Enroll a box with a single command and one small, outbound-only agent takes it from there — reporting vitals, watching for trouble, and keeping itself up to date. Live today.
4
3
1
Enroll a server once and a single outbound-only agent takes it from there — reporting vitals, watching the host and the containers on it, and keeping itself up to date. Here is exactly what it does.
A single static binary enrolls your box with a one-time token and starts reporting. It opens no ports and speaks outbound HTTPS only, so there is nothing inbound to expose.
On every heartbeat the agent reports load, memory, and disk, plus a summary of the Docker containers it can see. Miss the heartbeat and SolidOps marks the box offline.
Offline, disk, and resource checks ride the same monitoring stack as your endpoint checks. They open incidents and fire alerts the same way, so a full disk reaches you like any outage.
Agent releases are signed, and the agent verifies the signature before it swaps itself. Roll a new version across the fleet in waves, and pause the rollout the moment a wave misbehaves.
Point a monitor at any Docker container on an enrolled server. SolidOps reads its state and health straight from the heartbeat — no extra probe, no sidecar — and opens an incident the moment it stops, disappears, or reports unhealthy.
Enrollment is a single command. The agent installs, registers with a one-time token, and starts reporting — all over outbound HTTPS, with nothing left listening.
One line on the box. The installer adds a service user, drops the static binary in place, and writes a systemd unit where systemd exists — or hands you the run command where it doesn't.
A one-time token registers the server and mints its agent key. From then on the agent heartbeats out over HTTPS. Nothing listens; nothing inbound is ever opened.
Vitals start streaming, and heartbeat, disk, resource, and container monitors begin watching the box. A missed beat, a filling disk, or a stopped container opens an incident and sends an alert on its own.
illustrative session · figures are demo data
Most agents ask for root and leave it at that. Ours runs unprivileged by default under a hardened unit — but we tell you exactly where that boundary is real and where it isn't.
The default install runs as a dedicated ops-agent service user under a hardened systemd unit — no new privileges, a strict read-only system, a private tmp, and its own owned state directory. The daemon needs no root: process stats are world-readable, its state dir is owned rather than root-owned, and it reaches Docker over the socket.
On a box in the docker group — any host running your databases or backups — Docker access is root-equivalent. There, an unprivileged agent is root by another name, and we will not pretend otherwise in the UI, the docs, or here.
We would rather tell you where the boundary stops than sell you a boundary that isn't there.
No surprises. These are the facts about the thing you install on your servers.
Outbound only
The agent dials home over HTTPS. There are no inbound ports to open and nothing to expose.
linux x64 & arm64
Runs under systemd, or under your own supervisor on hosts without it.
~18 MB static
A single self-contained binary. No runtime to install, no agent database to run.
Signed, self-applied
The agent verifies a signature before it swaps, and rollouts stage across the fleet in waves.
Outbound only · x64 and arm64 · one static binary · signed updates
The agent is live: enroll a server, watch its vitals, and let disk and offline checks open incidents on their own. Buy the core today, and the rest of the platform lands as it ships.