Get an enrollment token from panel.gritiva.com → Add VM. The agent installs in under 60 seconds and the VM appears in your panel immediately. See Quick Start.
No. The agent is a single PyInstaller binary with no Docker dependency. Inside a scope, however, you'll typically run docker compose to deploy your apps — that's where Docker is useful. The host running the agent doesn't need Docker installed unless your scopes use it.
Anything with kernel ≥ 5.15, systemd, iproute2, and nftables should work. We don't currently support Alpine (musl-libc incompatibility with the bundled binary).
A VM is a full guest OS with its own kernel. A Scope is a Linux network namespace + cgroup running on the agent's host kernel. Lighter than a VM, more isolated than a container. See Concepts: Scope.
gmesh IS a WireGuard mesh — so technically a VPN. The difference is: gmesh is per-scope, not per-VM. Each scope gets its own private interface and identity. Two scopes on the same VM are isolated from each other unless explicitly meshed. See Concepts: Mesh.
Containers share the host's network stack and PID namespace by default — weaker isolation. Scopes give you full netns + cgroup isolation but without the overhead of a full VM. See Concepts: Scope for the full comparison.
No. The agent dials out to our control plane via WebSocket (always outbound 443). Scopes reach the public internet via the host's egress; inbound traffic comes via Cloudflare's tunnel into your scope. You don't open any inbound ports on the host.
Can two scopes on different VMs talk to each other?#
Yes — that's exactly what gmesh is for. Once both scopes join a VNet, they reach each other on a private subnet over WireGuard, no further config.
The agent's enrollment token is stored at /etc/gritiva/agent.toml (mode 0600, root-only). The hosted control plane stores account passwords as bcrypt hashes (cost 12) and session tokens as JWTs with a 60-minute TTL. See Privacy Policy.
Revoke it from the panel (Settings → Tokens) — the affected agent will fail its next heartbeat and need re-enrollment. Until you revoke, anyone with the token can register a fake VM under your account. Treat enrollment tokens like API keys.
The hosted control plane sees telemetry (heartbeats, scope counts, mesh peer state) but not application payloads. Your gmesh traffic is end-to-end WireGuard between your VMs — we cannot decrypt it. See Privacy Policy §3.