One command on a host, and HostAtlas has the services, the containers, the certs, the cron jobs, the listening ports and the package manifest — without an Ansible inventory, an asset CMDB, or a spreadsheet that two people pretend to maintain. The list stays right because nothing about it depends on a human remembering.
The reason every team eventually has a stale CMDB, a half-finished Ansible inventory, and a Notion page titled “servers (current)” is the same: keeping a list accurate is somebody's 9th-most-important task. Auto-discovery moves the list off the human entirely.
Somebody spins up a worker box for a one-off and never tells the doc. Three months later it's in production traffic and nobody knows what runs on it.
The CVE scanner ran clean — on the 18 hosts in the inventory. The 22 hosts that aren't in the inventory still have log4j.
You schedule it every quarter. It runs for two days. Half the team SSHs into a box, runs ps, copies a few lines, and goes back to real work.
At 03:42 you need to know everything that talks to the database that just crashed — not the version of it from last quarter's audit.
Everything below appears in the host detail page within seconds of the agent reporting in. Counts are typical for a 4-vCPU production box.
The agent is a single binary. It runs as its own user, reads what it's allowed to read, and pushes diffs to the platform over mTLS. No SSH back to the box. No inbound port.
One curl | bash on a fresh host. Detects the package manager, installs the agent, prompts for the enrolment token from the UI. About 8 seconds end to end on a fast box.
curl -sSL https://install.hostatlas.app/install.sh | sudo bash -s -- --key=HOSTATLAS_SERVER_KEY Within 30 seconds the agent has cataloged everything in the list above. The host shows up in your fleet with a stable UUID — derived from machine-id + first MAC, not from hostname, so renames don't fragment the timeline.
Diffs every 60 seconds. Container events and systemd state changes pushed within seconds via subscription. A full re-scan every 5 minutes catches anything an event missed. Bandwidth is small — empty diffs are ~400 bytes.
The first scan is the small one. The harder problem is the second day — when somebody deploys a new container at 16:30 and you find out about it at 04:00 because it broke. Live re-discovery is the part you forget about because it just works.
Inventory is a crowded category. Auto-Discovery is opinionated: continuous, agent-based, opinionated about what counts as “an asset.” Here's where it's the right answer and where it isn't.
Once everything is in the inventory, the other capabilities have something to attach to. Most of HostAtlas is downstream of this one feature.
hostatlas user. Container introspection needs Docker group membership. Service control — required only for Auto-Recovery — needs systemctl rights, granted via a narrow polkit policy that ships with the package./etc/hostatlas/exclude.yml with glob patterns for services, mountpoints, container names, or path roots. Globally exclude by tag from the platform. Excluded items still appear in the audit log so nothing disappears silently.Free tier includes the agent on unlimited hosts. The inventory is the same on every plan.