curl -fsSL "https://omynix.com/install.sh?token=sd_enroll_YOUR_TOKEN" | sudo bash
Everything runs through one agent, one outbound connection, one dashboard.
CPU, memory, disk, network, temperature and per-mount usage from every node, pushed sub-second over a single WebSocket. No polling, no agents-per-metric.
Learn moreStart, stop, restart and remove containers, read logs, check image updates and drive Compose stacks. Per host, from one screen, without SSH.
Learn moreA real shell in the browser over the same outbound channel. The agent runs as an unprivileged user; the PTY drops to a configurable login user. Port 22 stays closed.
Learn moreAuth-log parsing per service, scenario thresholds, subnet aggregation and consensus across every protected Omynix node. Offenders are dropped in the kernel with nftables, not just logged.
Learn moreThe agent dials out to your hub over a persistent WebSocket and proves itself with an Ed25519 challenge. No listening ports, no port forwards, no VPN. A server behind NAT, a Pi on 4G and a VM in a locked-down VLAN all enroll the same way.
agent → wss://hub:443 · Ed25519 · 12 MB binary · <15 MB RAM
Not metrics-only. The agent watches and reports the boring things that get boxes owned.
One failed login is noise. The same address knocking on servers owned by three different customers in under a minute is a campaign. Shield agents report attempts to the hub; when enough independent fleets agree, the offender is dropped in the kernel on every protected host. An attack on someone else's servers protects yours before it reaches you.
Per-server toggles decide what each box runs: full enforcing, observation-only, or delegate to an upstream proxy that already filters. Detection stays honest: if the kernel path is unavailable, Shield says so instead of pretending to protect.
The honest comparison. If you only need Docker management, Portainer is fine. If you only want graphs, Beszel is lighter. Omynix is for when you want the whole host.
| Omynix | Portainer | Beszel | Cockpit | Datadog | Netdata | |
|---|---|---|---|---|---|---|
| Live fleet telemetry | yes | basic | yes | per-host | yes | yes |
| Docker & Compose control | yes | yes | read-only | partial | no | read-only |
| Web terminal (PTY) | yes, outbound | container only | no | yes | no | no |
| Intrusion detection + kernel bans | Shield + nftables | no | no | no | paid add-on | no |
| Cross-customer consensus bans | yes | no | no | no | no | no |
| File integrity monitoring | yes | no | no | no | paid add-on | no |
| Backups (local / SFTP / S3) | yes | no | no | no | no | no |
| Zero inbound ports on agents | yes | yes | yes | inbound :9090 | yes | inbound :19999 |
| Self-hosted, open source | yes | yes | yes | yes | SaaS | core only |
| Agent footprint | 12 MB · <15 MB RAM | ~90 MB | ~20 MB | per-host service | ~150 MB | ~100 MB |
Feature sets as documented by each project, September 2026.
Community is the real product, not a crippled trial. Cloud is for people who do not want to run the hub.
Free & open source
Self-hosted hub and agents. Every feature, no limits.
Hosted hub, per-tenant
We run your hub on an isolated micro-instance. You just install agents.
On-premise & support
For fleets with compliance, air-gap or support requirements.
Install the hub, mint an enroll token in the UI, run the one-liner on a node. About two minutes.
curl -fsSL "https://omynix.com/install.sh?token=sd_enroll_YOUR_TOKEN" | sudo bash