Help › Start here
How bananana.dev works
The brain, nodes, the relay and the agent, and what happens when you click something. Five minutes that make everything else make sense.
bananana.dev has four parts. Once you know what each one does, the rest of the help (and the dashboard) is easy to follow.
The four parts
- The brain
- One server your company owns, usually in the office, that runs bananana.dev. It holds everything: the dashboard, every account, every setting and every record. There's one brain per company. The brain's own pages (Overview, Hardware, Docker and so on) show that server.
- Nodes (devices)
- Every other computer bananana.dev looks after: Windows PCs and laptops, Macs, Linux servers, even a Raspberry Pi. Each one runs a small program, the agent. "Node" and "device" mean the same thing in this help.
- The agent
- A single program (
bananana-node) installed as a system service on each node. It reports how the computer is doing, and does what the brain asks, but only the things you allowed when you installed it. On Windows and Macs it also shows a small bananana.dev icon by the clock. - The relay
relay.bananana.dev, run by us. The brain and every node connect out to it, so nothing needs an open port, a VPN or a fixed address. It passes encrypted messages along and can't read them.
What happens when you click something
Say you press Restart next to the Print Spooler service on RECEPTION-01:
- Your browser asks the brain. The brain checks who you are, whether your role allows restarting services, and whether RECEPTION-01 is one of the devices you look after.
- The brain encrypts the request for that one computer and hands it to the relay.
- The relay forwards the sealed message to RECEPTION-01's agent. It sees only which connection it goes to, and how big it is.
- The agent checks that this node allows service control (it was chosen at install, and the node enforces it, not the brain), restarts the service, and sends back the result, encrypted.
- The brain writes what happened to the audit log: who, what, which device, when, and from where.
The whole round trip takes well under a second.
Features: what a node allows
Each node decides what the brain may do on it. You choose when you add it, and someone at the computer can change it later with bananana-node enable or disable.
| Feature | What it allows | Needed for |
|---|---|---|
| Monitor | CPU, memory, disks, network, temperature, processes, installed apps, security status. Always on. | Company overview, Compliance, alerts |
| Terminal | A command line on the computer, and running scripts. Runs as the administrator account (root, or SYSTEM on Windows). | Terminal, automations, app installs, security actions, rollouts |
| Files | Browsing, uploading, downloading and changing files. | The Files tab |
| Services control | Starting, stopping and restarting services and Docker containers. | The Services tab, service automations |
| Screen control | Seeing and controlling the screen. | Screen, My computers |
Jobs: work that waits for offline computers
Many things bananana.dev does (installing an app, reading a computer's security status, running a scheduled script) are jobs. A job waits in a queue until its computer is online, then runs. If it fails it tries again a few times with growing gaps; if the computer goes offline halfway, it puts the job back without counting it as a failure. You see a device's jobs on its Device tab.
Where things live
| What | Where |
|---|---|
| Accounts, settings, the audit log, device records, app catalog, automations, history | On your brain, in its data folder, backed up every night. |
| Each node's identity (its private key) and allowed features | On that node: C:\ProgramData\bananana-node\config.json, /Library/Application Support/bananana-node/config.json or /etc/bananana-node/config.json. |
| Nothing readable | On the relay. It holds an address for your brain and, briefly, sealed onboarding codes. |
The full security story: How bananana.dev keeps things safe.