The whole estate · one console
One console for your servers.
Deploy containers and compose stacks. Run Kubernetes, OpenShift, Proxmox and RHEL. Run real Ansible. Grade your domains’ security. Watch AI coding agents at work. Each machine’s agent dials out over HTTPS, so nothing opens in.
Free to start, no card. One server and twenty monitors free, for good.
Illustration of the console. Your console shows your own machines.
Everything in one place
Sixteen areas. One sign‑in.
Every area below is in the product today, behind one set of roles, one audit trail and one bill.
Instead of a container UI, a log viewer, an uptime checker, a status-page service, kubectl and its dashboards, the Proxmox web UI, an Ansible box and a security scanner: one console, one set of roles, one audit trail, one bill.
A closer look
Deep where it counts.
Each area speaks its platform’s own language, and each one is optional. If you only run apps on a few servers, you never see the rest.
Deploy what you have, as it is.
Paste the docker run or java -jar line you already use. BasePit turns it into an app, shows every change it made, and runs nothing until you say so.
- Five ways in: an image, a compose file, a JAR or saved image, a script on the host, or a ready-made app from the catalogue.
- Adopt containers that are already running, and BasePit runs them from then on.
- A release counts a copy only when it is healthy. An unhealthy copy goes back to what it ran before.
- Redeploy from a Docker Hub, GHCR or Harbor webhook, follow an image’s digest, or build from Git on your own host.
- Live logs, search across every copy at once, a terminal and a read-only file browser.
- Cron jobs with their own heartbeat, config files, and compose drift shown, never applied.
Every machine, and the ones you have not made yet.
CPU, memory, disk and load every 15 seconds. On a host whose owner opts in: servers listening, processes, GPUs, systemd services and logs, with start, stop and restart.
- VMs on your own hosts: a Linux VM, a Linux container, or Windows, signed into through its screen in the browser.
- Cloud machines in your own account: DigitalOcean, Hetzner, AWS, Google Cloud or Azure. Each joins by itself.
- Machines to add: an opted-in host lists the machines it sees on its own network.
- Agent upgrades from the console that fall back by themselves, disk clean-up, wake-on-LAN, tags and host groups.
Your clusters, in Kubernetes’ own words.
An agent inside the cluster, installed from a Helm chart or plain YAML, connects out to BasePit. Nothing has to reach in.
- Objects, events, logs, CPU and memory with history, and Helm releases.
- Scale, restart and roll back a Deployment, delete a pod, set a Secret, open a terminal into a pod. Each one a named, recorded action.
- Apply YAML bundles with numbered revisions and prune, and Helm charts, after Kubernetes’ own dry run.
- Follow a Git branch, or install charts from the catalogue.
- Choose the agent’s reach at install: the whole cluster or chosen namespaces, view only or not.
- Install OpenShift or OKD on your machines from a boot image one of your hosts makes.
Proxmox, without handing over a password.
Install the same agent on each Proxmox VE node, 8.4 and later. No Proxmox password or token is ever typed into BasePit.
- Every VM and container with its state, CPU, memory and disk, plus nodes, storage and backups.
- Start, shut down, stop and restart; take, roll back and delete snapshots.
- An LXC terminal, or a VM’s screen in the browser.
- Make a host: a new VM or container with BasePit already inside, ready for your apps.
- Alerts for a guest nobody stopped, storage over 90 %, a failed backup or lost quorum.
Podman, SELinux and firewalld, handled.
Versions 9 and 10. Your apps run unchanged on Podman or Docker, with SELinux labels and firewalld ports taken care of.
- Quadlet units from pasted files, an image form, a Git folder or the catalogue, checked first by the server’s own Quadlet check.
- See SELinux denials and apply the fix each denial names.
- Open ports, see the updates waiting, and get an alert when security updates are waiting.
- BasePit never installs updates, reboots or changes your system’s settings.
Real Ansible. Previewed before it touches anything.
BasePit brings Ansible itself, so there is nothing to install. Run playbooks on your hosts and on machines that do not have the agent.
- Preview runs Ansible’s check mode with a diff on every machine: what would change, changing nothing.
- Run runs exactly what the preview ran: the same files on the same machines.
- Tested playbooks from a catalogue, run from a form, with no YAML.
- AI writes a playbook from what you describe, reviews yours, and explains why a run failed.
- Every preview and run kept for 90 days, with Ansible’s own output for each machine.
Security checks with a grade and a fix.
Add a domain or a web app. BasePit runs the checks that fit it, grades it A to F, and tells you how to fix each finding.
- E-mail security, mail blocklists, website security headers, DNS health, public subdomains, deep TLS configuration, certificate and domain expiry.
- An AI-written fix for each problem, with where to make it in your provider’s console. Labelled as AI-written.
- A PDF for a run and for a whole domain, and re-checks every week or every 1 to 90 days.
- Each check runs in a locked-down container. Deeper checks run only on a domain you have proved you own.
Run AI coding agents on your machines, and stay in charge.
Start Claude Code, Codex, Gemini CLI, OpenCode, Amp or Pi on one of your hosts, in the folder and as the user you choose, or in an isolated box on a new branch of your repository.
- Watch it work from the browser, and answer its questions with a button.
- See what it changed, then ask for a commit, a review or a recap in one click.
- Hand the work to a different agent, with a note of where it stands.
- A session survives BasePit’s own agent restarting. BasePit pushes a box’s branch when it is done.
- Your own sign-in or keys, sealed and never shown again.
Know before your customers do.
Public targets are checked from up to three places. Each confirms a failure on its own, then they vote, so one bad network does not page anybody.
- Websites and APIs (status, keyword, JSON path, certificate, response time), ports, ping, DNS, and heartbeats on a cron schedule.
- Incidents open and resolve with the monitor, with a timeline, updates and acknowledgement.
- Public status pages, with JSON, a badge and history for your own site.
- Twelve kinds of rule, from down and slow to high CPU, out of memory, restarts and missing copies.
- Slack, e-mail, Telegram, signed webhooks; SMS, WhatsApp and calls from BasePit, or through your own provider by webhook.
- Quiets and maintenance windows hold the messages, never the checks.
And also
The details you would otherwise script yourself.
How it works
One line on the machine. One tab for you.
Sign in
Create your BasePit account with email and password, Google or Slack.
Paste one line
A token that works once and expires in an hour. The installer checks first and writes nothing until the checks pass.
The agent dials out
One connection over ordinary HTTPS. No inbound port, no VPN, no firewall rule. The host turns green as it connects.
$ curl -fsSL https://app.basepit.com/install.sh | sudo sh -s -- --token <TOKEN>
Linux or macOS, Intel or ARM. The agent is checked against two checksums before it is installed. Removing it is one command that needs no network.
Built carefully
The details that matter at 3 a.m.
Anything that can change a machine is off until the machine’s owner turns it on, at the machine. Everything else is built to fail safe.
The agent dials out over HTTPS. No managed host needs an inbound firewall rule.
A secret of its own, proven on every connect and never sent again.
No path runs an arbitrary command. A terminal, host control, VMs and AI agents are install flags; the browser cannot turn them on.
Sealed under your organisation’s key and handed to the process in memory. Command lines are cleared of secrets before they leave a machine.
A copy counts only when it is healthy. An unhealthy one goes back to what it ran before, and the release stops.
Kubernetes’ own dry run, Ansible’s check mode, the server’s own Quadlet check. What runs is what you saw.
Destroying a VM, a guest or a cloud machine asks for its name. Proxmox protection is honoured, never cleared.
Up to five approvers, never the person who started it. Policies refuse unlisted registries, root containers and missing health checks.
Viewer, Operator and Admin, with rules that take rights away and never add them. Every action is recorded in Activity.
Pricing
Try it properly. Pay when it’s worth it.
One server and twenty uptime monitors are free every month, for good, and 300 sign-up credits let you try the rest. After that, a server is 50 credits a month: about ₹41.50 or 50 cents on the smallest pack.
70 credits every month
One server and twenty uptime monitors, free, for good.
300 to try the rest
A second server, VMs, AI agents: room to try everything for your first three months.
No card, no seats
Nothing is charged by itself, and your whole team joins at no cost.
Your apps never stop
Run out and the newest things pause after three days of grace. Your apps keep running, and nothing is deleted.
The price before you add
Every form shows what it costs, and Billing shows how many days your credits last.
GST tax invoices
Pay in rupees in India and in US dollars elsewhere. We never see your card.
Questions
Straight answers.
Do I need to open a port or a VPN?
No. The agent dials out over HTTPS. Nothing on your network has to accept a connection from outside. Kubernetes works the same way: the agent inside the cluster connects out.
What can BasePit do on my machine?
It runs only the apps and recipes you add. A terminal, host control, VMs and AI agents are off unless the machine’s owner switched them on when installing the agent.
Which machines can run the agent?
Linux with systemd, and macOS, on Intel or ARM. VMs and AI agents need a Linux host. Proxmox VE 8.4 and later, and RHEL, Rocky Linux and AlmaLinux 9 and 10, each get their own area.
Do I have to use all of it?
No. Kubernetes, RHEL, Proxmox and Automation are separate areas. If you only run apps on a few servers, you never see them, and you pay only for what you switch on.
What happens to my apps if BasePit can’t be reached?
They keep running. BasePit is not in their path. The agent reconnects by itself and sends what it saw while it was away.
Does BasePit restart a crashed app by itself?
BasePit is a remote control, not an autopilot. Your containers keep Docker’s own restart policy. BasePit checks that each app has one, and tells you the moment something stops.
Can I use my own AI?
Yes. Use BasePit’s AI, connect your own provider (including any OpenAI-compatible server), or turn AI off for your organisation. AI coding agents use your own sign-in or keys.
Is my data kept apart from other customers’?
Yes. Every organisation’s data is its own, and its secrets are sealed under a key for that organisation alone.
Can my team use it?
Yes. Invite people by e-mail. A Viewer reads everything, an Operator starts, stops and deploys, and an Admin can change everything. Teams own apps, hosts and monitors.
Is there a free plan?
There are no plans. Every account gets 70 free credits every month, for good: one server and twenty uptime monitors. A free account has four limits, such as two hosts and checks every 5 minutes, and buying any pack once lifts them. Pricing.
Your first host is a minute away.
Sign up, paste one line, and watch it turn green.