RHEL 9 DCP Worker

CPU-only build · install, register, and run · tested on RHEL 9.0, 9.6, and 9.8

Pilot status — read this first. This is a working engineering pilot, confirmed end-to-end (install, registration, restart persistence, live scheduler connection) on real RHEL 9 — but it is not yet an officially supported, GA Distributive product the way the Ubuntu .deb/apt package is. Good for evaluation and non-production trials.

Signed RPM, but no repository yet — the package is signed with Distributive's GPG key and dnf verifies it on install, but it installs from a URL rather than a DNF repository, so there's no dnf upgrade yet. Updating means running the install command again with the new version's URL.
Not on the official build pipeline — the bundled Linux runtime was hand-rebuilt for this pilot to work around a real gap in the normal build system, and hasn't been through Distributive's usual CI/review/QA.
No automatic updates, no independent security review, no formal support SLA yet for this platform target.

See "What production-grade would add," below, for the full list and what each item is actually for.

1 Install and register

Run this on the RHEL 9 machine. It downloads, verifies, installs and registers the worker.

Your registration key Your earnings account

Fill in both and the command updates. They stay in this page; nothing is sent anywhere. Or copy the command as-is and replace the two placeholder values before running it.

EARNINGS=0xYOUR_EARNINGS_ACCOUNT
REGKEY=0xYOUR_REGISTRATION_KEY

sudo mkdir -p /etc/systemd/system/dcp-worker.service.d && \
printf '[Service]\nExecStart=\nExecStart="/opt/dcp/bin/dcp-worker.sh" --output=console --no-global --earnings-account=%s\n' "$EARNINGS" \
  | sudo tee /etc/systemd/system/dcp-worker.service.d/override.conf >/dev/null && \
sudo rpm --import https://people.distributive.network/dandesjardins/rhel9-worker/RPM-GPG-KEY-distributive && \
sudo dnf install -y --setopt=localpkg_gpgcheck=1 \
  https://people.distributive.network/dandesjardins/rhel9-worker/downloads/dcp-worker-8.0.1-0.1.cpuonly.el9.x86_64.rpm && \
sudo -u dcp dcp-worker --register="$REGKEY" && \
echo "Waiting 65 s for registration to take effect..." && \
sleep 65 && \
sudo systemctl restart dcp-worker

What it does:

Sets the worker's options in a systemd override: --no-global so it only runs jobs from your own compute groups, and --earnings-account so earnings go to your account. The override survives package upgrades.
Trusts Distributive's package signing key (fingerprint 24AD 9466 37A3 4EE6 220E 2D3F 5683 DE7D 5F4D 42AB).
Downloads and installs the package, refusing it unless its signature matches that key. It creates an unprivileged dcp system user, installs under /opt/dcp, installs any missing OS dependencies (such as libatomic), and enables and starts the dcp-worker and dcp-evaluator services.
Registers the worker to your account, so your earnings and worker activity are tracked correctly.
Waits 65 seconds, then restarts the worker. A new registration takes up to a minute to reach the worker; the restart makes it pick up your compute groups. Without it the worker can run but never get work.

Run the registration as the dcp user, exactly as shown (sudo -u dcp). That's the account the service runs as; registering as root saves the registration where the service never sees it.

You only register once per machine. The identity is saved to /opt/dcp/.dcp/id.keystore and reloaded on every start, including after a reboot. Both services restart on their own after a crash (Restart=always).

Prefer to download first?

dcp-worker-8.0.1-0.1.cpuonly.el9.x86_64.rpm

Signed RPM · SHA-256 · public key. Install a downloaded copy with sudo dnf install -y --setopt=localpkg_gpgcheck=1 ./dcp-worker-*.rpm.

Download

2 Confirm it's running

sudo systemctl status dcp-worker dcp-evaluator --no-pager

Both should show Active: active (running). To watch live logs:

sudo journalctl -f -u dcp-worker -u dcp-evaluator

A healthy startup looks like:

. Configured for scheduler https://scheduler.distributed.computer/
. Bank is https://bank.distributed.computer/
. Identity is 0x...
. WebGPU not enabled
. Scheduler supports worker type(s) v4 and operations 1.0.0
* Ready.

WebGPU not enabled is expected and correct — this is the CPU-only build. Press Ctrl+C to stop watching logs (this does not stop the worker).

A note for your network/security team: this build always launches with Node's --use-system-ca flag, so the worker trusts whatever certificate authorities are in this machine's own managed trust store — anything installed via update-ca-trust (e.g. an internal corporate CA, or a TLS-inspecting proxy's certificate), not just the certificates the worker ships with. If your network requires outbound HTTPS to be trusted via a custom/internal CA, add it the standard RHEL way and the worker picks it up automatically, no worker-specific configuration needed:

sudo cp your-ca-cert.pem /etc/pki/ca-trust/source/anchors/ && \
sudo update-ca-trust extract

3 Stopping / restarting

Stop:

sudo systemctl stop dcp-worker dcp-evaluator

Start again:

sudo systemctl start dcp-worker dcp-evaluator

Restart:

sudo systemctl restart dcp-worker dcp-evaluator

Stopping and starting again does not require re-registering — the saved identity is reloaded automatically every time.

4 Optional configuration

The install command already set your earnings account and --no-global in /etc/systemd/system/dcp-worker.service.d/override.conf. To change them, join an extra compute group, or adjust CPU/sandbox limits, edit that override. Overrides survive package upgrades; editing the installed unit file directly does not.

sudo systemctl edit dcp-worker

In the editor that opens, the override looks like this; add or change options as needed. The empty ExecStart= line is required; it clears the original before the new one replaces it.

[Service]
ExecStart=
ExecStart="/opt/dcp/bin/dcp-worker.sh" --output=console \
  --earnings-account=<your-bank-account> \
  --join=<compute-group-key>,<compute-group-secret> \
  --no-global \
  --utilization=1 \
  --cores=4

--earnings-account: where payouts get deposited.
--join=key,secret: join a private compute group (repeat to join more than one).
--no-global: opt out of the public Global Compute Group, so this worker only ever runs jobs from the compute group(s) you explicitly --join. Include this if you only want it running your own private workloads, not public/anonymous jobs from the wider DCP network. Omit it if you're fine with both.
--utilization / --cores: how much of the machine's CPU to offer.

Save and close the editor, then restart the worker to apply the change:

sudo systemctl restart dcp-worker

5 Uninstalling

sudo dnf remove -y dcp-worker && \
sudo rm -rf /etc/systemd/system/dcp-worker.service.d && \
sudo systemctl daemon-reload && \
(sudo systemctl reset-failed dcp-worker 2>/dev/null || true)

This stops and removes the services, the installed files, and the worker's options, but keeps the worker's saved identity in /opt/dcp/.dcp, so reinstalling later brings the same worker back without registering again.

To remove everything, including the saved identity and the dcp user, run this after the command above. It deletes the worker's identity; back up /opt/dcp/.dcp/id.keystore first if you might want the same worker ID later.

sudo rm -rf /opt/dcp && sudo userdel dcp

6 What production-grade would add

The list below is what turns this from "a working pilot we tested ourselves" into an officially supported enterprise product. None of it blocks evaluating the worker today — it's the gap between pilot and GA.

Packaging & provenance

Done for this pilot: a signed .rpm with dependency resolution, a clean dnf remove, and signature verification on install.
That RPM produced by Distributive's normal build system (a CPack RPM generator mirroring the existing .deb target), rather than packaged by hand for this pilot.
A signed DNF repository — the RHEL equivalent of apt.distributive.network's existing signed apt repo — so installing is dnf install dcp-worker and updating is dnf upgrade, with no URLs to copy.

Build pipeline

RHEL 9 (and ideally 8/10) added as a real target in Distributive's own CI, so every release automatically produces and tests a RHEL build — not a manual, one-off rebuild done for this pilot.
The underlying Linux-runtime build gap fixed at the source, not worked around per-release.

Update methodology

A defined versioning and patch-release policy, delivered via dnf upgrade once the DNF repository above exists.
A rollback path for a bad update, and staged/canary rollout for large fleets.
A stated support lifecycle tied to RHEL 9's own EOL.

Security

An independent security review / penetration test specifically covering this platform target — the worker executes third-party compute-marketplace code (JS/WASM) as an unprivileged systemd service on customer infrastructure, so sandbox isolation, network egress controls, and privilege boundaries are worth an explicit, documented audit rather than inherited-by-assumption from the Ubuntu build.
A documented vulnerability disclosure / CVE response process.

Support

A formal support channel and SLA (response-time commitments), rather than ad hoc email/Slack.
QA coverage across supported RHEL point releases in CI, not a single manual test pass.

Compliance (worth checking, not necessarily new work)

Whether Distributive's existing certifications/compliance posture already covers this deployment path, or whether a new platform target needs something specific addressed for your own vendor security review.

7 Troubleshooting

systemctl status shows failed or inactive: check sudo journalctl -u dcp-worker -u dcp-evaluator --no-pager | tail -50 for the actual error.

Running and Ready, but never gets work: check that a job is actually running in one of your compute groups, then restart the worker with sudo systemctl restart dcp-worker. A worker started too soon after registering can miss its compute groups until it restarts.

Worker log says "Waiting for dcp-evaluator... to start" and never proceeds: dcp-evaluator isn't running — start it with sudo systemctl enable --now dcp-evaluator.

dnf reports a signature or "public key not installed" error: the first line (rpm --import) didn't run or failed. Run it again on its own, then retry. If the error persists, don't install the package; contact Distributive.

dcp-worker: command not found: the install line didn't complete. Check the dnf output above it for the error.