Manage every host from one place. Offline.
KyriosForge is the self-hosted control plane for your containers — across Docker, Podman, Swarm, Kubernetes, and Nomad. A single native binary, no agent reporting back, and pricing that treats you like a partner instead of a lock-in.
The console
What it actually looks like.
A real hub managing a real fleet — not mockups.
Fleet overview: every host, its runtime, and what’s running on it.
Built-in MCP server
A Model Context Protocol server ships inside the hub, with nothing extra to install. Point Claude Desktop, Claude Code or any MCP client at it and manage your fleet in plain language: “which containers are unhealthy?”, “restart plex on the media host”. Every call runs on an API token you scope, so a read-only token makes the assistant a pure observer.
Every runtime, one console
Docker, Podman, Docker Swarm, Kubernetes, and Nomad — managed side by side from a single pane, with a unified agent per host.
GitOps & automation
Track a repo and keep stacks in sync; drive lifecycle from event triggers. Poll or instant webhook — your call. Alert rules route events to ntfy or a webhook.
RBAC, teams & SSO
Granular capability flags, scoped teams and multi-tenancy, and OIDC/OAuth2 SSO — included, not paywalled behind an “enterprise” wall.
API-first
A full REST API with generated clients for Python, C#, Rust, and C/C++, plus a gRPC control surface — automate everything.
Image CVE scanning
Scan running images for vulnerabilities and wire findings straight into automations — including auto-patch loops.
One native binary
The hub — console SPA and all — ships as a single self-contained Rust binary. Distroless-ready. Nothing loose to tamper with.
Auto-update that checks its own work
Update containers or whole stacks on a schedule. After each update KyriosForge waits, health-checks the result, and reverts to the prior image automatically if anything fails. Only code is reverted, so your volumes are untouched, and a stack rolls back all-or-nothing.
Backup and migrate
Package a stack, with its compose file, build context and named volumes, into one portable archive. Keep encrypted copies in the hub with retention, then migrate to another host in one click.
How it runs
A control plane you can actually hold
One binary you run, one agent per host it manages, and nothing reporting back. Here’s the shape of it.
Hub + one agent per host
The hub — console and API in a single binary — talks to a lightweight agent on each host over mutually-authenticated TLS. The container socket is never exposed to the network.
Self-contained
The console SPA is embedded in the binary. Distroless-ready, nothing loose on disk to tamper with, and no runtime dependencies to chase.
Stays inside your network
No telemetry, no external calls, no account to register. The whole control plane runs within your own perimeter.
Runtime support
Manage what you have — provision what you don’t
Most tools stop at connecting to a runtime that already exists. On Kubernetes, KyriosForge also stands new ones up — installing prerequisites on bare nodes and building the cluster for you.
| Runtime | Connect & manage | Provision | Notes |
|---|---|---|---|
| Docker | ✓ | — | Full lifecycle + cross-host stack and container migration. |
| Podman | ✓ | — | Same unified agent — daemonless, rootless-friendly. |
| Docker Swarm | ✓ | — | Orchestrate services, stacks, and nodes. |
| Kubernetes | ✓ | ✓ build & node setup | Manage existing clusters — or build one: install prerequisites on bare nodes and stand the cluster up. |
| Nomad | ✓ | — | Hub-direct to the cluster API — jobs, allocations, deploys, scaling, and an exec shell. |
Pricing
You pay for scale, never for features.
A plan sets how big your fleet can get and how long the licence runs. It never decides which of the product you are allowed to use.
What a plan sets
Nodes per deployment, CPU sockets per node, and the length of the term. That is the whole list.
What is never locked
RBAC, teams, SSO, multi-tenancy, audit, Kubernetes, Swarm and Nomad, cross-host migration, GitOps, the registry, CVE scanning, backup and restore — every tier, including the free one.
Every plan starts with a real trial
The full product, every feature, for 60 days — no credit card, no phone-home, nothing crippled to push an upgrade. See exactly what you would run in production.
The price you pick is the price we protect
We only ever loosen our terms. No phone-home, and no card held over your head to keep the software running.
Purchasing opens when the beta closes. The prices on that page are final, not placeholders — evaluate against the real number.
See the full pricingHow “no phone-home” actually works
Enforcement without a leash
“Offline” isn’t a marketing word here — it’s how the licensing is built. There’s no server to reach, so there’s nothing to go down, throttle you, or watch what you run.
Signed, never phoned
Your license is an Ed25519-signed token. The control plane verifies the signature locally on every check — there is no license server to call, ever.
Bound, but forgiving
The license anchors to a hardware footprint that tolerates normal servicing — swap a DIMM, replace a disk — without breaking, yet can’t be silently cloned onto a second machine.
Rehost offline
Moving to new hardware issues a signed deactivation receipt that frees the activation. Air-gap friendly, no callback required.
Why it’s different
The parts a rented platform can’t match
Features get copied. These are the commitments a monetization-pressured incumbent can’t adopt without walking back what made it profitable.
No phone-home
Enforcement, activation, and every feature run entirely offline. Perfect for edge, air-gap, and sovereignty — and we can’t sell data we never received.
Price protection
The price you sign up at is the price you keep. We grandfather you against increases — in writing.
Continuity guarantee
A long-horizon promise that what you run keeps running. No rug-pulls, no forced migrations, no held-hostage workloads.
Minimal attack surface
A lean, auditable control plane hardened through an adversarial security review — not a sprawling platform you have to babysit.
ISO 27001-aligned design
Built around ISO/IEC 27001’s core security principles — an isolated signing authority, encrypted internal transport, and data minimization by default, not bolted on after the fact.
Limiting usage and exposure of unsafe code
Every hub and agent crate compiles with unsafe code forbidden by the compiler, not just discouraged by convention — with a single named exception (a PAM authentication FFI shim) instead of it being scattered through the codebase.
Run it on your own terms
60-day trial, no phone-home, no credit card held over your head. Your environment, your data, your deployment — all under your control.
See pricing & start