What is Fleet?

Fleet is an open-source device-management and endpoint-security platform aimed at IT and security teams looking after large numbers of computers. A Fleet server plus its fleetd agent delivers mobile device management, software inventory and patching, OS update enforcement, script execution, compliance policies and ongoing vulnerability reporting across macOS, Windows, Linux, ChromeOS, iOS and Android, including first-class attention to Linux. You can drive everything from the web UI, the REST API, webhook automations, the fleetctl command-line tool, or a Git repository of YAML configuration, so changes are reviewed and can be rolled back. Self-hosting means running the Fleet server next to your own MySQL database and Redis and pointing agents at it; documented paths include a homelab Docker Compose setup, Kubernetes, AWS with Terraform, GCP, Render, and a Docker-based fleetctl preview that serves the UI on localhost:1337 for testing. The free edition is MIT-licensed and the project states it adds no artificial limits on hosts, users or performance, while the paid Premium tier (from $7 per host per month) layers on two-factor login, role-based access control, enforced disk encryption, conditional access, vulnerability scores and CISA KEV data, plus optional vendor-hosted cloud for deployments above 700 hosts.

Should you self-host Fleet?

Fleet scores 67/100 on selfhost.directory (how scoring works) and ranks #1 of 11 in Device Management. It has 7 061 GitHub stars.

It shipped 3 stable releases in the past year. The latest, fleet-v4.93.2, came out on 21 October 2026. New versions land roughly every 7 days.

Setup is advanced: plan for several services and some ongoing maintenance. It is Other-licensed and written mostly in Go.

Its closest alternative on selfhost.directory is CUPS (67/100, 1 787 stars). Fleet scores higher overall. See Fleet vs CUPS side by side.

Features

Cross-platform mobile device management (MDM)
Custom log forwarding
Enforce disk encryptionListed only under Fleet Premium.
fleetctl CLI
GitOps / configuration as code
Live queries and device reports
Malware and IOC detection (YARA)
Policies and CIS benchmark compliance
REST API
Role-based Access ControlListed only under Fleet Premium.
Script Execution
Software inventory and patching
Two-factor authenticationListed only under Fleet Premium.
Vulnerability managementVulnerability scores and CISA KEVs are Fleet Premium.
Webhooks

How to configure Fleet

FLEET_LICENSE_KEYLicense key that unlocks Fleet Premium features
License key that unlocks Fleet Premium features
FLEET_MYSQL_ADDRESSlocalhost:3306MySQL host and port Fleet stores its data in
MySQL host and port Fleet stores its data in
FLEET_MYSQL_DATABASEfleetName of the MySQL database Fleet uses
Name of the MySQL database Fleet uses
FLEET_MYSQL_USERNAMEfleetUsername Fleet connects to MySQL with
Username Fleet connects to MySQL with
FLEET_REDIS_ADDRESSlocalhost:6379Redis host and port used for pubsub and host cache
Redis host and port used for pubsub and host cache
FLEET_REDIS_HOST_CACHE_TTL60sBase TTL for entries in the Redis-backed host lookup cache
Base TTL for entries in the Redis-backed host lookup cache
FLEET_SERVER_ADDRESS0.0.0.0:8080Address the Fleet webserver (UI and API) listens on
Address the Fleet webserver (UI and API) listens on
FLEET_SERVER_CERT./tools/osquery/fleet.crtTLS certificate used when terminating TLS
TLS certificate used when terminating TLS
FLEET_SERVER_ENABLE_CSPAdds a Content-Security-Policy header to Fleet UI, API and static asset responses; env-var only
Adds a Content-Security-Policy header to Fleet UI, API and static asset responses; env-var only
values: 1 or true to enable
FLEET_SERVER_KEY./tools/osquery/fleet.keyTLS private key used when terminating TLS
TLS private key used when terminating TLS
FLEET_SERVER_MAX_INSTALLER_SIZE10GiBMaximum size of uploaded software installers
Maximum size of uploaded software installers
values: human-readable size (K, M, G, T or KB, MB, GB, TB)
FLEET_SERVER_PRIVATE_KEYKey needed for Apple, Windows and Android MDM features and for storing sensitive configs; at least 32 bytes
Key needed for Apple, Windows and Android MDM features and for storing sensitive configs; at least 32 bytes
FLEET_SERVER_TLStrueWhether the server is served over TLS
Whether the server is served over TLS
values: true | false
FLEET_SERVER_TRUSTED_PROXIESHow Fleet determines the client IP for rate limiting behind proxies
How Fleet determines the client IP for rate limiting behind proxies
values: none | IP list/CIDRs | number | header:<name>
FLEET_SERVER_URL_PREFIXURL prefix under which the Fleet API and frontend are served, e.g. /apps/fleet
URL prefix under which the Fleet API and frontend are served, e.g. /apps/fleet
values: path without trailing slash

FAQ

Is Fleet MIT licensed?

Different parts of the codebase carry different licences: most of Fleet is MIT, and paid features require a license key.

Can I buy support or services separate from Fleet Premium?

No, support and services are only available through purchasing Fleet Premium.

How do I contact Fleet for support?

Documentation, guides and community help are free for everyone; professional support with a guaranteed response time requires a Premium license.

How can I uninstall fleetd?

The project publishes a dedicated guide for removing the Fleet agent from a host.

Will Fleet slow down my servers? What about my employee laptops?

You control how often and how heavily scanning runs, Fleet reports the performance impact of each collection, and a query that is too demanding on a host gets temporarily disabled.

What browsers does Fleet support?

Current stable releases of all major browsers are supported, though some admin UI areas are awkward on mobile browsers.

What host operating systems does Fleet support?

Supported host OSes include macOS 15+, iOS/iPadOS 17+, Windows 10 21H2 and later plus Server 2012+, ChromeOS 112+, Android 14+, and many Linux distributions.

What Redis versions are supported?

Redis 6.2 and 7 are actively tested; Redis 8 and Valkey are known to work but aren't part of the regular test matrix.

What MySQL versions are supported?

Fleet is tested with MySQL 8.0.44, 8.4.8 and 9.5.0 (9.6.0 is currently incompatible), Aurora needs at least 3.10.3, and MariaDB or other variants should be avoided.

What is the easiest way to deploy Fleet?

Use the official deploying guides (Render, or AWS with Terraform) or run it anywhere you like; agents can be installed with a simple installer or delivered through existing tools such as Chef, Ansible or Puppet.

Do you offer pricing for unmanaged hosts? What about ephemeral hosts which may scale up or down?

The licensed host count is the maximum number of enrolled hosts at any moment, and devices still pending MDM enrollment are not counted.

Has anyone stress-tested Fleet? How many hosts can the Fleet server handle?

Load testing reached 150,000 online and 400,000 enrolled hosts; production deployments typically run several Fleet servers behind a load balancer, with MySQL as the usual bottleneck.

What options do I have for access control? What about auditing admin activity?

Fleet supports role-based permissions, different admins per group of hosts, staged rollouts, built-in audit logging, and git-tracked change history through GitOps.

Where's the data stored?

Because Fleet is self-managed, metadata sits in the MySQL database wherever you deploy the server, while most endpoint data can be streamed to any supported log destination.