Run Sonar workers on a host

The published worker launcher requires Docker and curl. It checks Docker, asks Sonar for registry access, registers the returned TLS registry with docker login, pulls Sonar's configured worker image, and starts the requested number of containers. Each container then asks Sonar for its RabbitMQ and MinIO configuration when it starts.

You do not need a BBM checkout or separate RabbitMQ, MinIO, or registry credentials.

Before you start

The host needs:

1. Docker installed, with its daemon running and Linux containers enabled on Windows;
2. curl on Linux or macOS, or PowerShell on Windows;
3. network access to Sonar and the container registry; and
4. the operator-managed WORKER_BOOTSTRAP_SECRET from the team credential channel.

The launcher checks whether Docker is installed and reachable. If it is missing or stopped, the launcher prints OS-specific installation or startup instructions and exits without requesting credentials.

Start workers

Run the launcher directly from docs.astrixion.ai:

curl -fsSL https://docs.astrixion.ai/run-worker.sh | bash

The launcher prompts for:

• WORKER_BOOTSTRAP_SECRET without echoing it;
• the worker image: standard, nuclei, or service-detection; and
• the number of workers to start.

It uses https://sonar.astrixion.ai by default. To use another Sonar deployment or avoid the image and count prompts, pass those values as arguments:

curl -fsSL https://docs.astrixion.ai/run-worker.sh | bash -s -- \
  --backend-url https://sonar.astrixion.ai \
  --type standard \
  --scale 4

The secret is still requested interactively. Avoid passing --secret directly unless the shell history and process list on the host are appropriately protected.

The launcher uses the image tag returned by Sonar, warns when the Docker host is not AMD64, and starts containers with an init process and 1 GiB of shared memory. If any container fails to start, the command exits unsuccessfully and reports the partial count.

Verify

List the containers created by the launcher:

docker ps --filter label=bbm.run-worker=1

Then follow one container's logs:

docker logs -f <container-name>

Verify that:

• every requested container remains running;
• the log reports successful bootstrap without exposing credentials;
• worker pulses appear in Sonar;
• the workers advertise the expected routing tag; and
• pending tasks for that tag can move to Published and Running.

Add or remove capacity

Run the launcher again to add more containers. --scale is the number added by that invocation; it does not resize or replace workers already running on the host.

Remove every worker created by either launcher on the host with:

curl -fsSL https://docs.astrixion.ai/run-worker.sh | bash -s -- --stop

Troubleshoot

• Docker error: confirm Docker is installed, the daemon is running, and the current user can access it.
• Bootstrap 401: retrieve the current secret through the team credential channel; do not generate a client-only replacement.
• Bootstrap/network error: check the Sonar URL, TLS, firewall, DNS, and host reachability.
• Registry login or pull failure: confirm the host can reach the registry returned by Sonar.
• Architecture warning: published worker images target AMD64. Configure supported emulation or move the workers to an AMD64 host if the pulled image cannot run.
• Workers pulse but tasks remain pending: compare the task's target tags with the tags advertised by the workers and check routing capacity.