Every process. Every owner. Every sunset.
Fernwake is built around four primitives — Discover, Attribute, Alert, Sunset — and an opinionated workflow that connects them.
Continuous discovery, across every plane.
Fernwake ships with collectors for the layers you actually run things on. Each collector is read-only and ships out the smallest signature it needs.
- Hosts & VMs (systemd, init.d, cron via the Fernwake agent)
- Containers (Kubernetes, Nomad, ECS, plain Docker)
- Serverless (AWS Lambda, GCP Cloud Run, Cloudflare Workers)
- CI pipelines (GitHub Actions, GitLab, Buildkite)
- Third-party webhook receivers (Zapier, n8n, custom inbound URLs)
# 2,184 processes across 47 hosts scope processes ghost stale ───────────────────────────────────── hosts 1,096 18 142 containers 787 6 54 serverless 301 19 22 + cron jobs 412 4 —
Connect every process to a human — even if they've left.
Fernwake's attribution engine cross-references everything that mentions a process to surface the most likely current owner. Even when the original author quit four years ago.
- Git blame on the deploy commit + on the executable's source file
- Ticket history (Jira, Linear) mentioning the process name or host
- Your SSO directory — off-boarded users surface as "orphaned"
- Manual claim flow: any teammate can adopt a process in two clicks
# Source: aws-lambda/us-east-1/invoice-retry-v2 last commit a4f8c1c · 2022-03-14 last author j.lim <off-boarded 2023-09-01> linked PRs PR #4112, PR #4187 linked tickets BILL-882, BILL-901 → orphaned no active owner → suggested adoption: team:billing
Get pinged when a new ghost appears — not three months later.
Fernwake watches your delta. The moment a new process appears in production without an owner, justification, or sunset date, you'll know.
- Real-time alerts to Slack, Microsoft Teams, PagerDuty, OpsGenie
- Triage from chat — adopt, suppress, or mark-for-review in one click
- Quiet hours, on-call rotation, custom routing rules
- Weekly digest of stale processes for the eng-leads channel
─── Fernwake bot ─────────────────── 🟡 new ghost detected /opt/scripts/clean_tmp.py host: app-07 first seen: 12m ago owner: none [ adopt ] [ suppress ] [ details ] ─── 2m later ────────────────────── ✓ adopted by @maria → team:platform
Decommission with a paper trail. Roll back with one click.
The whole point: actually turn things off. Fernwake's sunset workflow proposes the deprecation, runs a dry-run impact analysis, requires approvals, then commits — keeping a snapshot ready for instant rollback.
- Dry-run mode predicts downstream impact before anything changes
- Approval chains: 1 reviewer for low-risk, 2 for prod-critical
- Quiet kill — the process is paused for 14 days before being truly removed
- One-click rollback restores binary, cron entry, and IAM state
$ fernwake sunset clean_tmp.py --dry-run # Impact analysis depends-on none detected depended-by none detected cost saved $12.40 / month last useful output sink unreachable since 2023 → proposal #88 created → awaiting approval from @maria, @dan # Rollback always available for 14 days
It already speaks your stack.
One-click connectors for the tools you already pay for — and a typed API for everything else.
Cloud
AWS, GCP, Azure, DigitalOcean, Hetzner. Read-only IAM is all we need.
Orchestration
Kubernetes, Nomad, ECS, Docker Swarm. Read pods, deployments, jobs.
SCM
GitHub, GitLab, Bitbucket. We pull blame and PR metadata, never source code.
Tickets
Jira, Linear, Asana. Helps attribute by linked tickets and labels.
Chat
Slack, Microsoft Teams. Triage ghosts and approve sunsets without leaving chat.
Paging
PagerDuty, OpsGenie, Grafana OnCall. Route ghost alerts into your existing rotation.
SSO & SCIM
Okta, Google Workspace, Microsoft Entra. Off-boarded users surface as orphan owners.
Custom
Typed REST + webhook API. Build collectors for anything weird in your stack.
Read-only by default. Auditable by design.
You can't damage what you can't write to. Every privileged action Fernwake takes is explicit, approved, logged, and reversible.
Read-only IAM
Connect with the smallest possible permission set. The agent runs unprivileged unless you opt-in to host-level remediation.
Audit log of everything
Every login, every adoption, every sunset proposal — append-only and exportable to your SIEM.
Self-hostable
Single-tenant cloud, dedicated cloud, or fully self-hosted on your own K8s cluster. We support all three.
SOC 2 Type II
Audited annually. Penetration test reports available under NDA.
EU + US data residency
Pick your region at signup; data never crosses it. GDPR DPA available on request.
Open-source agent
The host agent is MIT-licensed. Inspect every byte before you run it.