Installing the server agent

The server agent installs in one command and enrolls itself. This page covers each install surface, the network requirements, and the optional container-metrics flag.

Prerequisites

• A Linux host, x86-64 or arm64, running systemd.
• Outbound HTTPS from the host to the WatchTower15 API. No inbound ports.
• Your organisation’s install token (dashboard → install instructions).
• Ability to run the installer as a user that can create a system service (typically via sudo for the install step only — the agent itself never runs as root once installed).

Note

The installer needs elevated rights once, to create the wt15-agent service user and the systemd unit. After installation the agent runs unprivileged with an empty capability set — see the privilege model.

Install

Linux (one-line)

The fastest path. Downloads the agent, verifies its checksum, creates the service user, enrolls, and starts monitoring:

curl -fsSL https://watchtower15.com/install.sh | sh -s -- <org_token>

Assign the host to a specific profile at install time by exporting its slug first:

export WT15_PROFILE_SLUG=production-servers
curl -fsSL https://watchtower15.com/install.sh | sh -s -- <org_token>

Unattended / IaC

For cloud-init, Ansible, Terraform user_data, or a golden image, the same installer runs non-interactively. Keep the token in your secret store and pass it through the environment:

1. Provision the host with outbound HTTPS to the API.

2. Fetch the token from your secret manager into WT15_ORG_TOKEN (do not bake it into an image layer).

3. Run the installer, pinning a profile so the host is configured on first boot:

   export WT15_PROFILE_SLUG=web-tier
   curl -fsSL https://watchtower15.com/install.sh | sh -s -- "$WT15_ORG_TOKEN"

4. On boot the agent enrolls, collects self-reported tags from the instance’s cloud/Docker/Kubernetes metadata, and begins reporting.

Because auto-enrollment collects cloud metadata, a fleet of identical images each enroll with correct, distinct identity tags — no per-host bootstrap script.

Air-gapped

For hosts without direct internet egress, stage the binary and install script from an internal mirror:

1. On a connected host, download the agent binary and the install script, and note the published X-Content-SHA256 for the binary.

2. Copy both to your internal artifact store or the target host.

3. Point the installer at your mirror and provide the token:

   WT15_BINARY_URL=https://mirror.internal/wt15-server-agent \
   WT15_API_BASE=https://api.watchtower15.com \
     sh ./install.sh <org_token>

4. Verify the downloaded binary’s SHA-256 matches the value you recorded before the service starts.

The host still needs outbound HTTPS to the WatchTower15 API to enroll and report; only the binary distribution is mirrored.

Verify the install

systemctl status wt15-server-agent

● wt15-server-agent.service — WatchTower15 Server Agent
     Active: active (running)
       User: wt15-agent

The host appears in your dashboard within ~60 seconds. The agent writes its own diagnostics to /var/log/wt15-server-agent.log.

Optional: Docker container metrics

By default the agent does not read the Docker socket. You can opt in to per-container CPU, memory and network metrics with an install flag:

curl -fsSL https://watchtower15.com/install.sh | sh -s -- <org_token> --enable-docker-monitoring

Caution

Membership of the docker group is effectively equivalent to root on the host — a group member can start a privileged container that mounts the host filesystem. Enable this only where that trade-off is acceptable, and never as a blanket default across a fleet. It is an explicit, documented opt-in for exactly this reason.

Network requirements

Direction	Destination	Purpose
Outbound HTTPS (443)	WatchTower15 API	enrollment, telemetry, logs, config
Inbound	—	none required

If your host egresses through a proxy, set the standard HTTPS_PROXY environment variable in the service unit’s environment.

Uninstall

sudo systemctl disable --now wt15-server-agent
sudo rm /etc/systemd/system/wt15-server-agent.service /usr/local/bin/wt15-server-agent
sudo userdel wt15-agent

Removing the agent stops reporting; the server remains in your dashboard until you delete it there.

Related

• Configuration reference — environment variables.
• Fleet & profiles — central configuration.
• Upgrades — keeping agents current.