Docker

A Nexus Telemetry Fleet collector runs in a container on any host that has Docker. The image is published for amd64 and arm64 and pulls without a login. Docker restarts the container, and the nf-data volume holds the collector’s certificate.

Install

Pull the image.

bash
docker pull registry.nexustelemetry.com/nf-collector:latest

Every image is signed with cosign. Verify the tag against the Nexus Telemetry public key before running it. The check reads the signature from the registry, so the host must reach the registry.

bash
cosign verify --key https://nexustelemetry.com/cosign.pub registry.nexustelemetry.com/nf-collector:latest

The docker-manifest-digest in the result must match the digest of the pulled image. A signature that does not verify means the image was not signed by Nexus Telemetry. Do not run it. The fleet server image is verified the same way.

Enrol

The Add telemetry collector window generates this command with the real values. The command includes the fleet server’s address, the token and, when one was given, the name.

bash
docker run -d --pull always --name nf-collector --restart always --network host \
  -e NF_SERVER=<your-address> \
  -e NF_TOKEN=<token> \
  -e NF_SOURCES=starlink,connection,ping \
  -e NF_DEVICE_NAME='<terminal name>' \
  -v nf-data:/var/lib/nexus-fleet \
  registry.nexustelemetry.com/nf-collector:latest

The container connects outbound to the fleet server. The site requires no inbound connection, no port forwarding and no firewall rule.

Flag Effect
--pull always Docker fetches the newest image before the container starts, instead of running a cached older one
--network host The collector reads the host’s own network interfaces, so it can tell a change of connection from a short interruption
-v nf-data:/var/lib/nexus-fleet The named volume stores the collector’s certificate and its readings
--restart always The container restarts after a crash and after a reboot

Warning: the volume holds the collector’s certificate. A container started without it, or after the volume is deleted, enrols as a new collector with a new record. The old record keeps its history.

Service

Action Command
Stop docker stop nf-collector
Start docker start nf-collector
Restart docker restart nf-collector

After a restart the collector reconnects to the fleet server.

Logs and paths

What Where
Binary The image entry point, nf-collector
Config None. The -e variables configure the container
Data directory /var/lib/nexus-fleet in the container, the nf-data volume on the host
Logs docker logs nf-collector, and a rolling copy at /var/lib/nexus-fleet/logs/collector.log, 5 files of 10 MB each
Service name The container, nf-collector
Service user nexus, uid 10001, inside the container

Update

To update, remove the container and run it again on the same volume. --pull always fetches the newer image. The dashboard cannot update a container, because a container cannot replace itself.

bash
docker rm -f nf-collector
docker run -d --pull always --name nf-collector --restart always --network host \
  -e NF_SERVER=<your-address> \
  -e NF_SOURCES=starlink,connection,ping \
  -e NF_DEVICE_NAME='<terminal name>' \
  -v nf-data:/var/lib/nexus-fleet \
  registry.nexustelemetry.com/nf-collector:latest

The command omits NF_TOKEN. An enrolled collector ignores it. The collector starts from the certificate in the volume and reconnects to the same record with the same name and history. Do not enrol it again. A new token is required only when the volume no longer exists, or to enrol the collector again on purpose with NF_REENROL=1.

Remove

To reinstall the collector later on the same host, remove the container and retain the volume. Do not decommission the collector on the dashboard.

bash
docker rm -f nf-collector

The dashboard shows the terminal as offline until the collector is reinstalled. The readings and the certificate stay in the nf-data volume, and the reinstalled collector reconnects to the same record.

Purge

To remove the collector permanently, decommission it on the dashboard first, while it is online. The collector deletes its enrolment and the dashboard marks its record decommissioned. Remove on the dashboard deletes the record. See Retire and revoke. Then remove the container and the volume.

bash
docker rm -f nf-collector
docker volume rm nf-data

No collector files remain on the host. A collector installed on the host later enrols as a new collector, with a new record on the dashboard.

← Dashboard Debian →