The daemon is the agent that runs on every node. It exposes a REST API that the panel calls to manage what happens on that host — containers, processes, files, packages — and calls back to the panel to report state.
A node without a running daemon cannot be controlled. Nothing else on the node talks to the panel.
| Area | What the daemon does |
|---|---|
| Docker | Container and image lifecycle, I/O attach, stats, ports, mounts |
| Processes | Host process inspection and child-process supervision |
| Files | Reads, writes, chunked uploads, hotlinks |
| Packages | apt on Linux; MSI and PowerShell on Windows |
| SSH / SFTP | Optional SSH and SFTP access, scoped per tenant |
| Relay | TCP relay messaging for live console and events |
| Network | Interface and port queries |
| Licence | Validates this node's entitlement to run |
The daemon is a Java 21 application. On Linux the package installs the runtime for you, so there is no separate Java step.
Storage is file-based. There is no database on a node — persistent state lives in the daemon's
root directory (registries, licence cache, upload staging) and in daemon.properties.
The daemon must run as root on Linux and as Administrator on Windows. It checks this during
startup and refuses to continue otherwise. It manages cgroups, installs packages, and
supervises processes belonging to other users; none of that works unprivileged.
In production the daemon is not started directly. The wrapper supervises it — downloading versions, verifying them, and starting and stopping them. The daemon JAR actively refuses to run unless it was launched by the wrapper or given an explicit development flag.
This is what makes remote upgrades possible: the wrapper stays up while the daemon underneath it is replaced. See The wrapper.
Roughly, on boot the daemon establishes its root directory, loads configuration, restores its container and child-process registries, checks privilege, verifies dependencies, sets up networking and its API client, fetches the ports the panel wants it to bind, loads its keystore, validates its licence, starts its services, and finally handshakes with the panel.
The ordering of those last steps matters: ports are fetched, then bound, then reported. The panel completes the handshake by calling the node back, so nothing can be reported before it is listening.
Next: Installing the daemon.