Installing the agent on Linux

Get the enrollment bundle

From the console, create a Linux enrollment for the target workspace. It comes down as an enrollment.json carrying a single-use token — the machine that redeems it is what appears under Hosts.

A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.

Install

Run in the foreground first, to confirm enrollment succeeds:

dsh-host-agent run --enrollment-file enrollment.json

Once that connects, install it as a background service instead — the packaged tarball’s installer registers a systemd unit and creates a dedicated, unprivileged dsh-agent account to run it under:

sudo ./install.sh --enrollment-file enrollment.json

Paths

• Install prefix: /opt/dsh-host-agent, owned by root, readable by the dsh-agent group.
• State directory: /var/lib/dsh-host-agent, mode 700, owned by dsh-agent. Override it with DSH_AGENT_STATE_DIR.
• Service unit: /etc/systemd/system/dsh-host-agent.service.

The execution policy

Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.

The dsh-agent account is also read-only diagnostic groups (adm, systemd-journal) rather than root — the policy bounds which commands run, and the account bounds what they can reach.

The service

Once installed, the agent heartbeats every 30 seconds and re-syncs its signed skill catalog every 5 minutes. Check on it without touching the service:

dsh-host-agent status
dsh-host-agent status --local
dsh-host-agent diagnose

Uninstall

Removes the background service; local state is left in place:

dsh-host-agent uninstall