Getting started
Install the stack, sign in, enrol your first host and ask it a question — four steps, each tied to a real command.
Four steps get you from nothing to an answer: install the stack, sign in, enrol a host, and ask it something. Every command below is one you can run today.
What you need
- Docker Engine 24+ with the Compose plugin (
docker compose version). - Ports 443 (and 80 for a Let’s Encrypt certificate) free on the host.
- A Linux machine to enrol as the first host — the one you’re installing on works.
1. Install
Get the deployment bundle from the licensing portal’s Downloads page — not by cloning this repository. The air-gapped bundle needs no registry access at all; extract it and bring the stack up:
tar -xzf dsh-stack-0.1.0-airgap.tar.gz && cd dsh-stack-0.1.0-airgap
for t in images/*.tar; do docker load -i "$t"; done
docker compose up -d --wait
docker compose logs control-plane | grep -A6 'FIRST-BOOT ADMIN'
See self-hosting for the registry-access bundle, TLS modes and k3s.
The whole stack self-hosts with one command; an air-gap bundle ships every image.
2. Sign in
The grep above prints the first administrator’s password once, in the control plane’s log, and nowhere else. Open https://<DSH_HOSTNAME>/ (or https://localhost/ with the defaults) and sign in with admin@localhost — or DSH_ADMIN_EMAIL, if you set one — and that password.
3. Enrol your first host
From the console, create an enrollment bundle for the host’s platform — it comes down as an enrollment.json scoped to one workspace, single-use by default. On the target machine, install the host agent and point it at that file:
dsh-host-agent run --enrollment-file enrollment.json
On first start the agent creates its own device identity, calls the control plane’s /agent/enroll with the single-use token, then connects to the Gateway. The host appears under Hosts within seconds.
A host joins the fleet with one install command and an enrollment token; revoking the host unpairs it.
Read-only execution policy is the default on every enrolled host; the full policy is an explicit, per-host choice.
4. Ask your first question
Select the host under Ask and pose a question in plain language — for example, whether it still permits SSH password authentication. The answer streams back with the exact command that ran, its exit code and its output, before the finding.
Every answer shows the exact commands that ran, their exit codes and output, per host.
From here: agent-install-linux, agent-install-macos and agent-install-windows cover the other platforms, admin-guide covers users, models and deployment settings, and self-hosting covers k3s, air-gapped installs and day-2 operations.