Remote Agents

Containerised agents that run inside a private network and poll out to this dashboard for work — so on-premises hypervisors can be discovered and managed without opening a single inbound firewall rule. Each agent authenticates with an Ed25519 key it generates itself; no reusable credential ever crosses the wire.

Enrolment codes are blocked

Fix it in Settings → Integrations → Remote Agents, which shows the pinned audience and offers a reset.

Remote agents are not enabled

Turn them on in Settings → Integrations → Remote Agents. Enabling publishes /api/agent for agents to reach, so terminate TLS in front of the dashboard first — see the remote agent docs.

Enrolled Agents

Loading…
No agents yet. Click "Register Agent" to get an enrolment code and a run command.
Every agent is revoked. Untick "Hide revoked" to see them.
Name Site Status Registered by Source IP Version Last seen Running

Register Agent

Enrolment code for

Shown once. It expires in 15 minutes and can only be redeemed a single time. 


        
        

          The agent image is Linux; on Windows it runs in Docker Desktop's Linux VM, so keep
          Docker Desktop in Linux containers mode. See
          Running on Windows.
        

      


      
      

        
          Alternative: keep the code out of docker inspect
        
        

          Mounts the code as a file instead of an environment variable, so nothing durable in
          Docker's metadata holds it. Follows the toggle above. To keep the code out of your
          shell history too, create agent-enroll-code with an
          editor — just the code, on one line — and paste only the
          docker run that follows.
        

        
        

          Save it as plain ASCII or UTF-8 without a byte-order mark — Notepad's
          "Unicode" and "UTF-8 with BOM" options both produce a file the agent cannot read.
          PowerShell also writes its history to disk as you type, so an editor is the only way
          to keep the code out of it.
        

        

        
      

      

        The agent needs a policy.yaml naming the networks it may
        scan — it refuses all work without one. See
        the remote agent docs
        for a starting file.
      

      

        
      

    

  


  
  

    

      
Discover via 

      

        Unauthenticated probes only — a TCP connect and a protocol banner. Nothing ever
        attempts a login. The agent will refuse any target outside its own policy file.
      

      

        

          
          
        

        

          
          
        

        

          
          
        

        

          Probes never authenticate, so a WinRM answer identifies Windows — not
          necessarily a Hyper-V host. Those findings are marked possible only.