Installation

Install Vediram Levee on one Windows 11 computer and check that it is healthy

Installing Levee is a job for the IT team: it needs administrator rights and at least one restart. This page covers installing Levee by hand on one computer, for example to try it out. To roll it out to many computers with Intune, Configuration Manager, or another tool, see Enterprise deployment.

The steps, in order:

1. Turn on the Windows Containers feature and restart.
2. Run the Levee installer.
3. Check that Levee is healthy.
4. Give the computer a policy.

Before you start

• The computer meets the system requirements: Windows 11 Pro, Enterprise, or Education, build 22621 or later, x64.
• The ASP.NET Core Runtime 8.x and the .NET Desktop Runtime 8.x (both x64) are installed.
• You have local administrator rights.
• You have the Levee installer, VediramLeveeSetup-<version>-x64.msi, from Vediram.

Enable the Windows Containers feature

Levee's sandboxes need the Windows Containers feature. The installer does not turn it on, so enable it first. From an elevated PowerShell:

Enable-WindowsOptionalFeature -Online -FeatureName Containers -All -NoRestart
Restart-Computer

After the restart, check it:

(Get-WindowsOptionalFeature -Online -FeatureName Containers).State   # Enabled

You do not need to enable Hyper-V.

If you skip this step, Levee still installs. The Levee app then shows "Windows 'Containers' feature is off" at startup. When the app runs as administrator, its Fix button enables the feature for you. A restart is still required.

Run the installer

1. Double-click VediramLeveeSetup-<version>-x64.msi, or run it from an elevated prompt:

   msiexec /i .\VediramLeveeSetup-<version>-x64.msi /l*v "$env:TEMP\levee-install.log"
   

2. Accept the elevation prompt.

3. The installer checks the Windows edition and build and the ASP.NET Core 8 runtime, and verifies the integrity of the bundled container engine. It also installs LeveeFS, the component that shows shared files inside the sandbox: a file-system driver (LeveeFs) and a Windows service (LeveeFSHost). If any check fails, it rolls back and leaves nothing behind. See Install prerequisite errors.

4. When setup finishes, both Levee services are installed and started. If the computer already had an older LeveeFS driver, updating it needs a restart: the installer reports that a restart is required (exit code 3010), and shared files are available again after the restart.

What gets installed

Programs go under Program Files, where only administrators can change them. Data stays under ProgramData.

What the installer does not do:

• It does not add levee.exe to PATH. Call it by its full path, or add the folder yourself (see below).
• It does not install a policy.json. Until you provide a policy, every channel uses its built-in default, which is deny. See How policy works.
• It does not install any AI tool. An administrator makes tools available separately. See AI tools.
• It does not touch Docker Desktop or any existing Docker engine. Levee's engine is separate and private to Levee.

To call the CLI as levee in your own session:

$env:Path += ";$env:ProgramFiles\Vediram\Levee\bin"
levee --help

To make it permanent for all users (elevated):

$bin = "$env:ProgramFiles\Vediram\Levee\bin"
$machinePath = [Environment]::GetEnvironmentVariable('Path', 'Machine')
if ($machinePath -notlike "*$bin*") {
    [Environment]::SetEnvironmentVariable('Path', "$machinePath;$bin", 'Machine')
}

Check that Levee is healthy

Check both Levee services:

Get-Service LeveeService, LeveeContainerEngine

Both should show Running. Then run the health check:

levee doctor
levee service status
levee runtime status

levee doctor exits with code 0 when the computer is healthy and a non-zero code when something needs attention. The first time the service starts, it downloads and verifies the container runtime image. Until that finishes, levee runtime status shows progress, and projects cannot start. To wait for it from a script:

levee runtime ensure --wait

See Container runtime for details, including offline computers.

Give the computer a policy

A fresh install denies everything. Before people can do useful work, give the computer a policy in one of two ways:

• Centrally: connect the device to Vediram Cloud and write the policy in the Vediram Portal. See Connecting to Vediram Cloud and Managing policy in the Portal.
• Locally: write %ProgramData%\Vediram\Levee\policy.json. See How policy works.

Next steps

• First launch: open the app, create a project, and start an agent.
• AI tools: make Claude Code, Codex CLI, or GitHub Copilot CLI available to users.