Simplicity at the Edge of Execution
Modern software deployment has become excessively fragmented. Engineering teams deploying applications directly to Virtual Private Servers (VPS) and self-managed Linux virtual machines frequently rely on a fragile patchwork of manual SSH commands, custom shell scripts, GitHub Actions runners, Ansible playbooks, or heavyweight container orchestrators.
“Reliable, repeatable, secure, and observable application deployments to self-managed Linux servers without infrastructure bloat.”
Fleet decouples orchestration from execution: a centralized Control Plane coordinates deployments, versioning, environment variables, and telemetry, while a native, statically compiled Go Agent running on each host autonomously executes Git checkouts, process lifecycles, and auto-healing.
Why I Built Fleet
Fleet was born out of real-world operational challenges across personal projects and team engineering.
Case 1: Solo Projects & Multi-Service Fatigue
As a developer running multiple personal projects and independent backend micro-services on a single VPS, deployment quickly degenerated into a maintenance headache:
- Script Sprawl: Every repository required its own custom
sync.shscript, SSH passwords, and IP setups. - Context Fragmentation: Running multiple backends concurrently made it easy to forget where specific build scripts lived, which ports were bound, or what
.envconfigurations were loaded. - Cognitive Load: Hours were lost troubleshooting broken SSH sessions, failed remote merge conflicts, and manual process restarts instead of writing code.
Case 2: Team Collaboration & Infrastructure Outages in Startup Teams
From my past experience managing staging and dev servers across startup teams, running shared VPS infrastructure was always a headache:
- The SSH Access Trap: Sharing raw root/sudo SSH credentials with multiple engineers created an uncontrolled security perimeter with zero access control or auditability.
- Invisible Memory Spikes: The staging VPS crashed twice in production/staging due to untracked memory leaks. Because there was no live telemetry, the server crashed silently without alerts or diagnosis.
- Deployment Blindness: Zero record of which Git commit or branch was actively deployed. Team members constantly had to ask: “Who deployed last?” and “Is my branch on staging?”.
- Sync Overhead: Every developer had their own mental model of how to deploy and restart services, leading to conflicting configurations and accidental overrides.
The Realization
When deploying applications to virtual machines, teams shouldn't have to choose between fragile manual SSH workflows and massive infrastructure overhead. Developers simply need a single command center that connects directly to their servers, provides live memory and CPU visibility, tracks every deployed commit, supervises processes with automated crash recovery, and enables 1-click deployments—all without ever opening inbound SSH ports to the public internet.
Bidirectional Outbound-Only Design
Unlike traditional tools that require opening inbound SSH ports on firewalls, Fleet operates on a zero-inbound-port trust model. The Fleet Agent initiates and maintains a long-lived, encrypted WebSocket channel over TLS to the Control Plane.
┌────────────────────────────────────────────────────────┐
│ Fleet Control Plane │
│ (Web Dashboard, REST API, Dispatcher Hub) │
└───────────▲────────────────────────────────▲───────────┘
│ │
WSS / TLS (Outbound) WSS / TLS (Outbound)
│ │
┌───────────▼───────────┐ ┌───────────▼───────────┐
│ Fleet Agent A │ │ Fleet Agent B │
│ (Ubuntu VPS - 1GB) │ │ (Debian VPS - 2GB) │
│ ┌───────────────────┐ │ │ ┌───────────────────┐ │
│ │ Process Watcher │ │ │ │ Process Watcher │ │
│ ├───────────────────┤ │ │ ├───────────────────┤ │
│ │ Automated GC Prune│ │ │ │ Automated GC Prune│ │
│ ├───────────────────┤ │ │ ├───────────────────┤ │
│ │ App: API (:3000) │ │ │ │ App: Web (:8080) │ │
│ └───────────────────┘ │ │ └───────────────────┘ │
└───────────────────────┘ └───────────────────────┘Engineering Modules
Zero-Disk Git Authentication
Authentication tokens are passed in memory during the build pipeline and consumed via ephemeral HTTP Basic Auth. Output logs are scrubbed via real-time regex filters before streaming.
Process Watcher & Supervision
Polls child PID health continuously (10s – 600s). Detects crashes and signals (SIGTERM / SIGKILL) and triggers automated self-healing with backoff.
Automated Disk GC Engine
Periodically prunes obsolete release checkouts and abandoned build caches beyond the retention window, maintaining disk cleanliness and preventing storage exhaustion.
Live Host Telemetry
Live CPU core utilization, RAM breakdown (active/available/buffers), disk partition usage, and server uptime tracked continuously to preempt memory spikes.
Ed25519 Cryptographic Trust
Security is built into Fleet's foundational design, eliminating the vulnerabilities inherent to shared credentials and SSH access.
- Ed25519 Asymmetric Signatures: Private keys never leave the VPS filesystem (
0600permissions). Mutual signatures authenticate all control-plane commands. - Replay Attack Protection: Every signed payload includes an epoch timestamp and a single-use random nonce with a strict 10-second skew tolerance.
- AES-256-GCM Secret Encryption: All environment variables and application secrets are encrypted at rest with authenticated AES-256-GCM in the control plane database.
- 1-Query Triple Assertion: Single database query validates
DeploymentID → AgentID → ServiceIDto eliminate cross-agent and cross-tenant command injection.
Resource Consumption Benchmark
Fleet was engineered in Go to run with negligible overhead on any VPS from 512MB RAM nano instances to dedicated bare-metal servers:
| Metric | Fleet Agent | Typical Container Orchestrator |
|---|---|---|
| Memory Usage | < 10 MB RAM | 800 MB – 2 GB RAM |
| Idle CPU | < 0.1% CPU | 2% – 8% CPU |
| Binary Footprint | ~10 MB Single Binary | Multi-package suite |
| Open Inbound Ports | 0 Ports (Outbound WSS) | Multiple inbound ports |
| Runtime Dependencies | Zero Dependencies | Docker, containerd, iptables |
Deploy with confidence, not complexity.
Connect your first virtual machine in under 60 seconds.