Adding a host

Add a host from the empty Fleet screen (Add host), from the + menu (Add host…), or from the host switcher. The sheet is titled Add Host, and a control at the top called Connect via offers three ways in: SSH, Portainer and Advanced.

SSH

SSH is the default. meshDeck opens an SSH session and runs docker system dial-stdio, so it talks to the Docker Engine API through the socket without exposing anything. Your SSH user needs the docker command and access to the Docker socket.

Fill in the Host section:

Name (optional). If you leave it blank the address is used.
Address or Tailscale name
Username
Port. Defaults to 22.

Then choose how to Sign in with.

TailscaleOffered when the address looks like a tailnet address (it ends in .ts.net, is a 100.64.0.0/10 address, or is a single-word MagicDNS name). No key is stored: your tailnet identity signs you in, provided the host has Tailscale SSH enabled.
New keymeshDeck makes an Ed25519 key on this phone. The private half never leaves it. Tap Copy authorized_keys command and run it once on the host, then connect. The command creates ~/.ssh if needed and appends the public key to authorized_keys. meshDeck cannot tell whether you ran it, so a mistake shows up when you connect.
Import keyPaste an OpenSSH private key (-----BEGIN OPENSSH PRIVATE KEY-----), Ed25519 or ECDSA. Keys with a passphrase and RSA keys are not supported.
PasswordThe password is stored in this phone's Keychain and sent only inside the encrypted SSH session.

Tap Connect. The first time, you will be asked to verify the host’s key (see Trust prompts).

Portainer

Choose Portainer and fill in:

Name (optional)
Server URL (https://host:9443). A bare host also works, and the port defaults to 9443.
Access token. In Portainer, open My account → Access tokens and create one. It is stored in this phone’s Keychain and sent only over TLS.

Tap Connect. meshDeck lists the Docker environments on the server. If there is one, it is saved. If there are several, pick one under Environment and tap Save. An environment that is down is marked “(down)”.

The server’s certificate is pinned the first time you connect. If it is self-signed you will be asked to trust it.

Advanced (the docker command line)

Advanced runs the docker command over SSH instead of using the Engine API. Use it when the SSH user cannot reach the Docker socket directly. It has a few limits: statistics update about every two seconds, and a container whose settings cannot be expressed as docker create flags cannot be recreated from here.

Turn on Run docker with sudo if the command needs it, and choose where the sudo password comes from:

None. Passwordless sudo.
SSH password. Reuse the password you signed in with (available only for password sign-in).
Enter. Type a separate sudo password, stored in the Keychain.

Passwordless sudo for just docker is the cleaner option. Tap Copy sudoers line and run it on the host:

echo "$USER ALL=(ALL) NOPASSWD: /usr/bin/docker" | sudo tee /etc/sudoers.d/meshdeck

Connect checks docker version first. If it succeeds you will see “Docker <version> on <os>/<arch>”. If not, the message says what went wrong: docker is not installed or not on your PATH, the user cannot use the Docker socket, sudo needs a password, and so on.

Trust prompts

The first time you connect to a host or a server, meshDeck shows its fingerprint and asks you to verify it.

Prompt	When	Choices
Verify host key	First SSH connection	Trust and save, Trust once, Cancel
Verify certificate	First HTTPS connection	Trust and save, Trust once, Cancel
Host key changed	The key is not the one saved	Trust the new key (red), Trust once, Cancel
Certificate changed	The certificate is not the one saved	Trust the new certificate (red), Trust once, Cancel

Compare the fingerprint with the host before you trust it. A changed key can mean the host was reinstalled, or that something is intercepting the connection. If you did not reinstall it, choose Cancel.

Adding more hosts

The free plan includes one host with every feature. Adding a second needs meshDeck Pro. When you reach the limit the sheet shows Multiple hosts need meshDeck Pro. See Free and Pro.