What every host shows
Every host the agent runs on appears in Hosts with its state, its apps and its measurements. Nothing on the host has to be opened for it.
| On the host's page | What it is |
|---|---|
| Measurements, every 15 seconds | CPU, memory, load, uptime, network in and out, disk use for each mount, and for each GPU its use, memory, temperature and power. Charted as history. |
| Facts | Operating system and kernel, addresses, what it runs in, whether KVM is available, its default network card, whether it wants a reboot, and whether Docker answers. |
| Apps | Every app BasePit runs there, with its state. Containers BasePit did not start are listed too, ready to adopt. |
| Online or not | An agent that stops cleanly says goodbye first, so the page tells a shutdown from a lost connection. |
Alerts for hosts: a host that goes offline, and CPU, memory or disk above a level you set. Host insight adds two more, on by default: a systemd service that failed, and a reboot the machine wants.
Wake: when a host is offline, other hosts on its network can send it a wake-on-LAN packet from its page. BasePit looks again 20 seconds later.
Inside a host
Host insight is for the services and processes BasePit does not manage. It is off until the machine's owner installs the agent with --allow-host-control. The console can never switch it on.
Admins and Operators
Servers listening and their ports, processes, GPUs, systemd services, and host logs under /var/log. Read when you open them, never stored. Command lines are cleared of anything shaped like a secret on the machine before they are sent.
Admins
Start, stop or restart a service, and switch its start at boot on or off. Stop or kill a process. Each is a fixed command, and each is recorded in Activity without a command line.
- Refused whoever asks: PID 1, BasePit's own agent, and any process or service of an app BasePit manages. That app keeps its own Stop and Restart.
- An action works only on a unit or process the agent lists at that moment.
- A service you stopped on purpose can be quieted, so it pages nobody.
- On a Mac, host insight shows servers, processes and GPUs.
Machines to add
An opted-in Linux host can look at its own network and list the machines on it that are not in BasePit yet.
- The quiet look, while Machines to add is open: the machines the host already knows from its neighbour table and mDNS. Each address is greeted once on port 22, and nothing is sent.
- The sweep, for an Admin: the host tries port 22 on every address of its own private subnet, at most 1,024 of them. The sweep is recorded in Activity.
- Only the host's own private networks. Never a public or link-local address.
A machine you find joins BasePit with the install line, or with an enrol key for many at once. See Get started.
VMs on your own hosts
On a Linux host with --allow-host-control and Docker, an Admin can make three kinds of guest. The host's agent makes each one as a container of its own, from images pinned by digest, and acts only on guests in its own record.
| Kind | Runs as | Joins BasePit as | Systems |
|---|---|---|---|
| Linux VM | QEMU with KVM, from a cloud image | A host of its own, under its parent | Ubuntu 24.04 and 26.04, Debian 13, Rocky Linux 9 and 10 |
| Linux container | A container with systemd as its first process | A host of its own, under its parent | The same five |
| Windows VM | QEMU with KVM | A machine on its host, not a host: there is no Windows agent | Windows 11, Windows 10, Windows Server 2025 and 2022 |
- Network: its own address on your LAN, from a range you give once per host, or behind its host with the ports you name.
- Joining: a Linux guest installs the agent as it starts, with a one-time token, and appears under its host.
- Windows: you sign in through its screen in the browser. The screen runs over a socket inside the VM's container, so no VNC or web port exists on any network.
- While it is made, its console output is shown; if it does not join, its last lines usually say why.
- Start and stop from the console. Destroying one asks you to type its name, and removes its container and disk from the host.
Needs: KVM (/dev/kvm) for Linux VMs and Windows. Windows also needs an x86-64 host with 30 GB free. Each host says what it can make, or why not.
Cloud machines in your own account
Connect your DigitalOcean, Hetzner, AWS, Google Cloud or Azure account under Sources. Its credential is sealed under your organisation's key and never shown again. Then make machines from Hosts.
- Where: a region of the account (at Google Cloud, a zone of a region).
- Its size: CPUs, memory, disk, and the provider's own price for an hour and a month, read from the provider and marked as an estimate.
- Its system, its name, and a way in for you: an SSH key kept at the provider.
The machine starts with a one-time token in its start-up script and joins BasePit as a host by itself: there is no line to paste. It gets no extra install flags. Power it off and on from the console; a machine powered off on purpose pages nobody. One that sits idle is warned about by default, and destroying one asks you to type its name.
Only x86-64 sizes up to 16 CPUs and 64 GiB.
For anything else, make the machine in the provider's own console and enrol it with the install line. BasePit acts only on machines its own make recorded, never on one it finds by name.
Running a fleet
- Tags and host groups. A deployment can target every host with a tag, resolved when you deploy. A host group is an ordered list of hosts, released in that order.
- Approval for new hosts. An organisation can make new hosts wait for approval before they run anything.
- Agent upgrades from the console, for one host or every out-of-date one. If the new agent does not connect after three starts or two minutes, the old one is put back.
- Disk clean-up. A host group can remove images no container uses, and the build cache, when a disk passes a level you set.
- Many machines at once with an enrol key in cloud-init, Ansible or Terraform. Each joins named by its own hostname.
- New secret replaces a machine's secret and keeps its history. Revoke stops sending it anything.
Limits
- BasePit does not restart a stopped app by itself, and does not run a reconcile loop. See how decisions are made.
- Without
--allow-host-control, services and processes BasePit does not manage are invisible to it. - There is no agent for Windows: a Windows VM is reached through its screen.
- VMs need a Linux host. Making a cloud machine is limited to the sizes above.