napalm-linux

NAPALM driver for generic Linux systems — Debian, Ubuntu, RHEL, Rocky, Alpine, Arch and any other distribution reachable via SSH.

Connects over SSH using Netmiko (linux device type) and automatically detects the installed package manager (apt, dnf, yum, apk, pacman).

Requirements

Installation

pip install napalm napalm-linux

Or from source:

git clone https://git.netork.io/NAPALM/napalm-linux
pip install -e napalm-linux/

When working in the NetOrk monorepo, install both packages as editable:

pip install -e vendor/napalm-device-types/ -e vendor/napalm-linux/

Quick start

from napalm import get_network_driver

Driver = get_network_driver("linux")

with Driver(
    "10.0.0.5",
    "admin",
    "s3cr3t",
    optional_args={
        # "port": 22,
        # "pkg_manager": "apt",   # force package manager; auto-detected by default
        # "sudo_password": "sudo-pass",  # for commands that need root; without it,
        #                                # `sudo -n` (passwordless sudo) is tried
        # "debugging": True,      # enable verbose logging
    },
) as dev:
    facts = dev.get_facts()
    print(facts)

    # OS-specific methods (from napalm-device-types OSDriver)
    packages = dev.get_packages()
    updates = dev.get_pending_updates()
    services = dev.get_services()
    users = dev.get_os_users()
    procs = dev.get_processes()
    jobs = dev.get_scheduled_jobs()["jobs"]

    # Upgrade specific packages
    result = dev.apply_updates(["openssh-server", "curl"])
    print(result)  # {"success": True, "output": "..."}

    # Upgrade everything with pending updates
    result = dev.apply_updates([])

    # Restart a service (start, stop, restart, enable, disable)
    result = dev.manage_service("cron", "restart")
    print(result)  # {"success": True, "output": ""}

Supported NAPALM methods

Standard NAPALM

OSDriver extensions (napalm-device-types)

Package manager auto-detection

The driver probes for each binary in order via command -v:

apt → dnf → yum → apk → pacman

Force a specific package manager:

optional_args = {"pkg_manager": "dnf"}

SSH user permissions

The SSH user needs read access to:

For full functionality it is recommended to run as root or grant passwordless sudo for the above commands.

With a sudo_password, privileged commands run on an exec channel next to the interactive shell: the password reaches sudo -S on stdin, never a command line, so it shows neither in the process list nor in a shell history. The interactive session switches its history off before its first command.

Versions before that typed echo '<password>' | sudo -S -p "" <command> into the interactive shell, so the login user's history kept the password once per command. get_history_sudo_lines() counts those lines per history file without reading them, and remove_history_sudo_lines() deletes exactly them and gives /etc/snmp/snmpd.conf and /etc/apt/apt.conf.d/00proxy back to root where they were left to the login user (napalm-device-types' SudoHistoryMixin). Rotate the sudo password afterwards: backups, snapshots and audit logs may still hold it.

get_services() and manage_service() come from napalm-device-types' SystemdServicesMixin; this driver supplies only the transport. An action runs as timeout 45 systemctl --no-ask-password <action> -- <unit>.service, so a unit that hangs on its way up or down cannot hold the session, and only the exit status decides whether it succeeded. Without a sudo password it uses sudo -n, which fails at once instead of waiting for a password prompt.

On OpenMediaVault (napalm-openmediavault inherits this driver), enabling or disabling a unit that OMV manages itself — Samba, NFS, SSH — may be reverted the next time OMV applies its configuration.

Tested distributions

Contributions for additional distributions and versions are welcome.

Development

# Create venv
python -m venv .venv
source .venv/bin/activate

# Install in editable mode with dev dependencies
pip install -e ../napalm-device-types/ -e ".[dev]"

# Run tests
pytest tests/ -v

# Lint / format
ruff check napalm_linux/
ruff format napalm_linux/

License

Apache 2.0