Docker

Route status: PUBLISHED — acceptance steps 1–7 passed on 2026-08-12 against agent 0.1.1, including a docker restart on the persisted credential and a probe of a private target.

The shortest route, and the right one for most hosts. Get your token first (step 1); the enrolment panel renders this block with the token and your server URL already substituted.

mkdir -p "$HOME/.wirewatch-agent"
docker run -d --name wirewatch-agent --restart unless-stopped \
  --user "$(id -u):$(id -g)" \
  -v "$HOME/.wirewatch-agent:/var/lib/wirewatch" \
  ghcr.io/wirewatch/agent:0.1.3 \
  --token=<your-token> --server=<your-server-url> --config-dir=/var/lib/wirewatch

Both platforms resolve from that one tag. The binary inside the image is byte-identical to the archive published for the same platform, so one signature covers both routes — see Verify a release.

Neither the mkdir nor --user is decoration

Docker creates a mount source root:root 0755, and the image runs as uid 65532. Without both, the agent starts, enrols, and then cannot write the credential — spending the single-use token for nothing.

Run both commands as the same user. If you sudo the mkdir but not the docker run (or the reverse), the ownership no longer matches.

Rootless Docker is unmeasured

Under rootless Docker the uid mapping differs and --user "$(id -u):$(id -g)" does not land on your host uid. Use a directory the mapped user owns, or run the binary route instead.

Logs and restart

Logs are where a container tells you it failed, including a refused or expired token:

docker logs wirewatch-agent

Restart with docker restart wirewatch-agent. It must come back without a new token; if it asks for one, the volume is not doing its job.