Self-Hosted Machines
What the Trickest Agent is, what it can access, and how self-hosted execution works.
On this page5
Overview
Self-hosted machines are your own machines — servers, virtual machines, cloud instances, bare-metal hardware, or macOS devices — that you connect to Trickest to execute workflows on your infrastructure. This is useful for data locality, access to internal networks, compliance, or custom hardware.
Self-hosted machines are available on all plans; on the Community plan, they are the way to run workflows — your self-hosted fleet is created at signup.
What a Self-Hosted Machine Actually Is
Attaching a machine does not hand control of it to Trickest. A self-hosted machine is simply a machine of yours running the Trickest Agent — a single service that maintains an outbound connection to the Trickest platform and executes workflow jobs when you run workflows on its fleet.
Concretely:
- The agent authenticates to the platform with per-machine credentials (a Client ID and Client Secret generated when you add the machine).
- All communication is outbound HTTPS from your machine to Trickest. The agent opens no inbound ports, and Trickest never connects into your machine.
- The agent sits idle until a run targets its fleet. Work is never pushed into your machine: the agent checks in with the platform over its outbound connection, and when a run targets its fleet, the platform hands it jobs — one workflow node each — in response. It executes them one at a time.
- Each job runs as a Docker container on your machine: the node's tool image is pulled, inputs are provided to the container, the tool runs, and the outputs are uploaded back to the platform. Nothing executes directly on the host outside of containers.
What the Agent Can and Cannot Access
The agent is installed as a system service (via systemd on Linux, launchd on macOS) and requires access to Docker to start job containers. On Linux, the service runs with root privileges — the same requirement as any software that manages Docker containers.
What it does with that access is narrow:
- It communicates only with the Trickest platform.
- It does not read, scan, or upload files from your machine. The only data that leaves the machine is the output of jobs you run, and the only data that arrives is the inputs of those jobs.
- Jobs it executes are the nodes of your own workflows — the agent runs nothing you didn't schedule.
- You stay in control: stop the agent service at any time, or delete the machine from Settings > Fleet > Self-Hosted to revoke its credentials.
Machine Lifecycle
- A machine that hasn't executed any jobs for 30 days is automatically removed from your fleet, even if the agent is still connected. To keep a machine registered, run something on it within that window; if it was removed, re-attach it.
- By default a self-hosted fleet holds up to 3 machines. Contact us if you need a higher limit.
- Machine credentials are shown only once, at creation. If they are lost, delete the machine and attach it again.