Add Devices

Provisioning a device creates its private network addresses and certificate, then gives you a command that starts the Mesh of Things agent.

Before You Start

Install Docker on the device. Docker Engine and Docker Desktop can both run the agent. The generated command starts a Linux container, mounts the local Docker socket, and grants the NET_ADMIN capability so the agent can create its encrypted network interface.

WARNING

Anyone with an unused bootstrap command can enroll that device. Copy it only to the intended machine and do not place it in logs, tickets, or source control.

Configure the Device

Open Devices, select Add device, and review these fields:

1. Device count: Keep this at 1 to create a device immediately. A value from 2 to 100 creates a background batch instead.
2. Generated device name: For one device, use the refresh button to generate another name. For a batch, enter a prefix; devices are named <prefix>-001, <prefix>-002, and so on.
3. Network: On plans that support multiple networks, choose the network the device will join. Devices on different networks cannot communicate. The Default network is selected automatically if you do not choose another.
4. Firewall group: Select one reusable inbound-rule set, or select None for default-deny inbound traffic. See Create Firewall Groups and Inbound Rules.
5. Apps: Optionally assign one or more apps. If an app has an active version, its deployment is queued for the new device.
6. Isolate from other devices: The device will trust the Mesh of Things infrastructure it needs, but it will not trust network peers. Firewall rules cannot override this certificate-level isolation.
7. Disable dashboard access: Create a mesh-only device with no Docker-management surface. Containers, logs, terminals, and app assignments are unavailable for that device.

The network, peer-isolation setting, and dashboard-access setting are fixed when the certificate is issued. To change one later, decommission the device and provision it again.

Start One Device

Select Create device, copy the generated docker run command, and run it on the intended machine. The agent runs with Docker's default bridge networking and connects outbound to the private overlay.

The bootstrap command is shown only as part of the creation result. If you lose it before starting the agent, decommission the unused device record and create another.

Open the new device's detail page to see when it comes online. A normal device exposes Overview, Logs, and Terminal management through the dashboard; a mesh-only device does not.

Start a Batch

When Device count is greater than one, select Create batch. The dashboard opens the batch progress page. When processing completes, download the temporary ZIP and run each device's command on its corresponding machine. See Device Batches for cancellation, partial failures, and export handling.

Relay Connectivity

Mesh of Things tries direct peer-to-peer paths first. When direct connectivity is not possible, eligible organizations can use a hosted relay that forwards the already-encrypted packets without decrypting them.

Relay access is an organization entitlement, not a per-device switch. The dashboard shows the organization's current entitlement under Settings → Billing.