Setup

Installation

One statically linked binary, CGO_ENABLED=0, no libc. The installer picks the file for your platform, checks it against the SHA256SUMS published with the same release, and installs to ~/.local/bin. A checksum mismatch installs nothing, and nothing runs as root.

Linux and macOS

$curl -fsSL https://raw.githubusercontent.com/DevInIndia/hollow/main/install.sh | sh

Set HOLLOW_INSTALL_DIR to change where it lands, or HOLLOW_VERSION=v1.0.1 to pin a release. The default directory may not be on your PATH; the script checks and says so.

Windows

$irm https://raw.githubusercontent.com/DevInIndia/hollow/main/install.ps1 | iex

Installs to %LOCALAPPDATA%\hollow\bin, so it never needs an elevated prompt.

Reading a script before running it

Piping a script from the internet into a shell is worth being wary of. Both installers are written to be read, and this is the same install in two steps.

read it first

curl -fsSL https://raw.githubusercontent.com/DevInIndia/hollow/main/install.sh -o install.shless install.sh && sh install.sh

Other routes

If you have a Go toolchain, or would rather build from source. The Docker image is multi-stage ending at FROM scratch: one layer, one static binary, 5.11 MB, running as uid 65534.

$go install github.com/DevInIndia/hollow/cmd/hollow@latest

$go build ./cmd/hollow

$docker build -t hollow . && docker run --rm -p 15353:15353/udp hollow

There is no CA bundle in the image and no /etc/resolv.conf. DNS over UDP and TCP carries no TLS, so there is no certificate to verify, and hollow walks from the root servers rather than asking the host resolver — an image with no resolver configuration at all is still a working one.

Published binaries

Prebuilt binaries cover the four targets below. Intel Macs and anything else build from source. The same source produces byte-identical output from any directory, built with go1.25.0 and CGO_ENABLED=0.

linux/amd64gated by make verify
hollow-linux-amd64
dd3586d6a900deda5311556153661f4d38c9dc0b437ac5535a194b5fda605182
linux/arm64
hollow-linux-arm64
89388445e2ea0271edfab9b776665a0e84db7dc30dcc1ea6332a357a09869db1
darwin/arm64
hollow-darwin-arm64
483ac3a8be85ca787c09ffc48eab4603f0cfceba3d3bf619d6a14f9f93bfab26
windows/amd64
hollow-windows-amd64.exe
b24d69c0c6638f85705fa7fed596c3f22b0851573b8606fc9172bbca1482e574

Only the linux/amd64 row is gated: it is rebuilt and compared against the published value on every commit, because it is the only platform this repository can reproduce byte for byte. The other three come from the same command and the same flags, and this says so rather than implying a check that did not happen. A stale hash breaks the build rather than quietly misleading a reader.

Checksums for every release are published alongside the binaries on the releases page.