Kerberos Agent

Last reviewed Sep 13, 2026 · 872 words

The design decision that defines Kerberos Agent is in its name: it is one agent per camera, not one NVR for all of them. Each camera gets its own Go container, its own motion detector, its own recordings folder and its own web UI on its own port. For 1 to 3 cameras that is delightfully simple. For 8 it is 8 containers and no single screen to look at unless you add Kerberos Hub, and that is where the project's open-source story gets more complicated than the MIT licence on the agent suggests.

One agent, one camera, one compose block

The agent is a 1,114-star Go project under an MIT licence, ships as kerberos/agent, and needs about 512 MB per instance for a 1080p H.264 stream with motion detection. A single camera looks like this:

services:
  camera-driveway:
    image: kerberos/agent:latest
    ports:
      - "8081:80"
    environment:
      - AGENT_NAME=driveway
      - AGENT_CAPTURE_IPCAMERA_RTSP=rtsp://user:[email protected]:554/stream1
      - AGENT_USERNAME=admin
      - AGENT_PASSWORD=change-this
    volumes:
      - ./driveway/config:/home/agent/data/config
      - ./driveway/recordings:/home/agent/data/recordings
    restart: unless-stopped

Duplicate the block per camera with a new name, port and RTSP URL. The default login is root / root if you omit the credential variables; do not omit them. Everything you set in the environment is also editable in the UI, and the UI writes it back to the config volume, so the environment acts as the initial seed rather than the source of truth. Pick one approach and stick to it, or you will wonder why a compose change did not take effect.

Motion detection is pixel-based, and that is fine for a driveway

The agent watches for pixel change inside a region you draw in the UI, records the clip with a few seconds of pre-roll, and writes an MP4 to the recordings folder. There is no object detection; a cat, a headlight sweep and a person all count as motion. That sounds like a downgrade next to the AI-detection projects, and for a busy street it is. For a back door, a garage or a driveway with a tuned region and a sensible threshold it produces a small number of clips a day, and the CPU cost stays low enough to run four agents on a Celeron NAS.

Recordings can stay local, upload to S3-compatible storage, or stream to Kerberos Vault, and the agent publishes events over MQTT, which is the hook for Home Assistant automations like turning on the porch light when the driveway agent fires. Live view is WebRTC in the browser and works across the LAN without a plugin.

Hub is where the free part ends

Central management of many agents (one grid of live views, a combined timeline, users and roles) is Kerberos Hub. The project offers a self-hosted Hub, but it is a separate, heavier deployment with its own database and message queue, and parts of the broader platform are commercial. The catalogue lists Kerberos Hub separately for that reason. If your definition of a surveillance system includes "one page showing all cameras," price in that second install before you start, or accept a browser bookmark folder with 8 tabs.

The upside of the split is the reason people choose this over an NVR. Agents are stateless enough to run on Kubernetes with a per-camera Deployment, on a Raspberry Pi bolted to the camera itself, or spread across three machines in a building. Nothing else in the video surveillance category treats a camera as a pod.

Frigate is the safer pick for most homes

If you want person and car detection, a unified timeline, and a large community answering questions, Frigate is the bigger project and the better default, at the cost of wanting a Coral TPU or a decent CPU. If you want something even smaller than Kerberos Agent and only need a webcam or two, motionEye has been doing pixel motion for a decade. Kerberos Agent sits between them: more modern than motionEye, lighter and more modular than Frigate, and the right answer when the per-camera model matches how you deploy things.

Two gotchas that cost me an evening

First, the RTSP URL format varies by camera vendor and the agent's error message when it cannot decode a stream is unhelpful; test the URL with ffprobe on the host first and use the sub-stream for motion if the main stream is 4K. Second, recordings do not prune themselves unless you set a retention policy in the UI; a busy camera at 1080p fills 100 GB in a few weeks. Set the max recording age on day one.

What I'd do

For 1 to 3 cameras on a home network, run one Kerberos Agent container per camera on the NAS, motion regions tuned, MQTT wired into Home Assistant, retention capped at 14 days, and skip Hub entirely. For 4 or more cameras, or for anything where "was that a person" matters, run Frigate instead and keep Kerberos Agent in mind for the odd camera at a remote site that needs its own self-contained recorder.