Worker setup

What vapn install actually does to your machine, and what it leaves behind.

This page describes what the installer does, for people who would rather know than trust. None of it is surprising, and all of it is inspectable afterwards.

What it writes

vapn install generates a Docker Compose file and a configuration file, then starts the container. The compose file pins the image and the environment the worker runs with; the configuration file holds the worker's name, its region, and the credentials it received when it enrolled.

The credentials are the only sensitive thing on the machine. They authenticate this worker to the platform. They do not grant access to anything else, and they can be revoked from the platform side without touching the machine.

What it starts

One container. It:

• fetches a signed snapshot of the targets it should measure;
• measures them on an interval;
• batches and signs the results;
• uploads the batch over HTTPS;
• sends a heartbeat roughly every thirty seconds so the platform knows it is alive.

What it does not do

It does not scan anything. The targets come from the platform as a signed list, and a worker measures exactly what is on that list and nothing else. This matters legally as well as technically: a worker is not a scanner, and running one is not port scanning.

It does not read anything from your machine beyond what it needs to run. It does not enumerate your processes, your other containers, or your network neighbours.

It does not accept connections. There is no control port, no dashboard on localhost, and no way to reach the worker from outside the machine.

Checking it

vapn status      # enrolment, snapshot age, last upload
vapn logs        # what it has been doing
vapn doctor      # the same checks the installer ran, against the running system

vapn doctor is the one to reach for first when something looks wrong: it repeats the install-time checks against the machine as it is now, which catches the case where something that was true at install time has stopped being true.

Uninstalling

vapn uninstall stops the container, removes the compose and configuration files, and tells the platform the worker is going away. Doing it this way rather than deleting the container by hand means the fleet register knows, and your worker is retired rather than sitting in the register as silent.