Omynix Omynix

One command, and the
machine is in your fleet

A 12 MB Go binary. Under 15 MB of RAM. Zero inbound ports. Live telemetry, Docker control, a secure web terminal and kernel-level Shield on every Linux box you run.
$ curl -fsSL "https://omynix.com/install.sh?token=sd_enroll_YOUR_TOKEN" | sudo bash
Omynix Omynix
Fleet
Shield
Domains
Docker
Terminal
Backups
Settings
Fleet 4 nodes · 3 online
web-01 Ubuntu 24.04 · amd64
CPU 34%
RAM 2.1/8 GB
nginxredisapp
db-01 Debian 12 · amd64
CPU 61%
RAM 11.4/16 GB
postgrespgbackrest
edge-pi Raspberry Pi OS · arm64
CPU 88%
RAM 3.6/4 GB
sensor-hub
mail-01 Debian 12 · offline
last heartbeat 2h ago
agent unreachable
stale
omynix.com SSL 71d portal.omynix.com SSL 71d legacy.example.org SSL 6d
> agent enrolled · heartbeat ok
Shield: ssh bruteforce detected
203.0.113.44 reported by 3 fleets in 40s · dropped via nftables
network consensus

Runs on the Linux you already run

Core capabilities

Everything runs through one agent, one outbound connection, one dashboard.

Live fleet telemetry

CPU, memory, disk, network, temperature and per-mount usage from every node, pushed sub-second over a single WebSocket. No polling, no agents-per-metric.

Learn more

Docker & Compose orchestration

Start, stop, restart and remove containers, read logs, check image updates and drive Compose stacks. Per host, from one screen, without SSH.

Learn more

Outbound PTY web terminal

A real shell in the browser over the same outbound channel. The agent runs as an unprivileged user; the PTY drops to a configurable login user. Port 22 stays closed.

Learn more

Omynix Shield & host security

Auth-log parsing per service, scenario thresholds, subnet aggregation and consensus across every protected Omynix node. Offenders are dropped in the kernel with nftables, not just logged.

Learn more

Outbound only.
Inbound nothing.

The agent dials out to your hub over a persistent WebSocket and proves itself with an Ed25519 challenge. No listening ports, no port forwards, no VPN. A server behind NAT, a Pi on 4G and a VM in a locked-down VLAN all enroll the same way.

agent → wss://hub:443 · Ed25519 · 12 MB binary · <15 MB RAM

Host hygiene, built in

Not metrics-only. The agent watches and reports the boring things that get boxes owned.

Every Omynix server compares notes

One failed login is noise. The same address knocking on servers owned by three different customers in under a minute is a campaign. Shield agents report attempts to the hub; when enough independent fleets agree, the offender is dropped in the kernel on every protected host. An attack on someone else's servers protects yours before it reaches you.

acme · web-01
sshd: 41 failures
from 203.0.113.44
globex · db-03
sshd: 37 failures
from 203.0.113.44
initech · edge-pi
sshd: 29 failures
from 203.0.113.44
hub
reporters: 9 fleets
vector: ssh_bruteforce
decision: network-wide ban
nft set add omynix-bans { 203.0.113.44 } · applied on every enforcing node, in every fleet

Per-server toggles decide what each box runs: full enforcing, observation-only, or delegate to an upstream proxy that already filters. Detection stays honest: if the kernel path is unavailable, Shield says so instead of pretending to protect.

Why Omynix

The honest comparison. If you only need Docker management, Portainer is fine. If you only want graphs, Beszel is lighter. Omynix is for when you want the whole host.

Omynix Portainer Beszel Cockpit Datadog Netdata
Live fleet telemetry yesbasicyesper-hostyesyes
Docker & Compose control yesyesread-onlypartialnoread-only
Web terminal (PTY) yes, outboundcontainer onlynoyesnono
Intrusion detection + kernel bans Shield + nftablesnononopaid add-onno
Cross-customer consensus bans yesnonononono
File integrity monitoring yesnononopaid add-onno
Backups (local / SFTP / S3) yesnonononono
Zero inbound ports on agents yesyesyesinbound :9090yesinbound :19999
Self-hosted, open source yesyesyesyesSaaScore only
Agent footprint 12 MB · <15 MB RAM~90 MB~20 MBper-host service~150 MB~100 MB

Feature sets as documented by each project, September 2026.

Editions

Community is the real product, not a crippled trial. Cloud is for people who do not want to run the hub.

Community

Free & open source

Self-hosted hub and agents. Every feature, no limits.


  • Unlimited servers
  • Shield, FIM, backups, domains
  • RBAC, OIDC, 2FA
  • Your hub, your data
Get the source

Cloud

Hosted hub, per-tenant

We run your hub on an isolated micro-instance. You just install agents.


  • Free tier: 3 servers
  • Pro: per-server pricing
  • Same agent, same features
  • Hub runs isolated per tenant
Create your account

Enterprise

On-premise & support

For fleets with compliance, air-gap or support requirements.


  • Air-gapped install supported
  • SSO / OIDC integration help
  • Support contract & SLA
  • Priority security contact
Talk to us

FAQ

What does the agent actually open on my server?

Nothing inbound. The agent is a 12 MB Go binary that dials out to your hub over a persistent WebSocket and authenticates with an Ed25519 challenge. It runs as an unprivileged system user; Shield needs CAP_NET_ADMIN for nftables and nothing else gets extra capabilities unless you opt in (for example the PTY login user).

How much does it cost my servers to run?

Under 15 MB of RAM and a few millicores on average. Telemetry pushes on change, not on a poll interval, so an idle node is nearly silent. The hub is a single Go binary with an embedded SQLite database; a small VPS runs a whole fleet.

Is the web terminal safe? It sounds like an open shell.

The PTY is off unless you configure a login user at install time. When on, the agent spawns the shell as that user (not root), behind the same role-checked API as everything else: admin role plus per-server scope, session cookies, audit log of every session. No SSH port is involved at any point.

What happens when my hub is unreachable?

Agents keep running and keep enforcing: Shield state, bans and configuration persist on disk. On reconnect the hub replays your saved Shield config, feeds and fleet bans, and agents report what they saw while offline.

Can I roll out Shield gradually?

Yes. Every server has per-module toggles and three modes: enforcing, observation-only and disabled. You can also delegate protection: a node behind a filtering proxy does not need the full engine, it just reports. Observation mode detects and reports honestly instead of writing firewall rules.

How do agent updates work?

The hub holds signed builds per OS/architecture. It compares the agent hash, pushes an update to a canary first, waits for it to come back healthy, then rolls the rest of the matching fleet. A bad build never leaves the canary.

Community vs Cloud: what is actually different?

Only who runs the hub. Community is the complete product on your own hardware. Cloud hosts a dedicated micro-hub per tenant on our infrastructure; agents and features are identical, and you can export and leave whenever you want.

Enroll your first server

Install the hub, mint an enroll token in the UI, run the one-liner on a node. About two minutes.

$ curl -fsSL "https://omynix.com/install.sh?token=sd_enroll_YOUR_TOKEN" | sudo bash