch it as a regular user. The entry may not appear immediately if the desktop menu hasn’t refreshed.

To update a DEB package manually, run sudo apt install ./Shadowrocket.deb with the newly downloaded file. Installing a local package does not automatically add an update repository. Unless the download instructions explicitly describe an update mechanism, don’t assume the system updater will fetch later versions automatically.

4. Install an RPM package and check dependencies with dnf

On Fedora and other dnf-based systems, you can install a local RPM directly. From the directory containing the file, run the command below, review dnf’s transaction summary, and confirm the installation. Renaming a DEB file with an RPM extension does not change its package format.

sudo dnf install ./Shadowrocket.rpm

dnf reads the package information and attempts to resolve dependencies using your enabled package sources. If installation fails, keep the full error output and identify whether the file is missing, the architecture doesn’t match, a dependency is unavailable, or a system policy blocked the operation. Each issue needs a different fix; repeatedly clicking the application launcher won’t resolve them.

If you see No such file or directory, check the filename and current directory before changing any system settings.
If you see a dependency conflict or a required capability is unavailable, check whether the package supports your system and whether your package sources are working.
If you see a warning about the source or signature, confirm that the file came from this site’s download page and follow your distribution’s package verification requirements. Don’t disable verification by default.
After a successful transaction, launch Shadowrocket from your desktop’s application list. If no window appears, try launching the installed program from a terminal and keep the error output.

5. Set AppImage permissions and launch it for the first time

The first step for an AppImage is usually to grant the file execute permission, not to install it. Save it in a local directory owned by your user, rather than running it from a restricted shared drive, temporary download folder, or removable media. Check the filename, then run:

chmod u+x ./Shadowrocket.AppImage
ls -l ./Shadowrocket.AppImage
./Shadowrocket.AppImage

chmod u+x grants execute permission to the file’s owner; there’s no need to use chmod 777. In the output of ls -l, an x in the owner permission field means that permission is set. Launching from a terminal makes errors easier to see, especially if double-clicking does nothing.

I added execute permission, but why do I still see “Permission denied”?

First run ls -l ./Shadowrocket.AppImage to check the owner and permissions, then run findmnt -T ./Shadowrocket.AppImage to inspect the file system. If the mount options include noexec, move the file to a local user directory that allows execution and try again. Don’t change system mount settings directly.

Which package should I install if libfuse.so.2 is missing?

This may mean the runtime is missing the FUSE 2 compatibility library. On Debian or older Ubuntu versions, check with apt-cache policy libfuse2. On Ubuntu versions using the newer package name, try apt-cache policy libfuse2t64. Install only a library that your distribution provides and supports; don’t remove FUSE 3 to replace it.

I get “Exec format error.” Is that a permissions problem?

Run uname -m to check your system architecture, then file ./Shadowrocket.AppImage to inspect the file type. If the architectures don’t match, return to the download guide and choose the right file. Repeatedly running chmod won’t fix an architecture mismatch.

It launches from the terminal, but why can’t I find it in the application menu?

An AppImage running successfully doesn’t mean your system has created an application menu entry. Keep the file in a fixed location and confirm it launches from the terminal. To add a menu entry, use your desktop environment’s application launcher settings and specify the file’s absolute path. Don’t point it to a temporary directory that you plan to clean up.

If the error specifically mentions a FUSE mount, the issue may be container restrictions or device permissions—even if the compatibility library is installed. Consider using a DEB or RPM package suited to your distribution instead of granting administrator privileges to the entire graphical application. Before importing network configuration, make getting the application to launch reliably a separate goal.

6. Verify your configuration before testing the connection

Launching the application and connecting through a proxy are separate steps. This guide assumes you already have your own provider and subscription: add an existing server on Home, or choose Subscribe under Add Server to import an existing subscription. After importing, make sure the server appears in the list and select the one you want to use. An imported configuration does not mean a connection has been established.

Check the configuration: Make sure the server address, port, protocol, and authentication fields match your original configuration. Shadowsocks, VMess, VLESS, Trojan, Hysteria2, and WireGuard use different fields; changing Type alone does not convert between protocols.
Select a server: On Home, select the server you want to use, then turn on the connection. If the system asks for network-related permission, review what it covers before deciding whether to allow it.
Run a test: Check the result in Connectivity Test, then use a browser to visit a site you can normally access. This helps distinguish the client’s connection test from traffic in other applications.
Check subscriptions separately: If a subscription update fails, first confirm the original URL is valid and reachable. Changing server authentication fields won’t fix a subscription URL timeout.

Global Routing determines how traffic handled by Shadowrocket is routed. When troubleshooting, change one setting at a time; don’t switch servers, change DNS, and replace rules all at once. These options describe Shadowrocket’s own routing behavior. Enabling one does not guarantee that all traffic from every Linux process will be routed through it.

Config

Recommended

Match traffic against the rules in the currently enabled configuration. Depending on the rules, traffic may use PROXY, DIRECT, or REJECT. Before everyday use, make sure the file enabled in Config suits your network needs.

Best for: everyday connections with clear routing rules.

Proxy

Route handled traffic as proxy traffic. Use this temporarily to compare results with Config. It doesn’t replace checking the system proxy, an application’s own proxy settings, or which traffic is being handled.

Best for: briefly checking whether the issue is related to rule selection.

Direct

Route handled traffic directly. If you leave the setting on Direct, an enabled connection switch alone does not mean the request is going through the selected proxy server.

Best for: comparing with a direct connection on your local network.

If Connectivity Test succeeds but an application still can’t connect, check whether it uses the system proxy or has its own proxy settings, and which rule matches the destination domain. DOMAIN-SUFFIX matches domain suffixes, IP-CIDR matches IP ranges, GEOIP uses an IP geolocation database, and FINAL handles traffic that hasn’t matched an earlier rule. Different rule results don’t mean the Linux installation failed.