The usual way to control a fleet is to reach into it: open a port on each box, or hold an SSH key that opens all of them. Both make the controller worth attacking.
Exa Fleet inverts it. Each machine runs one long-running service that opens a connection to the console and keeps it. Nothing listens on the VM.
What that buys
- No inbound port to open, and no firewall rule per machine.
- Works behind NAT — a machine on a home router or a laptop tether joins the same way a datacentre VM does.
- Reconnects on its own, with backoff, when the network goes away.
The console cannot reach your machines
This is the deliberate part. The console issues machines their identity, but it holds no SSH key to any of them — because the tokens it issues are already enough to run code, and a console that could also reach every VM directly would turn one web-tier break-in into root across the whole fleet.
So the console writes you an install script and hands it to you. You run it from somewhere that can already reach the targets. See Credentials and Installation.