Which servers
The same install line as any host. The agent reads /etc/os-release as data: RHEL, Rocky Linux or AlmaLinux at major version 9 or 10 is supported, and the server appears in the RHEL servers area.
- Another RHEL-family system sends its release details only, and no tool runs on it. Any other host reads the file once and does nothing more.
- For each supported server the agent reports SELinux's state, firewalld and whether it forwards ports strictly, Podman, Docker,
dnf, and the users that can run units. - A RHEL server counts as an ordinary host; the RHEL area itself adds nothing to pay. Pricing.
Your apps, unchanged
Containers, compose stacks, scripts and binaries run on Podman (through podman-docker), or on Docker CE where the server already has it. Nothing in Apps, New app, Releases or Monitors changes.
| On the server | What BasePit does |
|---|---|
| SELinux enabled | Adds :z to an app's own folder mounts, never to system paths. |
| firewalld with strict port forwarding | Leaves the published port off the container's line and adds a runtime firewalld forward to the container's address after each start. Elsewhere, the engine's own -p works as on Ubuntu. |
| No Podman yet | Set up Podman installs a fixed list of packages with dnf, turns on Podman's socket and its restart at boot, and adds the compose program BasePit serves. |
Podman is reached on its own sockets (root's, or a user's under /run/user/), never through /var/run/docker.sock.
Podman Quadlet units
A unit is a named group of Quadlet files on one server, run by root or by one existing user. If the user needs lingering turned on, BasePit asks first.
Create a unit from any of these:
- Quadlet files you paste or upload.
- A short form for one image.
- A folder in a Git repository, with follow the branch off by default.
- A ready-made unit from the catalogue.
The last step is a review that runs the server's own Quadlet check on the files. Then:
- Changes apply as numbered revisions. BasePit writes the revision's files with the values it keeps, starts the unit again, and removes files the revision no longer has.
- BasePit marks every file it writes on its first line, and removes or changes only files with that mark.
- Settings marked secret are sealed under your organisation's key, and written on the server only into a
0600environment file that the unit names. - A unit made by hand on the server is shown and can be started, stopped and restarted, but is never edited or removed.
- Deleting a unit stops it and deletes the files BasePit wrote. Files made on the server are kept.
- A terminal opens only into a unit BasePit made, on a server installed with
--allow-terminal.
A server's page
| Tab | Shows and does |
|---|---|
| Overview | The server's state and facts, with a link to its ordinary host page. |
| Units & pods | Every unit and pod, BasePit's and the server's own, with their files, journal and revisions. |
| Ports | Open a port or a service in firewalld's default zone. Closing one refuses what reaches the server through it, from now on and after a restart. |
| SELinux | Each denial, and the fix it names. |
| Updates | The updates waiting, security ones marked, and whether a reboot is needed and why (kernel, glibc, systemd or other packages). Read-only. |
SELinux denials and their fixes
When SELinux refuses an app, the denial appears on the server's page in plain words, for example "web was refused reading /srv/data", with the fix it names, such as relabelling the folder at the next start.
- Applying a relabel fix restarts the unit, and its folders are labelled as it starts.
- An SELinux boolean is switched only as the fix a denial names, and switching it back returns it to what it was before.
- SELinux's mode is never changed.
Alerts and access
- Four alert types: a unit down, an app SELinux refused, a port not opened, and security updates waiting. None is switched on by itself.
- Four levels of access (read, operate, manage, terminal) within the existing roles. Every row is scoped by its server, so access rules on hosts narrow this area too.
What BasePit never touches
- It never installs an update. The Updates tab only reads.
- It never reboots the server, changes SELinux's mode, or starts or stops firewalld.
- It never edits or removes a file that does not carry its own marker.
- Every action is a fixed command with no shell, run with an empty environment.