Run the collector in Docker

Compose or run the collector container with host networking and a secret-backed enrollment token.

Updated Aug 24, 2026Product 2026.95 minMSP operator, Internal IT

Prerequisites

A Docker or container-runtime host, x64
Host networking support (bridge mode degrades discovery accuracy)
A one-time enrollment token generated for the target site

Overview

The Docker image runs the same collector binary as the native packages. Use host networking so the container can see local broadcast, ARP and multicast discovery traffic; bridge networking hides most of the local segment from the collector.

Container image is roadmap

The published assuriq/collector Docker image is on the roadmap and not yet generally available. The v0.1 native collector currently ships as Windows x64 and Linux x64 packages only — see Install on Windows or Install on Linux. This page documents the intended Docker workflow for when the image ships.

What the v0.1 collector does today
A plain list of what the native v0.1 collector supports right now versus what is designed but not yet active, and what the DEV build badge means.

docker run

Run with an environment variable

docker run -d \
  --name assuriq-collector \
  --network host \
  --restart unless-stopped \
  -e ASSURIQ_ENROLLMENT_TOKEN="<one-time-token>" \
  -e ASSURIQ_URL="<control-plane-url>" \
  -v assuriq-collector-data:/var/lib/assuriq \
  assuriq/collector:latest

docker compose

Prefer a Docker secret or an environment file kept out of version control over inlining the token in a committed compose file.

docker-compose.yml

services:
  assuriq-collector:
    image: assuriq/collector:latest
    network_mode: host
    restart: unless-stopped
    environment:
      ASSURIQ_ENROLLMENT_TOKEN_FILE: /run/secrets/assuriq_token
      ASSURIQ_URL: "<control-plane-url>"
    secrets:
      - assuriq_token
    volumes:
      - assuriq-collector-data:/var/lib/assuriq

secrets:
  assuriq_token:
    file: ./assuriq_token.txt

volumes:
  assuriq-collector-data: {}

Verify the container

Tail logs

docker logs -f assuriq-collector

Once enrollment succeeds, the container persists its permanent credential in the assuriq-collector-data volume so it survives container restarts and image upgrades without re-enrolling.

Removal

Stop and remove

docker rm -f assuriq-collector
docker volume rm assuriq-collector-data

Removing the data volume destroys the collector's stored credential. Revoke the collector from AssurIQ before or immediately after removal so a leaked volume backup cannot be reused.

Uninstall and revoke a collector
How to retire a collector cleanly: uninstall the host software and revoke its credential so it cannot re-authenticate.

Troubleshooting

If the collector shows up but discovery finds nothing on the local segment, confirm the container is running with --network host and not the default bridge network.

AIQ-ENR-001Enrollment token invalid or already used
The enrollment token was not recognized, or has already been exchanged for a credential.
AIQ-COL-001Collector offline
The collector has not sent a heartbeat within the expected interval. Discovery, scans and evidence collection for its sites are paused.

Was this helpful?

collector docker enrollment

Install the collector on Linux (x64, systemd)

VM Appliance