Cockpit vs Stenvakt
Cockpit is an excellent way to look inside one Linux server from a browser. Stenvakt is built for a different moment: you have a few servers, and you want them patched, firewalled and locked down without ever locking yourself out.
Published . Cockpit as documented on cockpit-project.org; Stenvakt for macOS 14 or newer, managing Linux servers over SSH.
The short answer
- Cockpit is a free web console that runs on the server. It shows services, logs, storage, networking and containers, has a terminal in the browser, and is packaged by most major distributions.
- Stenvakt is a Mac app. It reviews each server over SSH, scores it, and applies firewall, SSH and update fixes with a rollback timer that runs on the server.
- They overlap less than it looks. Cockpit is for seeing and operating one machine; Stenvakt is for deciding what is risky across your servers and fixing it safely.
Where each one runs
Cockpit runs on the server and is reached in a browser, on port 9090 by default. You sign in with a normal system account. On Fedora and RHEL it is often already installed and only needs to be turned on; on Ubuntu and Debian you install the cockpit package. From one Cockpit you can also add other machines, which it reaches over SSH.
Stenvakt runs on your Mac and connects over SSH. Nothing listens on the server, so there is no extra login page on the internet to protect.
What Cockpit does well
- Live views: CPU, memory, disk and network graphs, and the system journal with filters.
- Operating the machine: start and stop services, manage storage and network settings, run containers with Podman, and use a terminal in the browser.
- It is free, open source and maintained by a large community.
What Stenvakt adds
- An opinion. Cockpit shows you a firewall zone; Stenvakt tells you that PostgreSQL is reachable from the internet, that Docker publishes a port around ufw, or that SSH still accepts passwords, and ranks it.
- Safe changes. Firewall and SSH changes arm a rollback on the server first and are kept only after a fresh SSH login works.
- Many servers at once. The same review on every server, a fleet score, and the weakest server first.
- History. Login attempts, firewall blocks and score changes over time, and what changed since you last approved a server.
How to choose
- You want to poke around one server, read logs and restart things from a browser: Cockpit.
- You want to know which of your servers is weakest and fix it without risking SSH access: Stenvakt.
- Plenty of people use both. If you keep Cockpit, keep port 9090 closed to the internet or behind a VPN; Stenvakt's review will flag it if it is open.
Stenvakt checks the things Cockpit leaves to you: exposed databases, Docker ports that skip the firewall, weak SSH settings, missing updates. Fixes run in safe mode with an automatic rollback. Get early access.