Docker
The Docker Host is the machine that runs Docker bots. It runs the Docker Host agent: a container that connects to the Sinfonia orchestrator, receives executions from the queue, fetches the bot image and runs it as a container on the machine’s own Docker.
This agent is different from the agents for Windows and Linux, used by Script, Zip and Git bots. Docker bots can only run on a Docker Host. They are compared in the Agents overview.
Important
Running Docker bots is a premium feature, purchased separately on the platform. The Docker tab in bot creation and the Docker Hosts screen only become available after it is purchased.
How it works
flowchart LR
O["Sinfonia<br/>orchestrator"] <-->|HTTPS| A["Docker Host<br/>agent"]
A -->|docker.sock| D["Host's<br/>Docker Engine"]
D --> C["Bot<br/>container"]
R[("Registry or<br/>image file")] -->|image| D
- The agent polls the orchestrator’s execution queue.
- When it receives an execution, it checks whether the bot image already exists on the host. If not, it fetches the image according to the source configured in the bot: pull from a public registry, authenticated pull, or load of the uploaded file.
- It creates and starts the container, passing along the execution’s environment variables.
- It captures the container output (
stdoutandstderr) and sends it to the orchestrator as the execution log. - At the end, it removes the container and records the result: exit code
0means success, any other value means error.
Requirements
- Linux machine with Docker Engine and the Docker Compose plugin installed.
- Docker Host feature purchased on the platform.
- Outbound access to the Sinfonia orchestrator at
grpc.sinfonia.liveover HTTPS (port 443), as described in the prerequisites. - Outbound access to the registries the bot images will be pulled from (Docker Hub, GHCR, Amazon ECR, etc.).
- UDP ports
49252to49292allowed through the firewall to the host, used to view container logs in real time from the portal. - An agent token. Use the account’s
mastertoken or create a new one in tokens. - Enough CPU, memory and disk for the agent and for the bot containers that will run on the host.
Warning
The agent accesses the host’s Docker through the /var/run/docker.sock socket, which is equivalent to full control over Docker on the machine. Use a host dedicated to automations and avoid sharing it with other workloads.
Deployment
Download the agent image
The Docker Host agent image is available for download inside the Sinfonia platform. Download the file and copy it to the host.
Load the image into Docker
On the host, load the downloaded file with the docker load command:
docker load --input <image-file>When it finishes, the command prints the name and tag of the loaded image, in the format Loaded image: <name>:<tag>. Note this value for the next step.
Create the docker-compose.yml
In a folder on the host, for example /opt/sinfonia-docker-host, create the file below:
services:
sinfonia-docker-host:
image: <name>:<tag>
container_name: sinfonia-docker-host
restart: unless-stopped
environment:
AGENT_NAME: DOCKER-HOST-01
AGENT_TOKEN: <your-token>
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /:/rootfs:ro
- /etc/os-release:/etc/os-release:ro
ports:
- 49252-49292:49252-49292/udp
deploy:
resources:
limits:
cpus: "2"
memory: "2000MB"Adjust the variables
In image, provide the name and tag printed by docker load.
| Variable | Required | Description |
|---|---|---|
AGENT_NAME | Yes | Name that identifies the Docker Host in the portal. Accepts letters, numbers and hyphens, is converted to uppercase and limited to 15 characters. |
AGENT_TOKEN | Yes | Token that authenticates the agent with the orchestrator. |
GRPC_SERVER_URL | No | Orchestrator address. Defaults to grpc.sinfonia.live. |
Warning
AGENT_TOKEN is a secret. Restrict read access to docker-compose.yml to the user who administers the host, and do not commit the file with the token filled in.
The volumes serve the following purposes:
| Volume | Purpose |
|---|---|
/var/run/docker.sock | Lets the agent pull images and create, start and remove containers on the host’s Docker. |
/proc, /sys, / and /etc/os-release | Mounted read-only, they let the agent report the host’s information and resource usage. |
The deploy.resources.limits block limits the agent’s own consumption, not that of the bot containers.
Start the agent
cd /opt/sinfonia-docker-host
docker compose up -dWith restart: unless-stopped, the agent comes back up on its own when the host or the Docker service restarts.
Confirm the connection
Check the agent logs:
docker logs -f sinfonia-docker-hostThen open the Docker Hosts screen in the portal. The host should appear with the name defined in AGENT_NAME. From then on it can be selected in the Docker Host field when creating a Docker bot.
Managing images and containers
On the portal’s Docker Hosts screen you can follow each connected host, with its stored images and existing containers, and you can:
- view a container’s logs;
- start, pause, restart, stop, kill or remove a container;
- remove an image from the host.
Execution behavior
- Start time: with an empty queue, the agent polls the orchestrator every 30 seconds. An execution may take up to that long to start.
- Image cache: the agent only fetches the image when it does not yet exist on the host. If you publish new content reusing the same tag (for example
latest), the host keeps running the old image. - Cleanup: the container is removed at the end of each execution. The image stays on the host for subsequent executions.
Tip
Publish each bot version with its own tag, such as my-bot:1.0.1. To force a fresh download of an existing tag, remove the image from the host on the Docker Hosts screen.
Updating or removing the agent
To update, download the new version of the image from the platform, load it on the host and recreate the container:
docker load --input <image-file>
docker compose up -dIf the new image has a different tag, update the image field in docker-compose.yml before recreating the container.
To remove the agent from the host:
docker compose downTroubleshooting
| Symptom | Likely cause | What to do |
|---|---|---|
Log AGENT_TOKEN environment variable must be set | Token not provided. | Fill in AGENT_TOKEN in docker-compose.yml and recreate the container. |
Log AGENT_NAME environment variable must be set | Name not provided. | Fill in AGENT_NAME and recreate the container. |
Log Could not send healthcheck and container restarting | No access to the orchestrator, or invalid token. | Check network access to grpc.sinfonia.live (HTTPS, port 443) and the token in use. |
| Execution fails while fetching the image | Image does not exist, invalid credentials, or registry unreachable from the host. | Check the image path, the credential variables and network access to the registry. |
| Bot runs an old version | Tag reused, with the old image cached on the host. | Publish with a new tag or remove the image on the Docker Hosts screen. |