Skip to content
Reoclo Docs

The Runner

The Reoclo Runner is a small agent that lives on your server and gives Reoclo a secure way to deploy, observe, and operate it — without opening a single inbound port.

Install it once with a one-line command. It opens an outbound WebSocket to Reoclo and stays connected. When you deploy from the dashboard, Reoclo sends instructions through that connection; the Runner executes them locally, streams output back, and keeps health and metrics flowing in real time.

No SSH keys to rotate. No bastion hosts. No firewall exceptions. The server connects out; Reoclo talks in. If the network flaps, the Runner reconnects itself. If a new version ships, it upgrades itself. You mostly forget it’s there.

This page walks through what the Runner gives you as a tenant. For installation steps, see Install the Runner.

Deploy

Section titled “Deploy”

Outbound-only connection

Works behind firewalls, NAT, home networks, and corporate proxies. No inbound ports needed.

Live deployment logs

Every build command and container output streams back to the dashboard in real time as it runs.

Encrypted env var delivery

Secrets are encrypted at rest and delivered only when a deployment runs — never stored on the server.

Saved script execution

Any script from your Saved Scripts library can be executed on any Runner-connected server, on demand.

Observe

Section titled “Observe”

Real-time system metrics

CPU, memory, disk, and network usage (IPv4 + IPv6) refreshed on the heartbeat interval.

Application logs

Tail any container’s logs from the dashboard with configurable retention.

Server fingerprint

OS, kernel, Docker version, listening ports, and firewall rules — reported automatically every 60 seconds.

Live health status

Heartbeat-backed “active” / “unreachable” state that updates within seconds of a network change.

Control

Section titled “Control”

Interactive terminal

Open a real PTY-backed shell into any container straight from the dashboard.

Container management

Start, stop, restart, inspect, and prune containers from the dashboard UI.

Automatic reconnection

Exponential backoff with linear fast-retries. Network flaps self-heal without manual intervention.

Self-updating agent

The Runner pulls and installs new versions automatically when they ship — no manual SSH required.

How it fits together

Section titled “How it fits together”

The Runner is a background process on your server that maintains a single outbound WebSocket connection to Reoclo. That connection is the entire control plane — no SSH sessions, no inbound HTTP API, no agent pull loop.

Here’s what happens when you click Deploy in the dashboard:

  1. The dashboard enqueues a deployment job in Reoclo’s API.
  2. Reoclo routes the job over the existing WebSocket to your Runner.
  3. The Runner executes the commands locally — git pull, image build, container start, env file write — and streams stdout/stderr back over the same WebSocket.
  4. The dashboard renders the live output as it arrives.

Between deploys the Runner is still busy: health heartbeats every few seconds, system metrics pushed on an interval, and container logs tailed so they appear in the dashboard. If the connection ever drops — laptop closes, modem resets, ISP blip — the Runner reconnects with exponential backoff and picks up where it left off.

You don’t manage any of this. You just see the dashboard update.

sequenceDiagram
  actor User as You
  participant Dashboard
  participant Reoclo
  participant Runner as Runner (your server)

  Note over Runner: WebSocket stays open<br/>(outbound only)
  Runner-->>Reoclo: heartbeat + metrics + logs
  Reoclo-->>Dashboard: live health & metrics

  User->>Dashboard: click Deploy
  Dashboard->>Reoclo: enqueue deployment
  Reoclo->>Runner: deploy command
  Runner->>Runner: git pull · build · start
  Runner-->>Reoclo: stream stdout/stderr
  Reoclo-->>Dashboard: live output

Where to go next

Section titled “Where to go next”