Quick start

The shortest path to a working atreoAGENT.

1. Sign up at app.atreolink.com and finish two-factor setup.

2. Create docker-compose.yml in a fresh directory:

   services:
     atreoagent:
       image: ghcr.io/atreolabs/atreoagent:latest
       container_name: atreoagent
       restart: unless-stopped
       network_mode: host
       cap_add:
         - NET_ADMIN
       devices:
         - /dev/net/tun
       volumes:
         - ./agent-data:/var/lib/atreoagent

3. Start the agent and watch the logs:

   docker compose up -d
   docker logs -f atreoagent

   The agent prints a one-time pairing URL:

   time=2026-05-25T14:43:07.833Z level=INFO msg="atreoAGENT starting..."
   time=2026-05-25T14:43:07.834Z level=INFO msg="No deviceID found, starting pairing flow..."
   
     ╔═══════════════════════════════════════════════════╗
     ║  atreoAGENT pairing — operator approval required  ║
     ╚═══════════════════════════════════════════════════╝
   
     Pairing code: 6ACXDJ
     Approve at:   https://app.atreolink.com/approve/<device-id>#<one-time-token>
   
     The fragment portion of the URL (after '#') stays in your
     browser and never reaches atreoLINK. It anchors the owner
     identity key on this agent.
   
     Waiting for approval...

4. Open the URL in a browser signed in to atreoLINK and choose your subdomain (e.g. alice.atreo.link).

5. Add an app in the dashboard, then invite someone by email.

That’s it. The agent obtains TLS, configures WireGuard, and starts the reverse proxy automatically.

For the full story, see the Overview, the canonical Install page (with all configuration options), and Pair your server.