The agent and the network
Do I need to open a port, a VPN or a firewall rule?
No. The agent dials out over ordinary HTTPS and keeps one WebSocket open. No managed host needs an inbound firewall rule. A Kubernetes cluster's agent connects out the same way. How the connection works.
What does a machine need?
Linux with systemd running, or macOS, on amd64 or arm64; root through sudo; and outbound HTTPS to app.basepit.com. Container apps need Docker, or Podman on RHEL-family servers. Requirements.
What happens to my apps if BasePit cannot be reached?
They keep running: BasePit is not in their path. The agent reconnects by itself and sends up to 15 minutes of measurements it kept while away.
What does the agent send, and do you keep my logs?
Facts and measurements every 15 seconds, command results, and check results. App logs are streamed only while someone reads or searches them, and BasePit keeps no copy. The full list.
How do I add many machines at once?
Make an enrol key and give it to cloud-init, Ansible or Terraform; the console gives you ready-made snippets. Each machine joins named by its own hostname. Enrol keys.
How do I remove the agent?
Run sudo sh /etc/basepit/uninstall-agent.sh on the machine. It needs no network. Then revoke the host in the console.
Security and data
What can BasePit do on my machine?
Run the apps you registered with it, and nothing else: there is no code path that runs an arbitrary command. A terminal, host control, playbooks, builds, VMs and AI agents are each an install flag the machine's owner sets. What each flag allows.
Can anyone switch those on from the console?
No. Each one is a flag on the install line, set on the machine by whoever has root there. The console shows what a machine allows, and cannot change it.
Where are my secrets kept?
Sealed under a key that belongs to your organisation alone, and never shown again. A secret is decrypted only when a command needs it and handed to the process in memory. It is never written to the machine's disk, a log or the console. You can also read secrets from HashiCorp Vault or AWS Secrets Manager. How secrets travel.
Is my data kept apart from other customers'?
Yes. Every record belongs to one organisation, and a record of another organisation is answered as not found. Secrets are sealed per organisation, and uploaded files are kept in a folder per organisation.
Who in my team can do what?
A Viewer reads everything, an Operator starts, stops and deploys, and an Admin can change everything. Access rules narrow a person or a team further, by environment, host group, tag or app, and can never widen a role.
What is recorded?
Every action, in Activity: who, what and when. Terminals are recorded when they open and close, never their contents. Export Activity as CSV or JSON, or stream it to your SIEM on an account that has bought credits.
Apps and hosts
What can I deploy?
A container image, a compose file, a JAR or saved image, a script on the host, or the docker run or java -jar line you run today, pasted in. Or a ready-made app from the catalogue. Apps.
Does BasePit restart a crashed app by itself?
No. BasePit is remote control, not an autopilot. Containers keep Docker's own restart policy, readiness shows any app without one, and BasePit tells you the moment something stops.
Can BasePit take over containers that are already running?
Yes. Adopt a container or a compose project from its host's page, and BasePit runs it from then on.
Does a deploy wait until the app is healthy?
Yes. A release counts a copy as done only when its command finished and it came up healthy. An unhealthy copy goes back to what it ran before, and the release stops.
Can BasePit make VMs or cloud machines?
Yes. Linux VMs, Linux containers and Windows VMs on your own Linux hosts, and machines in your own DigitalOcean, Hetzner, AWS, Google Cloud or Azure account. Each Linux one joins as a host by itself. Hosts.
Does the agent run on Windows?
No. There is no Windows agent. A Windows VM that BasePit makes is reached through its screen in the browser, and Ansible can reach Windows machines over WinRM.
Kubernetes, Proxmox, RHEL, Ansible
Do you support Kubernetes and OpenShift?
Yes: the three newest Kubernetes minor versions upstream supports, and OpenShift 4.x built on them. An agent inside the cluster connects out; you apply YAML and Helm charts after Kubernetes' own dry run. Kubernetes.
Which Proxmox versions?
Proxmox VE 8.4 or later in the 8 line, and Proxmox VE 9. No Proxmox password or API token is given to BasePit. Proxmox.
Which RHEL-family servers?
RHEL, Rocky Linux and AlmaLinux, versions 9 and 10, with Podman or Docker CE. BasePit never installs updates or reboots them. RHEL servers.
Do I need to install Ansible?
No. BasePit brings ansible-core in a self-contained Python. A Linux host installed with --allow-automation runs playbooks for itself, and as a runner for machines without the agent. Automation.
Do I have to use all of these areas?
No. Kubernetes, RHEL, Proxmox and Automation are separate areas. If you only run apps on a few servers you never see them, and you pay only for what you switch on.
Monitoring
Where are my sites checked from?
Public targets are checked by BasePit's workers in up to three places, which vote before anyone is paged. Private targets are checked by your own hosts. How checks run.
Can I add my own check locations?
Not as workers: workers are run by BasePit. Your own hosts already check private targets, and a monitor can be checked from one named machine of yours.
Which alert channels are there?
Slack, e-mail through your own mail server, Telegram and signed webhooks. On accounts that have bought credits, also SMS, WhatsApp and phone calls sent by BasePit, paid per message. Or pass alerts to your own SMS or voice provider through a webhook.
Can my status page use my own domain?
No. Status pages are served at BasePit's own address. Each also serves JSON, a badge and a history file.
AI
Which AI coding agents can I run?
Claude Code, Codex, Gemini CLI, OpenCode, Amp and Pi, on a Linux host whose owner allowed it, or in a box on a new branch of your repository. AI agents.
Can I use my own AI provider or key?
Yes. Use BasePit's AI, connect your organisation's own provider (including any OpenAI-compatible server), or turn AI off. AI coding agents use your own sign-in or keys.
What does BasePit send to an AI model?
For playbooks, what you ask and the playbook, never a secret, and no question or answer is kept beyond its draft. Nothing an AI writes runs by itself: a playbook is previewed first, and a Toolbox fix is labelled AI-written.
Credits and your account
Can I try BasePit without paying?
Yes, and keep using it. Every account gets 70 free credits every month, for good: one server and twenty uptime monitors. On top, 300 sign-up credits let you try more for your first three months. No card is asked for. Pricing.
Will I be charged when the free credits run out?
No. BasePit keeps no card, so nothing is ever charged by itself. You get three days of grace, then the newest things pause until you top up. Your apps keep running, and nothing is deleted.
Is there a free plan?
There are no plans at all. A free account uses the whole product, with four limits until you buy once: up to two hosts, checks every 5 minutes from one place, and no SMS, WhatsApp or call alerts. Buying any pack lifts them for good.
Do teammates cost extra?
No. Credits pay for machines and checks, never for people. Invite your whole team.
How do I know what I will spend?
Every form that adds something shows its price first, and Billing shows what you spend and about how many days your credits last. The calculator adds up a setup before you start.
Do you issue GST invoices?
Yes, a GST tax invoice for each purchase. You pay in rupees in India and in US dollars elsewhere, on the payment provider’s own page. BasePit never sees your card.
How do I sign in?
With your BasePit account: email and password, Google, or Slack, with two-step sign-in through an authenticator app if you turn it on.