Getting Started with Talos Enterprise Linux

Learn how to obtain and use Talos Enterprise Linux images with Enterprise Image Factory, either through the factory UI and CLI or automatically with Omni. This guide covers prerequisites, image creation and downloads, vulnerability scanning with SBOM and VEX data, image verification, and getting started with your enterprise image.

Prerequisites

You need the following before you begin.

A Talos Enterprise Linux entitlement (either an Omni subscription or a standalone Talos Enterprise Linux support contract) with an organization provisioned on Enterprise Image Factory. If you cannot log in, contact support.

If you are following the CLI tab below, you also need jq, cosign, and grype installed on your machine. On macOS or Linux with Homebrew, install all three with:

brew install jq cosign grype

For other installation methods, refer to the documentation for each tool: jq, cosign, and grype.

Standalone Talos Linux

Enterprise Image Factory offers two ways to get an enterprise image: through the browser wizard, or programmatically with curl. Pick the tab that matches your workflow.

Step 1: Log in to Enterprise Image Factory

The Enterprise Image Factory login screen asks for your work email and routes you to your organization’s identity provider.

Open factory.siderolabs.com in your browser.
Enter your work email address. Enterprise Image Factory matches your email domain to your organization and redirects you to your identity provider.
Complete sign-in. Most organizations use Google or a company SSO.

Step 2: Build a schematic and download artifacts

The wizard is identical to factory.talos.dev. The difference is the Schematic Ready page: in the Enterprise Image Factory, it combines vulnerability scan results, SBOM, and VEX alongside the standard boot assets, all available to download from one screen.

Click through the wizard on the home page. Select your Talos version, CPU architecture, and any system extensions you need.
On the Schematic Ready page, download what you need:
- Vulnerability Scan: The scan runs automatically and combines the per-schematic SBOM with Siderolabs’ VEX data, so results are pre-filtered to CVEs that actually apply to your image. Download the full report in JSON, SARIF, CycloneDX, or table format from the links provided.
- Boot assets: This section lists every boot asset for your schematic: ISO, disk image (raw), disk image (qcow2), UKI, and initramfs image. Click the link for the asset type your environment requires.
- SBOM (SPDX): This section contains a direct download link for the per-schematic Software Bill of Materials in SPDX 2.3 format.
- VEX (Vulnerability Exploitability eXchange): This section contains a direct download link for the per-release VEX document.

Step 3: Boot your machine and create a cluster

With your boot asset downloaded, follow the standard Talos Linux setup to boot your machine and create a cluster.See the Getting Started with Talos Linux guide to continue from here.

The Enterprise Image Factory login screen asks for your work email and routes you to your organization’s identity provider. You need to sign in to create an API token in the next step.

Open factory.siderolabs.com in your browser.
Enter your work email address. Enterprise Image Factory matches your email domain to your organization and redirects you to your identity provider.
Complete sign-in. Most organizations use Google or a company SSO.

Step 2: Create an API token

Every programmatic request to Enterprise Image Factory requires an API token. The token carries scopes that determine which endpoints it can reach.

In the Enterprise Image Factory UI, select Manage API Tokens.
Select + Create Token.
Enter a descriptive Name for the token.
Set a Lifetime. Lifetimes are written in seconds (s), minutes (m), or hours (h).
For Token actor, select Automation. This profile includes the schematic:create, schematic:read, image:read, report:read, and token:issue scopes needed to follow this guide. For a description of every profile and the scopes each carries, see Token actor profiles.
Select Create Token. Enterprise Image Factory displays your Organization ID and Token.

The token is shown once. Copy it to a password manager before closing the dialog. If you lose it, generate a replacement and revoke the original.

Store the token as an environment variable:

export EIF_TOKEN=<token>

Step 3: Build a schematic

A schematic describes the customizations applied to a Talos Enterprise Linux image: system extensions, extra kernel arguments, and initial Talos META values. Submitting an empty body ({}) produces the base Talos Enterprise Linux image with none of those customizations applied. This is the “vanilla” schematic.For the complete schematic format, including kernel arguments, Talos META values, and overlays, see the schematic reference in the Image Factory repository.Set your target Talos version and CPU architecture:

export TALOS_VERSION=<talos-version>
export ARCH=<arch>

Create the schematic and capture its ID:

export SCHEMATIC=$(curl -s --fail-with-body -X POST \
  -H "Authorization: Bearer $EIF_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://factory.siderolabs.com/schematics | jq -r '.id')

echo $SCHEMATIC

This command returns a 64-character hex ID.

Step 4: Download an enterprise image

Use your schematic ID, version, and architecture to download a boot asset from Enterprise Image Factory. The example below downloads the metal ISO:

curl -L -o metal-$ARCH.iso \
  -H "Authorization: Bearer $EIF_TOKEN" \
  "https://factory.siderolabs.com/image/$SCHEMATIC/$TALOS_VERSION/metal-$ARCH.iso"

The -L flag follows the redirect that Enterprise Image Factory issues for every image request. For other asset types such as disk images, UKI, initramfs, and PXE scripts, see Download Images and Artifacts.To verify the image’s build attestations before use, see Verify Enterprise Image Factory Signatures and Attestations.

Step 5: Scan for vulnerabilities

Enterprise Image Factory provides a per-schematic SBOM in SPDX 2.3 format and per-release VEX data. Grype uses both together to report only CVEs that apply to your exact image, filtering out findings that Siderolabs has assessed as non-applicable.Download the SBOM and VEX, then run the scan:

curl -s \
  -H "Authorization: Bearer $EIF_TOKEN" \
  "https://factory.siderolabs.com/spdx/$SCHEMATIC/$TALOS_VERSION/$ARCH" \
  -o sbom.spdx.json

curl -s \
  -H "Authorization: Bearer $EIF_TOKEN" \
  "https://factory.siderolabs.com/vex/$TALOS_VERSION/vex.json" \
  -o vex.json

grype sbom:./sbom.spdx.json --vex ./vex.json

For pre-built scan reports available directly from Enterprise Image Factory and alternative report formats, see Scan Talos Enterprise Linux Images With SBOM and VEX.

Step 6: Boot your machine and create a cluster

With your image downloaded and verified, follow the standard Talos Linux setup to boot your machine and create a cluster.See the Getting Started with Talos Linux guide to continue from here.

Via Omni

If you use Omni SaaS, enterprise images are handled automatically. No token management or factory setup is required on your part. omnictl media download already queries your Omni instance for the correct factory URL and credentials, so every ISO, disk image, and installer image it downloads is an enterprise build. Clusters switch to enterprise images on their next upgrade. Any change that triggers a schematic rebuild will do: bumping the Talos version, adding or removing a system extension, or changing a kernel argument. On that upgrade, Omni checks whether an enterprise build exists for the target version (available for Talos 1.13 and later) and pulls it automatically. Until a cluster is upgraded, its machines continue running open-source Talos Linux. To get started with Omni, follow the Getting Started with Omni guide. To move machines that are already running open-source Talos Linux to Talos Enterprise Linux, see Migrate Clusters to Talos Enterprise Linux.

Overview

Working with Talos Enterprise Linux

Learn More

Getting Started with Talos Enterprise Linux

Prerequisites

Standalone Talos Linux

Step 1: Log in to Enterprise Image Factory

Step 2: Build a schematic and download artifacts

Step 3: Boot your machine and create a cluster

Step 2: Create an API token

Step 3: Build a schematic

Step 4: Download an enterprise image

Step 5: Scan for vulnerabilities

Step 6: Boot your machine and create a cluster

Via Omni

​Prerequisites

​Standalone Talos Linux

​Step 1: Log in to Enterprise Image Factory

​Step 2: Build a schematic and download artifacts

​Step 3: Boot your machine and create a cluster

​Step 1: Sign in to Enterprise Image Factory

​Step 2: Create an API token

​Step 3: Build a schematic

​Step 4: Download an enterprise image

​Step 5: Scan for vulnerabilities

​Step 6: Boot your machine and create a cluster

​Via Omni

Prerequisites

Standalone Talos Linux

Step 1: Log in to Enterprise Image Factory

Step 2: Build a schematic and download artifacts

Step 3: Boot your machine and create a cluster

Step 1: Sign in to Enterprise Image Factory

Step 2: Create an API token

Step 3: Build a schematic

Step 4: Download an enterprise image

Step 5: Scan for vulnerabilities

Step 6: Boot your machine and create a cluster

Via Omni