An owner or admin can open Install agent and create a short-lived enrollment command. Run it on a host that can reach your selected data store and the HTTPS console. The command uses the published agent image configured by your console operator.
- Choose a name for the agent. Leave maximum enrollments at one for a single host.
- If you will use secret files, create
/srv/myrikeep/secretson the host and enter that path in Secrets directory. It is mounted read-only at/run/secretsinside the agent. See agent credentials. - Create the install command, copy it before leaving the page, and run it with
Docker on the agent host before the token expires. Both tabs on the result
page use the same token: a
docker runone-liner and a Docker Compose file (see below). - Open Agents and wait for the agent to appear online. An enrolled agent that has never checked in does not complete the checklist.
- Return to Get started to connect your data store.
The named state volume preserves the agent's identity. Reuse it when recreating the container to add secret or data mounts; do not clone or share it between agents. If the install command expires before use, create a new one. If the agent never checks in, check Docker container status, host network access to the console, and the configured HTTPS console URL.
For local folders, NFS, or host-mounted SMB shares, follow the local mount guide. Source credentials stay on the agent host; the console stores their names and presence status only.
Install with Docker Compose
If you prefer a file you can keep, use the compose tab. On the result page of
Install agent, open Docker Compose. It shows a
ready-made compose file with the same protections as the one-liner: a
read-only container, all Linux capabilities dropped, a private /tmp, and the
agent identity in a named state volume. Save the text as compose.yaml in its
own folder on the agent host, then start it:
docker compose up -d
The file contains the same one-time token as the one-liner, so copy it before
leaving the page. Once the agent appears Online on the Agents page, its
identity lives in the state volume and the token is no longer used: you can
delete the DG_AGENT_INSTALL_TOKEN line and run docker compose up -d again.
You can also start from the files in the Myrikeep repository instead of the
console tab: deploy/agent/compose.yaml and deploy/agent/.env.example. Copy
both into one folder on the agent host, save the example as .env, and fill in
the pinned image, your console address and a fresh install token. The template
carries the same protections and documents the optional read-only mounts for
secrets and data, with example host paths for Synology, Unraid and TrueNAS.
Tip: Portainer and Dockge users can paste the compose file into a new
stack. If you used the repository template, add the .env values in the
stack's environment section instead of a .env file. Nothing else needs to
change.
To update later, change the image tag in compose.yaml to a supported pinned
tag and run docker compose up -d again. The state volume is reused, so the
agent keeps its identity; see Upgrade your agent.
Before you install
Use a Linux Docker host you control, with outbound HTTPS access to your console and the selected data store. The install command is a short-lived credential: run it on that host, do not share it. It enrolls an agent in the workspace selected when you generated it. The image runs as UID 10001; mounted secrets and data must be readable by that UID or an appropriate group.
For example, prepare the secret directory before generating your command:
sudo install -d -m 0700 -o 10001 -g 10001 /srv/myrikeep/secrets
Choose the exact directory in the console installation form. Keep the writable
identity state volume at /var/lib/myrikeep. Do not add data folders until you
have chosen their read-only scope. The connector guide describes each
mount and provider permission.
Troubleshooting and upgrades
Online means recent server contact. Stale and Offline mean contact is overdue; check container status, trusted TLS and the console URL. Paused means control check-ins continue but the agent receives no new jobs. A present credential is separate from agent online status. Upgrade required and unsupported builds need a supported image before new jobs can start; follow Upgrade your agent.
Never delete or clone the state volume to fix a connection. If identity is lost, revoke the old agent and enroll a replacement. Revoked identity volumes cannot be reused for enrollment. Installation does not grant source access by itself; prepare agent credentials and a connection.