How to Install Deno on Debian: The Secure JavaScript and TypeScript Runtime

Deno is a secure runtime for JavaScript and TypeScript, created by Ryan Dahl, the original author of Node.js. Written in Rust and built on the V8 engine, Deno takes a fresh approach: TypeScript runs natively without a build step, code is sandboxed and denied filesystem, network and environment access unless you explicitly grant it, and a full toolchain — formatter, linter, test runner and bundler — comes built into the single deno binary.

Deno releases frequently and is not carried in the official Debian repositories. The upstream shell installer places a binary in your home directory outside of APT, so upgrades and clean removal become manual tasks.

The unofficial deb.griffo.io repository provides a neater path: an up-to-date, prebuilt Deno package that installs with apt and updates with the rest of your system.

What Makes Deno Special?

  • 🔒 Secure by default - no filesystem, network or environment access unless you grant it explicitly
  • 🟦 Native TypeScript - runs .ts files directly with no separate compilation step
  • 🧰 Batteries-included tooling - formatter, linter, test runner and bundler built into one binary
  • 🌐 Web-standard APIs - fetch, URL, WebSocket and other browser APIs available natively
  • 📦 Modern module system - imports by URL or from deno.json, with a built-in dependency cache
  • 🟢 npm compatibility - import npm packages via npm: specifiers when you need them
  • ⚙️ Single executable - compile a project to a standalone binary with deno compile
  • 📚 First-class standard library - an audited standard library maintained by the Deno team

Why Use the deb.griffo.io Repository?

  • Easy installation and updates through the APT package manager
  • Automatic dependency management handled by Debian packaging
  • Always tracks upstream releases so new Deno versions arrive promptly
  • No shell installer dropping an unmanaged binary into your home directory
  • Works across supported Debian releases including Bookworm, Trixie and Sid

Prerequisites

Before you begin, make sure you have:

  • A Debian-based system (Bookworm 12, Trixie 13, or Sid)
  • sudo privileges
  • curl installed (run sudo apt install curl if needed)

Step 1: Add the deb.griffo.io Repository

Add the repository’s GPG key and source entry:

# Create the keyrings directory
sudo install -d -m 0755 /etc/apt/keyrings

# Download and install the repository GPG key
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg

# Add the repository (auto-detects your distro codename)
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null

# Update the package list
sudo apt update

What each command does:

  1. Create the keyrings directory with the correct permissions for the signing key.
  2. Install the GPG key, dearmoring it into a keyring APT can verify against.
  3. Add the repository, using lsb_release -sc to detect your Debian codename automatically.
  4. Update the package list so APT sees the new packages.

Step 2: Update the Package List

If you skipped the final command above, refresh the index now:

sudo apt update

Step 3: Install Deno

Install Deno with a single command:

sudo apt install deno

APT downloads the latest packaged release and resolves any dependencies.

Step 4: Verify the Installation

Confirm Deno is installed and on your PATH:

deno --version

You should see output listing the Deno, V8 and TypeScript versions:

deno 2.4.2
v8 13.7.152.6
typescript 5.8.3

Getting Started with Deno

Here are the workflows you will reach for most.

Running Code

Deno runs JavaScript and TypeScript files directly, prompting for permissions as they are needed:

# Run a local script
deno run main.ts

# Run a remote script straight from a URL
deno run https://docs.deno.com/examples/scripts/hello_world.ts

# Grant only the permissions the program needs
deno run --allow-net --allow-read server.ts

# Grant everything (use sparingly)
deno run -A main.ts

The permission flags are the heart of Deno’s security model: a script cannot open a socket or read a file unless you pass the matching --allow-* flag.

The Built-in Toolchain

Deno bundles the tools most projects reach for separate packages to provide:

# Format your code
deno fmt

# Lint for common mistakes
deno lint

# Run the test suite
deno test

# Type-check without running
deno check main.ts

A test uses the standard library’s assertions:

import { assertEquals } from "jsr:@std/assert";

Deno.test("adds numbers", () => {
  assertEquals(2 + 2, 4);
});

Managing Dependencies and Tasks

Modern Deno projects use a deno.json file for imports and task definitions:

# Initialise a new project
deno init my-app
cd my-app

# Add a dependency from JSR or npm
deno add jsr:@std/http
deno add npm:express

# Run a task defined in deno.json
deno task dev

# Cache dependencies ahead of time
deno cache main.ts

Installing Tools and Compiling Binaries

Deno can install scripts as global commands and compile projects into standalone executables:

# Install a script as a global command
deno install --global --allow-net -n serve jsr:@std/http/file-server

# Compile a project into a single self-contained binary
deno compile --allow-net --output myserver server.ts
./myserver

Keeping Deno Updated

Because Deno is installed through APT, updates arrive with your regular system maintenance:

sudo apt update && sudo apt upgrade

Whenever a new release is packaged, this pulls it in. There is no need for deno upgrade, which only applies to installs done via the upstream shell script.

Other Tools from deb.griffo.io

The deb.griffo.io repository packages many other developer tools for Debian:

  • bun - a fast all-in-one JavaScript runtime and toolkit
  • eza - a modern, maintained replacement for ls
  • starship - a fast, minimal prompt for any shell
  • lazygit - a terminal UI that makes Git a pleasure to use

Troubleshooting

GPG or Key Issues

If APT reports the repository cannot be verified, re-add the signing key:

# Re-download and install the repository GPG key
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg

# Refresh the package list
sudo apt update

Package Not Found

If APT cannot find the deno package:

  1. Make sure you ran sudo apt update after adding the repository.
  2. Confirm your Debian release is supported (Bookworm, Trixie or Sid).
  3. Check the source entry was written correctly:
cat /etc/apt/sources.list.d/deb.griffo.io.list

A Script Fails with a Permission Error

Deno denies access by default, so a PermissionDenied error usually means a required --allow-* flag is missing. If a program needs network access, add --allow-net; for file reads, --allow-read; for environment variables, --allow-env. Grant the narrowest set that works rather than reaching for -A, which allows everything.

Uninstalling

To remove Deno:

sudo apt remove deno

To remove the repository as well:

sudo rm /etc/apt/sources.list.d/deb.griffo.io.list
sudo rm /etc/apt/keyrings/deb.griffo.io.gpg
sudo apt update

Conclusion

Deno rethinks the JavaScript runtime from the ground up: TypeScript works with no setup, security is opt-in rather than assumed, and a complete toolchain lives inside a single binary. For scripts, servers and command-line tools alike, it removes a great deal of the boilerplate that has accumulated around Node.js.

Installing it through the deb.griffo.io repository keeps Deno under APT’s control on Debian: one apt install to set it up, and future releases arriving with your normal updates. That is far tidier than a shell installer writing into your home directory, and it keeps Deno current with no manual effort.

Resources

Disclaimer: The deb.griffo.io repository is an unofficial community project and is not affiliated with the official Debian or Ubuntu projects, or with the upstream Deno project.