Link Agent requirements

Before you set up the mabl Link Agent, make sure the machine that will run it meets the system and network requirements in this article. For how much CPU and memory to provision as your traffic grows, see Sizing and scaling Link Agents.

• System requirements
  • Host resources
  • Supported platforms
  • Linux versions
  • Software
  • Writable directories
  • High availability configuration
• Network requirements
  • Outgoing traffic
  • Legacy Link

System requirements

mabl Link works best when the Link Agent runs on an always-on server or VM in your network. If you can't use an always-on server or VM, choose a machine that runs with as little downtime as possible. Any mabl test scheduled to run while the Link Agent is disconnected can't reach the application under test.

Host resources

For how to choose between them, and how CPU and memory grow with traffic and the number of tunnels, see Sizing and scaling Link Agents.

If the Link Agent runs on a cloud instance, avoid burstable instance types, which can go through long periods of reduced CPU and network performance. We recommend the following instance classes:

• AWS: C class instances
• GCP: N2, N2D, T2D, C2, C2D class instances

Supported platforms

The Link Agent runs on the following operating systems and processor architectures:

On macOS, the Link Agent requires macOS 14 (Sonoma) or later. Macs with Intel processors and Windows on ARM are not supported. On Alpine Linux, only x86-64 is supported. For arm64 containers, use the Ubuntu variant of the Link Agent Docker image.

Linux versions

The Link Agent uses the GNU C library (glibc) that comes with your Linux distribution. The minimum glibc version depends on the processor architecture:

The Link Agent also needs zlib, and on arm64, the C++ runtime from GCC 8 or later (libstdc++). Every distribution in the table includes them. These minimums apply whether you install with the Linux installer, the zip or tar.bz2 archive, or the mabl CLI.

Older distributions are not supported, such as RHEL 8 and Amazon Linux 2 on arm64. On them, the Link Agent can connect only over legacy Link, which ends on March 15, 2027. To keep using an older host, run the Link Agent Docker image on it instead. The image includes its own libraries, so the host's glibc version doesn't matter.

Software

What you need to install depends on how you run the Link Agent:

Writable directories

The account that runs the Link Agent must be able to write to the following directories:

Each Link 3.0 tunnel runs as a separate program, called a tunnel process. The Link Agent downloads this program and runs it from the directories listed above, so they must also allow running programs. A file system mounted with noexec doesn't allow it.

If the Link Agent connects only over legacy Link and its log shows no writable, executable directory for the Link 3.0 worker, it couldn't find a directory where it can write and run the tunnel process. The log lists each directory it tried and why it couldn't use it. Legacy Link ends on March 15, 2027, and after that date a Link Agent in this state can't connect.

When the directory listed above isn't usable, the Link Agent tries these directories in order. The Link Agent in the mabl CLI tries the same ones:

1. $XDG_STATE_HOME/mabl/link, which is ~/.local/state/mabl/link by default
2. A private directory under the system temporary directory

With the mabl CLI, you can choose the directory yourself with the --install-root option of mabl link-agents start. The CLI then uses only that directory and doesn't try the others.

If the rest of the install directory is read-only, as in a container with a read-only root filesystem, the Link Agent still runs, but it can't install updates or write its log file. Update it by replacing the installation or image instead. To run the Docker image with a read-only root filesystem, mount a writable volume at /opt/mabl/link-agent/run. For a Kubernetes example, see Clusters with a read-only root filesystem.

High availability configuration

If your workspace runs many tests over mabl Link, run multiple Link Agents with the same tunnel name on different machines. mabl spreads connections across every agent on a tunnel, and if one agent disconnects, tests continue through the agents that are still running.

To take one agent out of service without interrupting tests, such as before patching its host, put it into maintenance mode first. The agent stops accepting new connections and lets the ones it already has finish.

Network requirements

When your tests run over mabl Link, traffic appears to originate from the machine in your network that runs the Link Agent. In a container setup, the container host is the point of origin.

The Link Agent host must be able to resolve the DNS names in your mabl tests. They can be non-public FQDNs, private IP addresses, or /etc/hosts entries such as https://app-local.example.com. As long as the Link Agent host can resolve an address and reach it, so can your mabl tests.

Outgoing traffic

The Link Agent only makes outgoing connections, so it never needs an inbound firewall rule. If your company firewall restricts outgoing traffic, allow the following:

The tunnel needs only one of mabl-wss.link.mabl.com or mabl-quic.link.mabl.com. The Link Agent tries QUIC first because it is faster, and falls back to WSS on its own. QUIC can't pass through an HTTP proxy, so the Link Agent uses it only when it can reach mabl without one. If your network sends outgoing traffic through an HTTP proxy, allow mabl-wss.link.mabl.com, the endpoint most networks use.

storage.googleapis.com is not required. If it is blocked, the Link Agent downloads updates from api.mabl.com instead.

If your network uses HTTP forward proxies, see Forward proxies for mabl Link traffic to configure how the Link Agent routes its traffic.

Legacy Link

Link Agents older than version 3.0 connect to a generated host name of the form {host}.link.mabl.com. A 3.0 agent keeps that legacy connection too, until your account moves to the Link 3.0 protocol. Keep *.link.mabl.com in your allowlist until you have finished migrating to Link 3.0.