Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Cockpit is a free, open-source web console for administering Linux. Install the distribution’s cockpit package, enable its systemd socket, and open https://server-address:9090 in a modern browser. Sign in with an existing Linux account, then use sudo or another configured privilege mechanism for administrative tasks. Cockpit complements SSH, the command line, and Ansible; it does not replace them.
This guide covers installation on major distributions, first login, common management tasks, add-ons for containers and virtual machines, security, and recovery when the page or a feature does not work.
What Cockpit does
Cockpit presents the host’s existing Linux services and APIs in a browser. Depending on the distribution and installed modules, it can show system health, search the systemd journal, control services, inspect networking and storage, manage users, apply software updates, open a browser terminal, administer Podman containers, and manage libvirt virtual machines. See the official project overview for the current feature set and release information.
It is not a fleet configuration system, a complete hosting control panel, a backup product, or a substitute for patch policy and monitoring. For repeatable changes across many machines, keep using Ansible, Terraform, or your existing automation. Cockpit can switch between hosts, but that is not the same as centralized policy enforcement.
#1 Best Overall
- LAPTOP TO SERVER: USB crash cart adapter connects your laptop to a headless system, turning your laptop into a portable console for rack servers in your server room, PCs, ATMs, kiosks, etc
- EFFICIENT TROUBLESHOOTING: Easily log server activity using the crash cart adapter software; For optimal performance, be sure to install the latest drivers; Note: Please make sure to download the drivers specifically for the NOTECONS01
- BIOS-LEVEL CONTROL: Connect the laptop crash cart adapter to your computer using the included USB cable, then connect the integrated USB and VGA cables to your server for instant BIOS-level control
- SELF-POWERED: The KVM adapter is powered by the server-side USB connection, reducing strain on the laptop's battery and eliminating the need for an AC outlet, allowing you to connect to any PC or device with a VGA output port and USB connection
- COMPACT DESIGN: This TAA Compliant pocket-sized data center crash cart adapter requires no additional accessories, eliminating the need to carry around a traditional crash cart/trolley when troubleshooting and servicing your systems
Before installing
- A supported Linux distribution and a user who can log in locally or through SSH.
sudoor equivalent privileges for installation and privileged changes.- A modern Firefox, Chrome, Edge, Safari, or GNOME Web browser. Use the current browser-support guidance on the Cockpit running page rather than relying on obsolete versions.
- Network connectivity to the server. Remote access normally requires TCP port
9090. - A plan to restrict that port, protect the certificate, and provide access through a trusted network or VPN.
Cockpit is an administrative endpoint: its terminal and management pages can perform the same consequential actions as a shell. Do not expose it casually to the public internet.
Install Cockpit by distribution
Fedora
Fedora Server includes Cockpit by default. On other Fedora editions:
sudo dnf install cockpit
sudo systemctl enable --now cockpit.socketIf firewalld is active and clients must connect remotely:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo firewall-cmd --add-service=cockpit
sudo firewall-cmd --add-service=cockpit --permanentUse Fedora’s normal repositories first. Some variants offer newer builds through COPR, but a third-party build should be a deliberate compatibility decision, not the default installation path.
Red Hat Enterprise Linux
Cockpit is available for RHEL 7 and later. The upstream instructions require the Extras repository on RHEL 7; RHEL 8 does not require a non-default repository. Exact repository names and package commands vary by release and subscription configuration. On RHEL 7, the documented path is:
sudo subscription-manager repos --enable rhel-7-server-extras-rpms
sudo yum install cockpit
sudo systemctl enable --now cockpit.socketOn newer releases, use the enabled RHEL repositories and dnf where appropriate. If firewalld uses a non-default zone, add the service to the zone through which clients connect:
sudo firewall-cmd --add-service=cockpit
sudo firewall-cmd --add-service=cockpit --permanentConsult the upstream RHEL instructions and Red Hat’s installation article; some Red Hat details require a subscription.
Debian
Cockpit is available in Debian beginning with Debian 10 (Buster). Stable repositories may contain an older release, so the project recommends official backports when you need a newer version:
Rank #2
- Small size for easy installation
- Real COM and TTY drivers for Windows, Linux, and macOS
- Standard TCP/IP interface and versatile operation modes
- Easy-to-use Windows utility for configuring multiple device servers
- SNMP MIB-II for network management
. /etc/os-release
echo "deb http://deb.debian.org/debian ${VERSION_CODENAME}-backports main" |
sudo tee /etc/apt/sources.list.d/backports.list
sudo apt update
sudo apt install -t ${VERSION_CODENAME}-backports cockpitWhen updating Cockpit and its dependencies, retain the -t ${VERSION_CODENAME}-backports selector. Prefer Debian’s backports over mixing unrelated third-party repositories.
Ubuntu
Ubuntu packages Cockpit, with updated builds available through official backports for LTS releases:
. /etc/os-release
sudo apt install -t ${VERSION_CODENAME}-backports cockpitIf backports are not enabled in your customized APT sources, enable the matching distribution component first. Package-update integration can be affected by the interaction among PackageKit, NetworkManager, netplan, and systemd-networkd; an update page that reports the host as offline does not necessarily mean APT itself is broken.
Free tools Windows power users keep installed
One-click scans. No signup required.
Arch Linux
sudo pacman -S cockpit
sudo systemctl enable --now cockpit.socketIf pacman reports that a database file does not exist, refresh the system before installing:
sudo pacman -SyuopenSUSE
For Tumbleweed and Leap 15.6 or newer:
sudo zypper in cockpit
sudo systemctl enable --now cockpit.socketWith firewalld:
sudo firewall-cmd --permanent --zone=public --add-service=cockpit
sudo firewall-cmd --reloadOn openSUSE, direct root access is disabled by default. The project documents the relevant setting in /etc/cockpit/disallowed-users; use a named administrative account and sudo where possible.
Fedora CoreOS and immutable systems
The standard Fedora CoreOS image does not contain Cockpit. Overlay the required packages and reboot:
rpm-ostree install cockpit-system cockpit-ostree cockpit-podmanA CoreOS host managed through another Cockpit instance may not need the same direct web-server arrangement. Direct browser login to the host requires additional container-based configuration; follow the current CoreOS instructions.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallStart and verify the socket
Cockpit is normally socket-activated. The browser service starts on demand, so a continuously running cockpit.service process is not required.
Rank #3
- Includes: 2x Power Cord, 1x Console Cable, 1x Rack Ears
systemctl status cockpit.socket
systemctl is-enabled cockpit.socket
sudo ss -ltnp | grep 9090You want an enabled socket and a listener on TCP port 9090. Then browse to:
https://SERVER_IP_OR_HOSTNAME:9090The default port and socket behavior are documented in the Cockpit manual.
First login and privileges
- Use
https://, nothttp://, followed by the server name or address and port 9090. - On a new installation, review the certificate warning. A self-signed certificate is common initially; do not blindly bypass warnings on a production system.
- Enter a normal Linux username and password, or the identity method configured by your administrator.
- For a task requiring root privileges, use Cockpit’s Administrative Access or privilege-elevation control. Your account must be allowed to use sudo or the configured mechanism.
- Confirm that the host name and operating-system details identify the intended machine.
Cockpit normally uses the host’s existing accounts, authentication policy, and privilege model. Read the authentication guide before changing root-login or centralized-identity settings.
Recommended Free Tools
Using the main pages
Overview
Use Overview for CPU, memory, storage, operating-system details, host name, and high-level health and performance information. It is a starting point, not a replacement for long-term monitoring.
Logs
Search and filter systemd journal entries, select a boot, and inspect failures around the time a service stopped. Logs are usually the fastest way to understand a failed start.
Services
Start, stop, restart, enable, or disable systemd units and inspect their recent logs. These buttons have the same operational consequences as systemctl; disabling the wrong unit can interrupt networking, storage, or remote access.
Networking
Inspect interfaces, addresses, routes, and connections, and configure NetworkManager-managed networking where the platform supports it. Capabilities depend on the host’s network stack, installed tools, permissions, and distribution integration. Have console or out-of-band access before changing the interface carrying your Cockpit session.
Storage
Review disks, partitions, filesystems, mounts, RAID, and encryption-related storage. Cockpit delegates much of this work to underlying storage APIs such as udisks, so available operations vary. Verify backups before formatting, deleting, resizing, or changing a mount.
Rank #4
- Remote MANAGEMENT: Avocent ACS8000 48-port advanced terminal management Serial Console Server allows users to access and troubleshoot remote locations using automatic network failover to Cellular (and failback).
- 8 USB 2.0 Ports: support external devices, IoT products and IT equipment; Features digital input/ output sensor ports and 48 RS232 serial.
- Automated PROVISIONING: Offers Fast, automated configuration with zero touch provisioning; compliant with data center access and security policies; powerful Dual-core ARM processor and 16GB of flash memory to support automation scripting.
- Power DEVICE MANAGEMENT: Dual 1 gigabit Ethernet port for network connectivity and failover and secure in band management for daily networking management; expanded support for Rack PDUs from Vertiv, server, APC, Raritan and Eaton along with Vertiv GXT4 UPS systems
- Environmental sensor port: connect to temperature, humidity, differential pressure, leak, and door pin sensors.
Accounts
Create and modify users, set passwords, and change group membership. Treat adding a user to an administrative group as a privilege grant, not a cosmetic account edit.
Software updates
Where PackageKit is supported, review and apply updates through the Software Updates page. If the page reports an Ubuntu machine as offline while APT works, investigate the documented PackageKit/NetworkManager and netplan/systemd-networkd integration issue rather than repeatedly clicking Refresh.
Terminal
The browser terminal is a real shell on the host. Use it for commands not exposed in the interface, and protect Cockpit as carefully as you would SSH.
Add modules for containers, virtual machines, and performance
The base package does not include every page. Package names and availability are distribution-specific; search your distribution’s repositories before installing.
cockpit-machines— libvirt and QEMU virtual machines.cockpit-podman— Podman containers and images.cockpit-storaged— additional storage management.cockpit-networkmanager— NetworkManager-related functionality where applicable.cockpit-packagekit— package operations and updates.cockpit-pcp— more detailed performance data where supported.cockpit-kdumpandcockpit-composer— platform-specific crash-dump and image-building features.
For example, on a DNF-based system:
sudo dnf install cockpit-podman cockpit-machinesMachines also needs a functioning libvirt/QEMU stack, suitable permissions, VM storage, and (for hardware acceleration) virtualization enabled in BIOS or UEFI. The equivalent add-on guidance is covered in Red Hat’s web-console documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Practical administration workflows
Restart a failed service
- Open Services and filter for the unit.
- Read its status and recent journal entries before restarting.
- Correct the underlying configuration if necessary.
- Restart it, then confirm the new status and logs.
Investigate a server problem
Start with Overview for resource pressure, move to Logs for boot and service errors, and use Services to inspect the affected unit. Use the terminal for commands or diagnostics not represented in the UI.
Review updates safely
Read the proposed package list and reboot requirements. For production, follow your maintenance window and rollback plan; a GUI does not remove the need to test updates.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Inspect disk and network state
Use Storage to identify full filesystems and unexpected mounts, and Networking to verify addresses, routes, and link state. Make destructive storage changes only after independently verifying the target disk.
Best Value
- 16-Port Serial Console / Terminal Server Management Switch
- Dual Ethernet, Dual Power Supply, and Built-in Modem
- Secure In-band and Out-of-band access for a Host of Equipment
- Manage all equipment in the rack: Servers, UPS, Routers, Switches, Firewalls, etc
- Compliant with the Federal Trade Agreements Act (TAA) for GSA Schedule purchases
Manage a container or VM
Install the matching add-on, confirm the underlying Podman or libvirt service works from the command line, and then use the corresponding Cockpit page. For a VM that will not boot, check BIOS/UEFI virtualization, QEMU/libvirt packages, disk and boot-media configuration, libvirt permissions, and available CPU, memory, and storage.
Secure a Cockpit deployment
- Allow TCP 9090 only from a trusted management subnet, VPN, or jump host.
- Avoid direct public exposure. Cloud security groups and network ACLs must be restricted as well as the host firewall.
- Replace the initial certificate with a certificate trusted by your users, or use a correctly configured TLS reverse proxy.
- Use named accounts, strong authentication, centralized identity or SSO where appropriate, and sudo rather than routine direct root login.
- Remove unused administrative accounts and keep Cockpit, add-ons, and the operating system patched.
- Log and monitor administrative activity.
If opening port 9090 on every server is undesirable, Cockpit supports SSH-based access through Cockpit Client or a cockpit/ws container on another host. The official FAQ also documents NGINX, Apache/Let’s Encrypt, and Pomerium proxy deployments. Proxy configurations must correctly handle WebSockets, paths, TLS termination, and authentication.
Troubleshooting
The login page does not load
systemctl status cockpit.socket
sudo ss -ltnp | grep 9090
sudo firewall-cmd --list-services # firewalld
sudo ufw status # UFWThen check DNS, the URL scheme, host firewall rules, cloud security groups, network ACLs, and whether the socket is listening on an address reachable from the client.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The socket is inactive
Run sudo systemctl enable --now cockpit.socket, inspect systemctl status cockpit.socket, and read journalctl -u cockpit.socket for package, permission, or systemd errors.
Certificate warnings or login failures
Verify that the address matches the certificate and that the account can log in through the host’s normal authentication path. Do not solve a production certificate problem by permanently ignoring browser warnings. Root login behavior differs by distribution; use a named sudo-enabled account unless your policy explicitly requires another arrangement.
Blank page after login
- Open the browser developer console, commonly with
Ctrl+Shift+J. - Inspect recent host logs:
sudo journalctl --since "5 minutes ago". - If a proxy is present, verify WebSocket forwarding, path handling, and TLS configuration.
These are the troubleshooting steps recommended in the Cockpit FAQ.
Ubuntu updates say the system is offline
This can result when PackageKit checks NetworkManager while the active system uses netplan and systemd-networkd. The FAQ describes a version-sensitive workaround involving NetworkManager managed-device behavior and a dummy interface; on some Raspberry Pi arm64 systems, extra kernel modules are also needed. Treat it as an advanced integration fix, not a universal first step.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe Cockpit package is old
Compare your distribution repository with its official backports path, especially on Debian and Ubuntu. Avoid random repositories on a production server merely to obtain a newer interface.
When Cockpit is the right tool
Cockpit is a strong fit for occasional or routine browser administration of one or several Linux hosts, especially on a protected network. It gives a small team a visual overview while preserving normal CLI workflows and is convenient for basic Podman or libvirt management.
Choose another primary tool when you need repeatable fleet-wide configuration (SSH plus Ansible is usually better), a customer-facing hosting panel with billing and quotas, deep enterprise observability and compliance workflows, or a virtualization platform rather than a host console. Webmin, Portainer, Proxmox VE, and commercial management suites address different jobs; none is a drop-in synonym for Cockpit.
The Bottom Line
Cockpit’s reliable installation pattern is simple: install the distribution package, enable cockpit.socket, allow port 9090 only on a trusted management path, and sign in with an existing Linux account. Treat the console and its terminal as privileged access, install add-ons only when their underlying services are ready, and keep SSH and automation available for recovery and repeatable administration.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
