A private worker is a lightweight agent you run inside your own network. It polls Monitorion every 15 seconds for due checks, executes them locally, and posts results back — no inbound ports or firewall rules required. Available on every plan, including free.
Monitorion's cloud workers run in data centers and can only reach publicly routable addresses. A private worker runs on hardware you control — a home server, office machine, Raspberry Pi, or VPS — and can reach anything on that network: 192.168.x.x, 10.x.x.x, localhost, or internal hostnames.
Outbound-only
Worker polls Monitorion — nothing ever connects inbound to your machine
MIT Licensed & Open Source
Inspect, fork, or self-host — the full source is publicly available
All Plans
Private workers are available to every account, including the free tier
Monitor devices that are only reachable on your local network.
Monitor internal infrastructure without opening firewall ports.
Run the worker on a VPS to monitor services on its private network interface.
Private workers support a broad set of monitor types — everything that makes sense to run from inside a network.
Create a worker in Settings
Go to Settings → Private Workers and click Add Worker. Give it a name so you can identify it later.
Copy the API key
After creation the API key is shown once. Copy it now — it is hashed immediately and cannot be retrieved again. If you lose it, delete the worker and create a new one.
Run the Docker container
Paste the command below on any machine inside your target network, replacing the placeholder values:
docker run -d \
--name monitorion-worker \
--restart unless-stopped \
-e MONITORION_PLATFORM_URL=https://app.monitorion.com \
-e MONITORION_API_KEY=wkr_your_key_here \
-e WORKER_NAME=my-worker \
--cap-add=NET_RAW \
monitorion/worker:latestNote: --cap-add=NET_RAW is required for Ping (ICMP) checks. If you do not need ping monitoring you can omit it.
Assign the worker to a monitor
When creating or editing a monitor, open the Check via dropdown and select your worker. Any target address — including private IPs and internal hostnames — is now reachable.
Done — your monitor now runs from your network
The worker picks up the job on its next 15-second poll. Results, incidents, and alerts work exactly the same as cloud-run monitors.
Outbound-only connection
The worker connects out to Monitorion to fetch jobs and post results. No inbound connections are ever made to your machine. You do not need to open any firewall ports or configure port forwarding.
API key hashed with SHA-256
Your API key is hashed on the server immediately after creation. Only the last 8 characters are retained for display purposes. Even if the Monitorion database were compromised, the plaintext key would not be exposed.
Private IPs are intentionally allowed
Cloud workers block RFC-1918 private addresses (192.168.x.x, 10.x.x.x, etc.) as an SSRF safeguard. Private workers deliberately skip this check — that is the entire point. Only cloud metadata IPs (AWS, GCP, Azure) are blocked by default.
Worker ownership verification
The platform verifies that every monitor ID in a submitted result belongs to the authenticated worker's account. Results for monitors you do not own are rejected.
| Variable | Required | Description |
|---|---|---|
| MONITORION_PLATFORM_URL | Required | Base URL of your Monitorion instance (e.g. https://app.monitorion.com) |
| MONITORION_API_KEY | Required | API key from Settings → Private Workers (starts with wkr_) |
| WORKER_NAME | Optional | Display name for the worker shown in the dashboard |
| CONCURRENCY | Optional | Number of checks run concurrently. Default: 10 |
| POLL_INTERVAL_MS | Optional | How often (ms) the worker polls for new jobs. Default: 15000 (15 seconds) |
Set up your first private worker in minutes — no plan upgrade required.