the surface
Read is the floor.
Everything above it is a grant.
Write, exec, terminal, plugins — each a separately granted, separately disableable capability that shrinks toward read-only as your declared Tier rises. No feature is bolted on; each one rides the same auth spine and lands in the same ledger.
01
Capability by capability
every rung independently disableable| group | capability |
|---|---|
| read/render |
Markdown with tables, footnotes and syntax-highlighted fences · 75 language grammars with line
numbers · JSON as shape-driven panels you can title, order and format from
config · CSV/TSV grids · logs and plain text · video and
audio inline — mp4, webm, mov, mkv; mp3, wav, flac, opus and friends — with honest
fallbacks · images and PDF as ever · 14 hand-tuned themes applied
pre-paint, no flash · invalid input keeps its notice, and the original bytes are always
one ?raw=1 away. |
| doors/share · dav |
Shares: expiring read-only links to a subtree — 256-bit secret shown
once, SHA-256 at rest, optional unlock password, managed and revoked from
/shares · the WebDAV door at
/dav/<label>/: Class 1 plus exclusive LOCK, riding the same
grants, trash, history and ledger as the browser — mount it in any file manager
or rclone, and a mounted editor's writes are as accountable as a logged-in browser's.
Both free in every edition. |
| prove/identity | Passkeys, password + TOTP, PAM import — every edition · step-up re-proof on the dangerous rungs: exec, shell, delete · licensed ladders: OIDC and trusted-proxy header (Pro+), LDAP (Team+), SAML and Kerberos (Enterprise) · client mTLS at the handshake — unanchored clients never reach HTTP (Team+) · break-glass accounts for the console only. |
| write/edit |
In-browser editor profiles — minimal, advanced, full — all embedded, all themed ·
ETag / If-Match conflict detection · atomic writes, no temp residue ·
rename, mkdir, delete with trash and restore ·
shadow-copy history with prune caps · size-capped upload · symlink aliases denied at
the target · policy writes validated before they land. |
| find/measure |
Content search across roots · parallel disk-usage scans with a cleaner that
trash-moves on dry-run-first policies · live refresh as the
tree changes · a Prometheus /metrics endpoint. |
| reach/exec · pty | argv-only Exec against an operator allowlist — no shell is ever constructed; a shell exists only as a separately named Grant · env-cleared children, own process group, deadline kills the whole group · tmux-backed terminal sessions that survive a closed browser · idle timeouts · optional asciinema-format session recording (Enterprise). |
| extend/plugins |
Out-of-process sidecars in any language, JSON-RPC over a Unix socket ·
default-deny filesystem/exec scopes and hard budgets ·
Landlock + seccomp cage · Ed25519-signed .renarp packages verified
before the manifest is even parsed · reference plugins: git panel,
journalctl explorer, container panel, log viewer. |
| watch/fleet |
Signed status envelopes between instances — each engine owns an Ed25519 instance
key generated at first boot · a /fleet page of live up/down cards ·
a health badge in the top bar · wrong key, bad status and staleness all read as
down, with reasons. (Enterprise.) |
02
Reading, up close
unretouched screenshots of the running engine/api/server.rs
/api/schema.sql
/web/app.ts
/data/service.log
/data/metrics.csv
/login
03
Against the field
honest positioning| versus | their shape | Renar's |
|---|---|---|
| Cockpit · Webmin · Ajenti | Hand-built dashboards; runtime stacks; systemd-coupled panels | One static binary, any init, out-of-process plugins, renderer-quality reading |
| CasaOS · 1Panel · Portainer | Container-app stores; the container is the unit | Whole-machine and filesystem-first — the box, not just what runs in Docker on it |
| filebrowser · dufs · miniserve | Browse ± upload; exec removed for safety | The rungs secured rather than amputated — grants, step-up, ledger, recording — plus search, du, git panels, plugins |
| code-server | A full IDE per user; heavy; npm-shaped supply chain | A lightweight console with zero client dependencies and a JSON twin on every surface |
| Teleport | Recorded SSH — the philosophy, applied to shells | Kindred philosophy, different category: recorded browser sessions over a capability-scoped file console |