Add docs about headless machine install

src/pages/client/profile-ownership.mdx

@@ -155,6 +155,37 @@ On a device with no console, for example a server, the default profile keeps no
 sudo netbird profile claim default --owner <owner>
 ```
 
+## Set up a headless machine
+
+A headless machine, for example a server or a Raspberry Pi, has no console. No user can claim the default profile automatically. A user without root privileges cannot connect the default profile.
+
+This protects machines that many users access over SSH, for example a shared server. If the first SSH user claimed the default profile, that user could control the connection of the machine and read its configuration. The daemon cannot know which SSH user is the correct owner, so it lets an administrator decide.
+
+Use one of these two methods.
+
+### Connect as root
+
+Use this method for servers that only administrators manage.
+
+```shell
+curl -fsSL https://pkgs.netbird.io/install.sh | sh
+sudo netbird up --setup-key <SETUP_KEY>
+```
+
+The default profile keeps no owner. Use `sudo` for each command that changes the connection, for example `sudo netbird down`.
+
+### Give the default profile to a user
+
+Use this method if a user without root privileges must control the connection.
+
+```shell
+curl -fsSL https://pkgs.netbird.io/install.sh | sh
+sudo netbird profile claim default --owner <user>
+netbird up --setup-key <SETUP_KEY>
+```
+
+Run `netbird up` as the user that you set with `--owner`. If you omit `--owner`, the owner is the user who ran `sudo`.
+
 ## Troubleshooting
 
 ### Another user has this machine connected

src/pages/get-started/index.mdx

@@ -70,12 +70,17 @@ First, copy the curl command, paste it into your server's terminal, and press **
 curl -fsSL https://pkgs.netbird.io/install.sh | sh
 ```
 
-Next, copy the netbird up --setup-key ... command and paste it into the terminal.
+Next, copy the netbird up --setup-key ... command and paste it into the terminal. Add `sudo` before the command.
 
 ```bash
-netbird up --setup-key <YOUR_SETUP_KEY>
+sudo netbird up --setup-key <YOUR_SETUP_KEY>
 ```
 
+
+<Note>
+    On a machine with no console, such as a server, run `netbird up` with `sudo`. See [Set up a headless machine](/client/profile-ownership#set-up-a-headless-machine).
+</Note>
+
 After running the second command, the terminal will confirm Connected. Your headless device is now part of your NetBird network.
 
 ![Headless install connected](/docs-static/img/get-started/onboarding/06_headless-install-connected.jpeg)
@@ -142,12 +147,17 @@ A [routing peer](https://docs.netbird.io/manage/network-routes) is a NetBird pee
 curl -fsSL https://pkgs.netbird.io/install.sh | sh
 ```
 
-Next, copy the netbird up --setup-key ... command and paste it into the terminal.
+Next, copy the netbird up --setup-key ... command and paste it into the terminal. Add `sudo` before the command.
 
 ```bash
-netbird up --setup-key <YOUR_SETUP_KEY>
+sudo netbird up --setup-key <YOUR_SETUP_KEY>
 ```
 
+
+<Note>
+    On a machine with no console, such as a server, run `netbird up` with `sudo`. See [Set up a headless machine](/client/profile-ownership#set-up-a-headless-machine).
+</Note>
+
 After running the second command, the terminal will confirm Connected. Your headless device is now part of your NetBird network.
 
 ### Connect a Client Device

src/pages/get-started/install/linux.mdx

@@ -488,14 +488,19 @@ For unattended deployments across many machines, pre-populate the client config
 1. Login to the Management Service. You need to have a `setup key` in hand (see [setup keys](/manage/peers/register-machines-using-setup-keys)).
 
 ```bash
-  netbird up --setup-key <SETUP KEY>
+  sudo netbird up --setup-key <SETUP KEY>
 ```
 
 Alternatively, if you are hosting your own Management Service provide `--management-url` property pointing to your Management Service:
 ```bash
-  netbird up --setup-key <SETUP KEY> --management-url http://localhost:33073
+  sudo netbird up --setup-key <SETUP KEY> --management-url http://localhost:33073
 ```
 
+
+<Note>
+    On a machine with no console, such as a server, run `netbird up` with `sudo`. See [Set up a headless machine](/client/profile-ownership#set-up-a-headless-machine).
+</Note>
+
 <Note>
     You could also omit the `--setup-key` property. In this case, the tool will prompt for the key.
 </Note>

src/pages/manage/peers/register-machines-using-setup-keys.mdx

@@ -1,3 +1,5 @@
+import { Note } from "@/components/mdx"
+
 # Automate Deployments and Onboard Machines at Scale with Setup Keys
 
 A setup key is a pre-authentication token used to register new machines in your network.
@@ -9,9 +11,14 @@ Pass the setup key to the ```netbird up``` command to authenticate a machine wit
 This unlocks automated, unattended deployments and integrates cleanly with infrastructure-as-code tools such as Ansible, CloudFormation, and Terraform.
 
 ```bash
-netbird up --setup-key <SETUP KEY>
+sudo netbird up --setup-key <SETUP KEY>
 ```
 
+
+<Note>
+    On a machine with no console, such as a server, run `netbird up` with `sudo`, or as root. See [Set up a headless machine](/client/profile-ownership#set-up-a-headless-machine).
+</Note>
+
 You can also pre-populate the client configuration ahead of first start, so peers come up fully configured and register with no manual steps. See [Bootstrap peers via config file](/manage/peers/bootstrap-via-config-file).
 
 ## Types of Setup Keys