What it scans
Regular files beneath one read-only folder mounted in your agent. This includes local disks, NFS exports and SMB shares that the host already mounts. Synced Google Drive or OneDrive folders also work, but their cloud sharing information is absent from the local copy. For direct SMB access use SMB.
What you need
A Linux customer-run agent and a folder its UID can read and traverse. The hosted pool cannot read local mounts. The host handles NFS/SMB authentication and mounting; the agent does not mount filesystems and needs no privileged Docker access. Never use the agent's state or secrets as data.
Step 1: Prepare the host folder
For an existing disk folder, grant the agent's UID read access to files and traverse access to directories. For NFS, have the storage admin grant this host read-only access to the selected export. For example, after installing your host's NFS client tools, mount the export as root:
sudo mkdir -p /srv/myrikeep/data/reports
sudo mount -t nfs -o ro nas.example.test:/exports/reports /srv/myrikeep/data/reports
Replace the server and export with your actual values. Verify the mount and UID mapping before starting the agent. Use a host-managed read-only SMB mount for an SMB folder, or the direct SMB connector instead.
Step 2: Bind the folder into the agent
Add this flag before the image name in your generated Docker command:
--mount type=bind,src=/srv/myrikeep/data/reports,dst=/data/reports,readonly
Recreate an existing container with the same state volume to add this mount. Keep the data mount read-only. Do not make the container privileged.
Step 3: Add a connection and scan
In Connections → Add connection, select Local/NFS mount, assign the agent,
set Mount name to reports, and choose credential mode Local mount. Leave
Credential name empty. Enter a relative Subfolder if needed, save, then wait for
a current present report. In Scans, select the connection and queue a scan.
Connection settings table
| Console field | Example | Required or optional |
|---|---|---|
| Connection name | NAS reports |
Required; unique in workspace |
| Type | Local/NFS mount (local) |
Required |
| Mount name | reports |
Required; matches /data/reports |
| Subfolder | Finance/2026 |
Optional; relative to mount root |
| Agent | NAS agent |
Required; customer-run, same workspace |
| Credential mode | Local mount (none) |
Required |
| Credential name | Empty | Must be empty |
| Exclude patterns (View/edit) | *.tmp |
Optional; one glob per line |
| Enabled (connection row) | Enabled | Disable to stop new scans |
Mount names have 1–32 lowercase letters, digits, _ or -, beginning with a
letter or digit. Subfolders use /, with no leading slash, . or .. component.
Never enter a host path in these fields.
Secret file
No secret file or catalog entry is needed. The resolved credential value is the empty JSON object:
{}
Do not create a credential file containing this object. Host NFS/SMB credentials stay in the host's mount configuration, outside the scanned folder.
Scope, exclusions and schedules
The mount and optional subfolder bound the scan. Exclude *.tmp, Archive/*
or */.snapshot/* in Connections → View/edit. Globs match relative paths
and basenames, case-sensitively, before content reads. See
Getting started for schedule cadence.
Findings use local://<connection-id>/<relative-path> locations.
"Who can see it" support
Sharing checks are not available for this source yet. Local POSIX modes, NFS export rules and cloud sharing of synced files are not assessed in phase 1. Modification time supports age review; access time is unreliable and can be changed by scanning. See Who can see it.
Troubleshooting
| State or error | What to do |
|---|---|
unknown |
Wait for a fresh current-revision heartbeat; check assignment and online status. |
missing / Invalid |
Local needs mode none and an empty credential name. Correct the connection; no catalog secret is needed. |
present |
Local credential mode is valid. This does not verify that the mount exists or is readable. |
source_error / access denied / missing path |
Inspect local agent diagnostics. Check bind mount, Subfolder, host export and UID read/traverse rights. |
| Local paths must be relative | Remove leading slashes, backslashes, dot components and parent paths. |
| Local sources require Linux mount identity information | Use the Linux agent with /proc available. |
| Refusing to crawl a bundle directory | Choose a normal data folder rather than an application bundle. |
| Hosted agent refuses local mounts | Assign a customer-run agent. |
| Paused / Migration paused / Disabled | Resume agent, assign and save a valid connection, or enable it. |
signin_required |
Applies only to personal-drive OAuth, not local mounts. |
Limits
Symlinks, special files, application bundles, secrets/state roots and nested filesystem/bind-mount boundaries are refused or skipped. Create separate connections/mounts for separate filesystems. No filesystem writes or mounts are performed by the agent. Parsing and sampling are bounded; common text, PDF text and modern Office have parsers. Other files receive strings-only checks. Text in images and scanned PDFs needs OCR, an optional premium feature a workspace owner enables; it runs inside your agent with the OCR agent image. Review Coverage, including skips, before treating a scan as complete coverage.