Linux servers
Inventory, patching, remote access, backup and estate topology.
Linux server managementInfrastructure control
kFleet — Linux server, virtual machine and container management
One console to run servers, containers and networking: fewer tools to maintain, and every change recorded. kFleet is Koraisoft's self-hosted software for managing Linux servers, virtual machines, containers and Kubernetes clusters from one console. Firewalls, DNS, certificates and remote access share the same permissions, versioned configuration and audit trail.
Self-hostableOne console, one audit trailVersioned configuration
Which infrastructure do you need to manage?
The word “machines” can mean very different things. kFleet manages IT machines and infrastructure; it is neither industrial maintenance software nor vehicle fleet software.
KVM virtual machines
libvirt lifecycle, cloud-init, snapshots, console and live migration.
KVM VM managementContainers
Docker, Podman, LXC, LXD, Incus and machinectl in one view.
Container managementMulti-cluster Kubernetes
Resources, catalogue, Velero backup, scanning, permissions and audit.
Kubernetes managementTransition from VMware
Assess a path to KVM/libvirt without promising automatic conversion.
Prepare the transitionMulti-customer managed services
Separated organisations, scopes and permissions in one console.
kFleet for MSPsThe problem
Nobody chose to run eight consoles. They were added one at a time, each for a good reason, and the cost only shows up once the whole thing is in place.
- A hypervisor on one side, a container orchestrator on the other, a third tool for Kubernetes: three permission models, three directories, three logs.
- The firewall, DNS and certificates live in yet other tools — often in scripts, sometimes in one person's head.
- The scripts connecting these tools have to be maintained: they serve no business purpose, and they fail at the worst possible moment.
- The day an auditor asks who changed what, the trail is reconstructed by hand, tool by tool — when it still exists at all.
What kFleet replaces
The clearest way to describe kFleet is to start from the tools a team already maintains. The third column matters most: it separates what is useful from day one from what first requires your infrastructure to be described.
| Maintained today | What kFleet brings | On install |
|---|---|---|
| Command-line tooling around KVM | libvirt (KVM/QEMU), Lima and VirtualBox virtualisation: machine lifecycle, browser console, snapshots, cloud-init, live migration between hypervisors. kFleet takes over the management layer when your hosts run KVM/libvirt. | Usable as is |
| A container UI, and the Kubernetes command line | Docker, Podman, LXC, LXD, Incus and machinectl containers, and multi-cluster Kubernetes across twelve resource types — one console for all three families. | Usable as is |
| A firewall appliance, or nftables scripts | A managed nftables firewall: profiles, zones, ordered rules, a diff before applying and lock-out protection. | Foundation to describe |
| DNS and DHCP servers configured by hand | DNS across six supported engines and DHCP across three: zones, records, scopes, reservations, all versioned. | Foundation to describe |
| ACME scripts | Authorities, certificates and distribution: ACME with nine challenge types, renewal and installation on targets. | Foundation to describe |
| A remote-console gateway, or a home-grown bastion | RDP, VNC and SSH consoles in the browser, through a jump host, with encrypted credentials and a traced session. | Usable as is |
| Ad hoc deployment, or an estate manager | Software estate: aggregated inventory, per-machine version gap, a security-only filter, bulk apply and follow-up. | Usable as is |
| An infrastructure-as-code tool, or the cloud consoles | AWS and Cloudflare: templates, planning, apply and continuous drift detection, from the same console. | Foundation to describe |
| Diagrams drawn by hand | A map built from the real inventory — machines, containers, pods, rules, tunnels — rather than redrawn by hand. | Usable as is |
“Foundation to describe” means the engine, the model and the screens are there, and your estate still has to be entered or imported: a managed firewall without your zones, a DNS without your domains replace nothing until they are configured. Setup is fast because the foundation exists, but it is not instant.
What kFleet does
Breadth is not the point. The point is that a certificate, the firewall rule protecting the service, the machine hosting it and the risk documenting its flaw are all managed from the same place, with the same permissions and the same log. No gateway, no cross-export, no extra console.
Virtual machines
libvirt (KVM/QEMU), Lima and VirtualBox behind one interface. Creation from an image, start and stop, snapshots, cloud-init, a console in the browser, live migration from one hypervisor to another. A machine's configuration is versioned like everything else: compare two states, roll one back.
Containers, six engines
Docker, Podman, LXC, LXD, Incus and machinectl (systemd-nspawn). Engines are connected, containers are listed, started, read — logs included — and their configuration is versioned. kFleet can install Docker, Podman, LXC and Incus; LXD and machinectl are connected once already installed. A mixed estate does not require two tools.
Multi-cluster Kubernetes
Twelve resource types — namespaces, deployments, pods, services, ingresses, volumes, jobs, cron jobs, secrets, config maps, storage classes, nodes — plus port forwarding, across as many clusters as you run. Logs and exec into a pod: from the browser.
nftables firewall
The firewall is described as profiles: zones, ordered rules, a policy per chain. kFleet computes the diff before applying, refuses a rule that would cut off your own access, snapshots the rules in place and can roll back in one click.
- The diff is read before the apply, not after.
- A rule that would close your own access is refused before it is installed.
- A snapshot of the rules before every apply, and a one-click rollback.
DNS and DHCP
Six supported DNS engines (BIND, dnsmasq, CoreDNS, PowerDNS, Route 53, Cloudflare) and three DHCP engines (Kea, ISC DHCP, dnsmasq). Zones, records, scopes, subnets and reservations are entered once and deployed to whichever engine serves you — the model does not change when the engine does.
VPN and remote access
Eight VPN adapters — WireGuard, OpenVPN, IPsec, cloudflared, NordVPN, AWS, GCP and Azure — with their peers. And to work on a machine, an RDP, VNC or SSH console in the browser, through a jump host, with encrypted credentials and a traced session: no fat client, no bastion to maintain.
Certificates and PKI
Authorities, challenge providers and distribution targets. ACME issuance with six DNS-01 and three HTTP-01 challenges, then installation on the declared targets. The most direct consumer of that chain is the same product's Zero Trust edge — which is what guarantees it is exercised.
Application catalogue
Ninety-four ready-to-deploy applications, sorted by category, with variable substitution and a post-install phase. For a Helm repository, deployment is guided the same way.
Backup and restore
Backup plans that state what, where and when: directories, container volumes, libvirt virtual machines backed up live, Kubernetes namespaces through Velero, etcd, PostgreSQL and MySQL databases, with point-in-time recovery for PostgreSQL through pgBackRest. Data goes from the node straight to your repositories (S3, local disk, NFS, SFTP, REST), with retention per destination; restic, the reference engine, encrypts client-side. A restore can be dry-run before overwriting, sent to another path or another host, and a backup is verified by restoring a sample.
Software estate and patching
Software inventory aggregated across the fleet, a per-machine version gap, a security-only filter, bulk apply and real-time follow-up. A patching campaign becomes one operation instead of N scripts.
Security scanning and DAST
Twenty-three integrated tools — dependency analysis, container images, system hardening, CIS baselines — and an authenticated application scan with replay. A scan result becomes an assessed risk, then a traced incident, then a report: with no re-export and no second tool.
Serverless and jobs
Knative jobs, their sources, revisions and triggers, with the runtime images shipped out of the box. An invocation is triggered and followed from the same console.
Estate map
A graph built from the real inventory — machines, containers, pods, firewall rules, tunnels, certificates, cloud resources — rather than redrawn by hand. It stays current because the product's own events feed it, not because someone remembered to update it.
Nodes and collectors
Every managed machine carries an agent reporting its state: hardware, storage, network, installed software. That collected state feeds the inventory, the map and the software estate — one report, several screens.
Zero Trust edge
A self-hosted access gateway whose configuration is compiled, signed and verified before being applied, keeping the last known-good version. It complements infrastructure management rather than being a standalone access product — but the chain of trust extends to the data plane.
On the Kore platform
Users, roles and fine-grained permissions, organisations, a sealed audit trail, a single GraphQL API, workflows, documents: kFleet rewrote none of these, it inherits them from the platform. That is why an infrastructure management tool arrives with permission management and an audit trail worth the name.
What kFleet changes
In this order: consolidate first, operate next, prove last — and none of it started from scratch.
You consolidate
One tool instead of eight: fewer licences, fewer accounts to manage, less training, one place to look. Machines, containers, Kubernetes, network, certificates and backup under one console and one permission model.
You operate, not just deploy
Every configuration is versioned, comparable and revertible in one click — machines, containers, firewall, DNS, DHCP, VPN, cloud templates. Drift is detected continuously, not at the next deployment.
You prove
A scan result becomes an assessed risk, then a traced incident, then a report. No re-export, no second tool, and the platform's audit trail underneath every step.
The Kore platform
Identity and access, nested organisations, fine-grained permissions, a sealed audit trail, a single GraphQL API, workflows, documents and artefacts. kFleet inherits them rather than rebuilding them.
See the Kore platformSovereign, without reservation
Deployed on your own servers, including off-network. Go and PostgreSQL, no proprietary format, and no third-party UI components left.
What you do not see
Five properties that are invisible in a demo, but decisive over time.
- Configuration is versioned across every domain — machines, containers, firewall, DNS, DHCP, VPN, cloud templates. Comparison and rollback everywhere.
- A long-running operation survives a service restart: scans, patches and deployments resume where they left off.
- A firewall rule that would cut off your access is refused before it is installed.
- The audit trail is off-box: it does not depend on the machine being audited.
- No third-party UI components: the entire software is owned and self-hostable, with no external component dependency.
Three editions
Community
Machines, containers and Kubernetes. Firewall, DNS, DHCP and VPN. Application catalogue and remote console.
Pro
Everything in Community, plus cross-domain versioning and rollback, AWS and Cloudflare with drift detection, software estate and fleet patching, cross-technology mapping, fine-grained permissions and audit, multi-tenancy for managed service providers.
Enterprise
Everything in Pro, plus authenticated application scanning and posture reporting, a risk register with timed incidents, a self-hosted Zero Trust edge with signed configuration.
Pricing under review — please contact us.
Frequently asked questions
What is kFleet and who is it for?
kFleet is self-hostable software from Koraisoft that manages virtual machines, containers, Kubernetes, the nftables firewall, DNS, DHCP, VPN, certificates, remote access and backup from a single console, with the same permissions and the same audit trail. It is aimed at teams that run their own Linux servers — KVM/libvirt hypervisors, container hosts, Kubernetes clusters, network — and want to consolidate the tools they maintain today. It installs on your servers, including off-network.
I want to deploy my software on an independent platform: is kFleet the right tool to manage my server resources easily?
Yes if you operate several Linux servers yourself — KVM/libvirt, Docker, Podman, LXC, Incus, Kubernetes — and want a single console, with fine-grained permissions, an audit trail, versioned configuration and sovereign hosting on your own machines. kFleet is for a team that administers its own infrastructure.
Where does kFleet run and what are its prerequisites?
kFleet installs on your own servers; your data stays with you. It is an application built on Koraisoft's Kore platform, written in Go with PostgreSQL: the Kore platform provides users, roles, organisations and the audit trail.
How much does kFleet cost?
kFleet pricing is under review: contact Koraisoft to discuss it. kFleet comes in three editions, Community, Pro and Enterprise, which differ in functional scope.
Which virtualisation and which containers does kFleet manage?
On virtualisation, kFleet manages libvirt (KVM/QEMU), Lima and VirtualBox; on containers, Docker, Podman, LXC and Incus, plus multi-cluster Kubernetes. The rest sits in the same console: nftables firewall, DNS and DHCP, ACME certificates, VPN, RDP/VNC/SSH remote console, software estate, security scanning and backup — with versioned configuration, and the Kore platform permissions and audit beneath each of those domains.
Does kFleet back up virtual machines and Kubernetes?
Yes, since September 2026. kFleet backs up directories, container volumes, libvirt virtual machines live, Kubernetes namespaces through Velero, etcd and PostgreSQL and MySQL databases, to S3, local disk, NFS, SFTP or REST repositories. A restore can be dry-run, sent elsewhere or to another host, and a backup is verified by restoring a sample. The module is recent: evidence links to a controls catalogue are not connected yet.
How do I get started with kFleet?
The simplest way is to write to Koraisoft through the Contact page, describing your infrastructure: we will look together at whether kFleet can fit.
Talk about your infrastructure
Looking to simplify how you run your servers, containers and network? Write to us and we will look together at whether kFleet can fit.
Contact usOur products evolve continuously. The features, screens and characteristics shown on this page describe their state at the time of publication: they may change, be modified or be withdrawn without notice, and do not constitute a contractual commitment.
The screenshots on this page and the online demo run on fictional, deliberately small datasets: they illustrate only part of what the product does, and some features are limited or switched off in the demo environment.