KnotRoute Control

Control is the optional management plane for networks, Agents, managed Beacons/relays, sidecar services, jobs and onboarding.

Compose

services:
  control:
    image: ghcr.io/localzet/knotroute-control:latest
    restart: unless-stopped
    environment:
      KNOTROUTE_CONTROL_LISTEN: "0.0.0.0:8080"
      KNOTROUTE_CONTROL_ADMIN_PASSWORD: "${KNOTROUTE_CONTROL_ADMIN_PASSWORD}"
      KNOTROUTE_CONTROL_ENROLL_TOKEN: "${KNOTROUTE_CONTROL_ENROLL_TOKEN}"
      KNOTROUTE_CONTROL_PUBLIC_URL: "https://control.example.net"
    volumes:
      - control-data:/data

volumes:
  control-data:

Use distinct admin and enrollment secrets.

Security boundary

Control should be served only over HTTPS and should never receive the Docker socket. Docker management belongs on Agents.

Failure behavior

If Control is down, existing relays, sidecars, circuits and published services continue to operate. Management jobs and centralized inventory are temporarily unavailable.

Backup

Preserve Control /data to retain network profiles, Agent registrations and operational state.

External versus managed Beacons

An external Beacon is only registered in a network profile and requires no Agent. A managed Beacon is created through a deploy_beacon job on a Docker-enabled Agent. Do not deploy a duplicate managed Beacon just because an existing Beacon was created outside Control.

Managed sidecars regenerate runtime config from deployment environment on restart while retaining service identity in persistent /data. Control itself must never receive the Docker socket.

Source