Daemon
Run and control the local control plane: the control loop that boots workstations and forwards sockets.
The daemon is the local control plane: the controller manager (control loops that boot workstations, deliver the in-VM agent, and forward the Docker socket) plus an optional HTTP API. The Ringleader desktop app starts one for you. These commands let you run and control it directly.
Bare rl daemon (no subcommand) runs in the foreground; rl daemon start
detaches it into the background.
rl daemon # run in the foreground
rl daemon start # start detached in the background
rl daemon start --foreground # explicit foreground form
rl daemon status # is one running?
rl daemon restart # stop, then start a fresh one
rl daemon stop
rl daemon log-level debug # raise the log level, kept across restartsSubcommands
| Command | Description |
|---|---|
start | Start the daemon detached, logging to <home>/daemon.log. No-op if one is already running for the data dir. --foreground runs it in the foreground instead of detaching. |
stop | Stop a backgrounded daemon, and wait until its process has exited. It prints rl daemon: stopped (pid N). A daemon still running after 10 seconds is stopped by force, and the line reads rl daemon: force-stopped (pid N). If even that fails, stop exits non-zero. With no daemon running, it prints rl daemon: not running and exits 0. |
restart | Stop the running daemon, then start a fresh one (forwards the full flag set). |
status | Report running state, pid, uptime, home, log path, and the latest log line. On Windows it adds an elevated: line when the daemon runs as an administrator or cannot tell whether it does. Exits 3 when none is running. |
log-level [level] | Show the daemon’s log level, or set it to trace, debug, info, warn or error. The setting is kept across restarts, and a running local daemon picks it up within a few seconds. A daemon started with --log-level or RINGLEADER_LOG_LEVEL starts at that level instead. |
Flags
These apply to start/restart (and bare daemon):
| Flag | Description |
|---|---|
--home <dir> | Data directory. |
--addr <address> | Also serve the HTTP API on this address (default: off). |
--require-auth | With --addr, reject unauthenticated callers (401) instead of treating them as local admin. On by default when --addr is not a loopback address. Pass --require-auth=false to allow anonymous callers, for example behind your own authenticating proxy. |
--jwks-url <url> | Auth-broker JWKS URL; with --addr, broker-minted tokens are accepted alongside local tokens. |
--store-dsn <dsn> | PostgreSQL DSN for the control-plane store (default $RINGLEADER_STORE_DSN; empty = local SQLite). |
--qemu <auto|on|off> | Register the qemu provider: auto (detect KVM on x86-64 Linux), on (force), off (never). Default $RINGLEADER_ENABLE_QEMU, else auto. |
--metrics-addr <address> | Serve Prometheus /metrics on this address (default $RINGLEADER_METRICS_ADDR; empty = disabled, so the local daemon serves none by default). |
--log-level <level> | trace, debug, info, warn, error (default $RINGLEADER_LOG_LEVEL, else info). |
--log-format <text|json> | Log format (default $RINGLEADER_LOG_FORMAT, else text). |
rl status
Report which workstation providers this machine can use, and why a provider cannot be used when it cannot.
rl status
rl status -o json # the same, to branch on in a scriptEach local provider, such as vz, lima, qemu, wsl2 or hcs, and each cloud provider is reported as one of:
| State | Meaning |
|---|---|
available | You can run a workstation on it here. |
not-registered | This machine can run it, and the daemon did not register it. |
unavailable | This machine, or your account, cannot run it. The reason says why. |
unknown | There is no check for it, or no permission to read one. |
The local answer is the daemon’s last check of this machine. With no daemon ever run here,
rl status checks the machine itself and says so.
The cloud answer comes from your organization’s
CloudAccount objects on the control plane you
are signed in to. It checks no cloud credential and makes no call to any cloud. Only an
org administrator can read those objects, so for anyone else each cloud shows unknown.
When you are not signed in, each cloud shows unavailable.
In the text form, the provider a new workstation lands on when it names none ends with
“default for new workstations that name no provider”. In the JSON form, that provider carries
"default": true and no other provider carries default. A report where no provider carries
default does not say which one is the default. That is the case when rl status checks the
machine itself, and for a report from an older daemon. Do not read a missing default as “this
machine has no default”.
A provider that runs a workstation only when the workstation names it, with provider: <name>,
carries "namedOnly": true in the JSON form. On Windows, while hcs is the default, wsl2 is
named-only: the text form leaves the wsl2 row out, and the JSON form keeps it. The
hcs provider says more about what
this means.
If the daemon runs edge VMs on this machine, the report lists each one. It shows the Edge each one serves, its workstations, and whether it is running and serving.
| Flag | Description |
|---|---|
-o, --output <format> | text (default) or json. |
--as <subject> | Impersonate a subject. |
--home <dir> | Data directory. |
Inspecting a running daemon
cat ~/.ringleader/daemon.pid # the live daemon's pid (absent ⇒ none running)
tail -f ~/.ringleader/daemon.log # provisioning, agent-delivery and configuration logsNote
daemon status exits with code 3 (not 1) when no daemon is running, so scripts
can distinguish “not running” from a real error, the same convention systemctl
uses.Running as an administrator on Windows
On Windows, start the daemon from an ordinary terminal, not one opened with Run as
administrator. Every process the daemon starts runs with its rights, including the network
process that carries each hcs workstation’s traffic. So rl daemon, rl daemon start and
rl daemon restart refuse to run as an administrator. They print this line and exit 1:
daemon: refusing to run as an administrator. Start it from a terminal that was not opened with "Run as administrator".A refused rl daemon restart leaves the running daemon running. When a daemon is already running,
rl daemon start prints rl daemon: already running (pid N) and exits 0, even from an
administrator terminal.
If UAC is off, or you sign in as the built-in Administrator account, Windows gives your account
only administrator rights, so the daemon runs as an administrator. rl daemon status then says so:
elevated: yes: this daemon runs as an administrator, the only token this account has (UAC is off, or it is the built-in Administrator)To run the daemon as an administrator anyway, set RINGLEADER_ALLOW_ELEVATED_DAEMON=1 in the
terminal you start it from. Only the value 1 allows it, and the refusal names any other value.
The daemon then logs a warning when it starts, and rl daemon status prints:
elevated: yes: this daemon runs as an administrator; restart it from a terminal not opened as administrator: rl daemon restartWhen you next start the daemon from an ordinary terminal, it replaces each hcs workstation’s network process that a daemon running as an administrator started. The SSH sessions open to those workstations drop once.