Probe fleet and the private agent

How checks run across regions and pools, how to register a private monitor-worker inside your network with a registration token, the agent lifecycle — and what assignment does and does not do today.

Checks are executed by monitor-worker processes. The hosted fleet runs in the regions you can pick on a monitor — us-east, us-central, us-west, eu, au, asia, me — and the same worker image can be run inside your own network as a private agent that registers with the platform and heartbeats from there.

Regions and execution

Run a private agent

1. 1In the admin console, Infrastructure → Agents → Registration tokens, generate a token. Tokens are prefixed ptreg_, valid for 15 minutes by default (up to 24 h) and single-use by default (up to 100 uses).
2. 2Start a monitor-worker with the token and a writable credential path. The worker POSTs to /api/v1/agents/register with the token, receives a permanent pt_agent_… credential, writes it to AGENT_CREDENTIAL_PATH and never needs the token again.
3. 3The agent appears under Unauthorized agents with status pending. An admin authorises it by assigning a region (required) and a pool (optional).
4. 4From then on it heartbeats every 30 seconds; it is marked degraded after 90 s without a heartbeat and offline after 300 s. Lifecycle: pending → active → disabled / revoked.

monitor-worker:
  build: ./services/monitor-worker      # same image as the hosted fleet
  environment:
    AGENT_REGISTRATION_TOKEN: ptreg_…     # single-use; ignored once redeemed
    AGENT_CREDENTIAL_PATH: /data/agent-credential.json
    ADMIN_SERVICE_URL: https://<admin console host>
  volumes:
    - ./data/monitor-worker:/data         # must be writable by uid 1000
  cap_add: ["NET_RAW"]                    # only if the agent runs ICMP checks

The worker runs as a non-root user; only the credential file is written, and only when a registration token is set. ICMP needs CAP_NET_RAW as a file capability, not root.

What assignment does today

Environment reference