A view across your hosts.
Collect telemetry, inspect running systems, and investigate fleet alerts from the control plane.
Read the fleet API ↗SystemAPI / The execution control plane
Operate the fleet.
Program the work.
Manage Linux systems, Docker workloads, and Kubernetes resources through one control plane. Outbound agents carry your intent. Entitlements bound what runs.
Linux fleet management · Outbound connections · Starlark automation
# Entitled Sysscript / example
containers = sys.containers.list()
for container in containers:
print(container)
# Inspect before changing a workload
print(sys.containers.inspect("web"))
print(sys.containers.logs("web"))The operating layer of SAHLinux hostsDocker workloadsk3s / KubernetesPolicy & evidence
01 / Fleet operations
Know the state. Control the change.
Workloads, with boundaries.
Inspect, start, stop, and restart Docker containers. Work with Kubernetes resources using explicitly entitled operations.
See script examples ↗Scripts with scoped authority.
Run Starlark Sysscripts through the agent. Host, filesystem, container, and Kubernetes capabilities depend on the granted entitlements.
Understand execution ↗02 / Programmable operations
A small script.
A specific capability.
Write the operation you mean. The agent exposes capabilities according to the script’s entitlements, with separate controls for containers and Kubernetes.
Read the scripting notes ↗print(sys.containers.list())
print(sys.containers.inspect("web"))
print(sys.containers.logs("web"))Requires container access and any operation-specific limits. Use an existing container ID or name.
print(sys.k3s.nodes())
print(sys.k3s.pods("default"))Requires k3s access and an allowed namespace. The agent reads its local k3s configuration.
print(sys.services.status("nginx"))Service access is bounded by the script’s entitlements. Linux service management uses the host’s service manager.
03 / How it works
Your host connects out.
Your control stays central.
The Go agent opens an outbound WebSocket connection. The control plane routes approved work and receives execution results and telemetry.
Enroll a Linux host.
Configure the control-plane address, tenant identity, and agent credential.
Declare the work and its scope.
Submit a Sysscript with the entitlements required for the operation.
Inspect the outcome.
Use the returned result, telemetry, alerts, and audit verification to understand the change.
04 / The larger system
The control plane in a bigger picture.
ComputeAPI supplies capacity.
SystemAPI operates it.
The SAH tools make the work deliberate.
Automatic ComputeAPI enrollment and the adssh lease handoff are planned. Managed platform scope is Linux; macOS and Windows fleet support are not claimed. Check availability →
Make the next operation repeatable.
Build the agent, connect your control plane, and start with a bounded read-only script.