Edge agent

The edge agent is a small containerized service that runs on each device in your fleet. It’s what turns a camera or edge box into a managed AcuSight endpoint: it registers the device, reports in, ships captured images, and runs the model you deploy. You install it once with the setup command and manage it from the dashboard after that.

​

What it does

• Registers the device — on first run it exchanges a one-time setup token for a device key and joins your organization.
• Checks in — sends a regular heartbeat with status, so the dashboard shows live online/offline state and last-seen time.
• Pulls pending actions — each check-in returns work to do, such as picking up a newly deployed model.
• Uploads images — captured frames (JPEG/PNG) are sent to AcuSight, where they land as batches ready to annotate.
• Runs inference — hosts the deployed model and, where the hardware supports it, uses the device’s accelerator.

​

How it connects

The agent authenticates with a per-device key and talks to AcuSight over an outbound HTTPS connection:

• No inbound ports. Devices behind NAT or a firewall work with no networking setup — nothing listens for incoming connections.
• Self-contained credentials. The device key identifies the device to the core APIs; it’s separate from user logins, so a compromised device can’t act as a user.
• Automatic recovery. If a device loses connectivity, it reconnects and resumes checking in on its own once it can reach AcuSight again — see Reliability.

​

Under the hood

Provisioning actually leaves two small containers running on the device:

• The AcuSight agent handles the device’s own work: registration, check-in, image and recording upload, and hosting the deployed model.
• A Portainer Edge Agent provides the container-management channel. AcuSight embeds Portainer as its fleet orchestration layer; during provisioning the platform issues the device an edge key, and the AcuSight agent uses it to start the Portainer Edge Agent alongside itself.

The management channel follows the same outbound-only rule as everything else. The Edge Agent polls the platform, and only when you actually open a device’s containers, stacks, or logs does it dial a short-lived encrypted tunnel out to the platform. The tunnel closes after a few minutes of inactivity, so nothing on the device stays reachable between management sessions. This is what makes the container view in the dashboard real orchestration — start, stop, redeploy, inspect — rather than a read-only status page.

​

Footprint

The agent runs as Docker containers, so it carries its own dependencies and stays isolated from the rest of the device. It’s designed to sit alongside your workload on modest edge hardware rather than require a dedicated machine — see Supported devices for the baseline.

​

Next steps