Gritiva — one control plane for every server, anywhere
Gritiva turns any machine into part of your own cloud — including machines behind NAT, CGNAT, corporate firewalls, or mobile networks. The agent makes an outbound connection to the control plane, so there is nothing to forward, no static IP to buy, and no router configuration to change.
What does Gritiva do?
Three primitives and one control plane. Each solves a problem that usually needs a separate tool.
- Encrypted mesh networking. Machines connect to each other over WireGuard across clouds and networks. NAT and CGNAT are never in the way, because every connection is initiated from inside the network — the same reason a browser tab works from behind a home router.
- Scopes — isolation without a container runtime. Each workload runs in its own Linux network namespace with cgroup v2 limits: process, network, filesystem, user and IPC isolation. No daemon, no image to build, sub-second startup, and memory overhead close to zero.
- Browser terminal. A full PTY session to any connected machine, with resize, scrollback, session recording and an audit trail. No SSH key distribution and no exposed inbound port.
- One dashboard. Servers, VMs, services, domains, virtual networking and live metrics for the whole fleet in a single view, with role-based access control and an audit log.
Who is Gritiva for?
Teams running roughly 2 to 50 machines who have outgrown ad-hoc SSH but do not want to adopt Kubernetes — home labs, agencies, small product teams, and anyone maintaining infrastructure across more than one provider or network. Above about fifty machines, where automatic rescheduling and metric-driven autoscaling start paying for the cluster you have to operate, Kubernetes is the better answer and we say so.
How do I get started?
One command on any Linux machine. The agent installs, registers with the control plane, and the machine appears in the panel — typically inside a minute. Nothing changes on your router or firewall.
curl -fsSL https://gritiva.com/install-gritiva.sh | sudo bash
What does it cost?
Free for up to 3 machines, with no time limit. Pro is $49 per machine per month with unlimited machines, email support, a 99.9% panel uptime SLA, 90-day audit log retention and API access. Enterprise is quoted individually. Scopes, mesh peers and domains are never metered — you pay for machines running the agent, and nothing else.
How is a Scope different from a Docker container?
A Scope is built directly from the Linux kernel primitives that containers are built on — namespaces and cgroup v2 — rather than from a container runtime. There is no daemon holding root, no image registry and no layered filesystem. The trade-off is real: Scopes are Linux-only and give you no portable image artifact, so if you need to hand the same image to infrastructure you do not control, a container is still the right tool.
- Process isolation. PID namespace — a scope cannot see or signal host processes.
- Network isolation. Network namespace with its own veth pair, IP, gateway and routing table.
- Filesystem isolation. Mount namespace and chroot — an isolated root with no access to host files.
- User isolation. User namespace giving scope-local root with no privilege on the host.
- Resource limits. cgroup v2 caps on CPU, memory, disk I/O and process count.
How does Gritiva compare to the alternatives?
It sits between two categories that normally stay separate. Self-hosted platform-as-a-service tools deploy applications but assume the network already works. Mesh VPNs connect machines but do not run or isolate anything on them. Orchestrators do both, and charge for it with a cluster you have to operate.
- Versus Coolify, Dokploy and CapRover. They are built around deploying applications from Git, with preview environments and managed databases. Gritiva operates a layer below: the machines, their isolation, and the network between them. If deployment ergonomics are what you are shopping for, those tools are more mature at exactly that.
- Versus Tailscale, ZeroTier and Netbird. They build the same kind of WireGuard mesh and are excellent at it, with broader platform coverage including mobile. They deliberately stop at the network. Gritiva treats the network as one layer of a control plane that also runs, isolates and monitors workloads.
- Versus Kubernetes. Kubernetes gives you automatic rescheduling when a node dies, metric-driven autoscaling and a large operator ecosystem. Gritiva gives you none of those. Above roughly fifty machines that trade becomes worth making, and Kubernetes is the correct choice.
- Versus Portainer. Portainer is an interface onto a container runtime you already operate. Gritiva does not require one, and manages the machines rather than the containers on them.
What does Gritiva not do?
Stating the limits plainly is more useful than a feature list. Gritiva does not reschedule workloads automatically when a machine dies. It does not autoscale from live metrics. It has no operator or chart ecosystem. It does not build applications from a Git repository, and it has no per-pull-request preview environments. It has no mobile client. Scopes require Linux, and produce no portable image you can hand to infrastructure you do not control. If any of those are load-bearing for you, a different tool is the right answer.
Frequently asked questions
- Does Gritiva work behind CGNAT?
- Yes. The agent makes an outbound WireGuard connection to the control plane, so no inbound port needs to be reachable. This works behind CGNAT, corporate firewalls and mobile networks without port forwarding or a static IP.
- Do I need Docker installed?
- No. Scopes are built from Linux namespaces and cgroup v2 directly, with no container runtime or daemon involved. You can still run Docker alongside Gritiva if you want to — the two do not conflict.
- Which operating systems does the agent run on?
- The full feature set, including Scopes, requires Linux, because Scopes are built from Linux kernel primitives. Agents also run on macOS and Windows for monitoring and remote command execution.
- Is there a limit on how many scopes or mesh peers I can run?
- No. Billing counts machines running the agent, not scopes, mesh peers or domains. Those are unlimited on every plan.
- What happens to my workloads if the control plane goes offline?
- Running scopes keep running — the data plane does not depend on the control plane being reachable. Lifecycle operations queue until the panel is available again.
Where can I read more?
The interactive dashboard needs JavaScript. Everything above is the full summary of what Gritiva is and does.