Self-host rudder
9.1.4Infrastructure automation for security posture
- Stars
- 719
- CPU
- 2 cores (<50 nodes), 4 cores (50-1000), 4+ cores (>1000)
- RAM
- 3 GB (<50 nodes), 4 GB (50-1000), 4 GB + 1 GB per 500 nodes (>1000)
- Storage
- SSD recommended for >100 nodes; PostgreSQL: 500-900 kB per Directive per Node per Day of retention
- Ports
- 443 (HTTPS web interface, API, and Windows/Linux agent communication), 5309 (cf-serverd policy distribution for Linux nodes)
- Requires
- OpenJDK, PostgreSQL
What is rudder?
Rudder automates infrastructure security for IT operations teams. It handles configuration management, patch management, vulnerability scanning, system hardening, and compliance with standards such as CIS, NIST, and ISO 27001. The platform uses a central server with web UI and API, optional relay servers, and lightweight agents on managed nodes. It supports Linux and Windows, scales to over 10,000 nodes per server, and comes in a free open-source Core edition (GPL-3.0 with Apache-2.0 exception) and a paid Enterprise edition adding Windows support, ARM architectures, extended maintenance, and professional support.
Should you self-host rudder?
rudder scores 55/100 on selfhost.directory (how scoring works) and ranks #4 of 8 in Configuration Management. It has 719 GitHub stars.
It shipped 11 stable releases in the past year. The latest, 9.1.4, came out on 7 August 2026.
Setup is advanced: plan for several services and some ongoing maintenance. It is GPL-3.0-licensed and written mostly in Scala.
Its closest alternative on selfhost.directory is zookeeper (73/100, 12 826 stars). It scores higher overall, so compare the two before you pick. See rudder vs zookeeper side by side.
Features
- Change requests
- Complete inventory
- Configuration Management
- Disconnected agent
- Dynamic groups
- High Availability
- Multi-Platform SupportWindows and ARM architectures require paid subscription
- Multi-tenant
- Patch Management
- Policy and benchmark compliance
- Relay servers
- REST API
- Rudder Score
- System hardening
- Vulnerability management
rudder README
FAQ
Has Rudder been audited?
Rudder has had several user-conducted pentests over the years (reports private). Cure53 performed an audit of node-server communication logic and a code review of relayd in July 2024, with the report made public.
How long are Rudder versions maintained?
Minor/major releases every ~6 months. Rudder Core has a 3-month upgrade window. With a subscription, major releases are maintained for 18-24 months with a 6-9 month upgrade window between minor versions.
Where can I find support for Rudder?
Professional support is included with a Rudder subscription. Rudder Core users can find help on community channels like GitHub Discussions and Gitter/Element chat.
What is the governance structure of the Rudder project?
The project is led by the French company Normation (formerly known as Normation).
Do I need to reinstall anything if upgrading from Rudder Core to a subscription?
No, the full Rudder solution is a direct super-set of Rudder Core. You don't need to reinstall anything; additional features come as plugins. You may just need to change the repository URL for extended maintenance.
Is Rudder open-source? Is it free? What is Rudder Core?
Rudder uses an open-core model. Rudder Core is free and open-source (GPL-3.0 and Apache-2.0) with main components and Linux agents. The full Rudder solution is paid and partially proprietary, adding Windows support, ARM architectures, extended maintenance, professional support, and additional plugins.
More in Configuration Management
Self Host BlocksSelfHostBlocks is an opinionated NixOS server management system with modular blocks for self-hosting services with unified config, LDAP/SSO, backup, and monitoring.
Semaphore UISelf-hosted, open-source automation server: run Ansible playbooks, Terraform/OpenTofu and Bash, PowerShell or Python scripts from a web UI and REST API.
shelveOpen-source, self-hosted secrets manager for dev teams: keep API keys and .env values in an encrypted vault with team roles, activity logging, scoped tokens and a CLI.
zookeeperApache ZooKeeper
adagiosAdagios is a self-hosted, open-source web UI for Nagios/Naemon/Icinga with modern status view, REST APIs, and audit trails — no database needed.
ARAOpen-source Ansible reporting tool: ara records playbook and ad-hoc runs into SQLite, MySQL or PostgreSQL, browsable via a self-hosted web UI, REST API and CLI.
BuildarrSelf-hosted tool automating *Arr stack configuration via YAML. Idempotent updates, TRaSH-Guides sync, scheduled daemon mode.
CaliberOpen-source CLI that syncs CLAUDE.md, Cursor rules, AGENTS.md and MCP config across Claude Code, Cursor and Codex, running fully self-hosted on your own API keys.
clonarrSelf-hosted web app to sync and customize TRaSH Guides profiles for Radarr and Sonarr with visual UI, auto-sync, and rollback.
collinsCollins is a self-hosted, open-source CMDB from Tumblr for tracking servers, switches, and racks with REST API, CLI, IPAM, power management, and multi-datacenter support.
ConfigarrConfigarr is a self-hosted, open-source tool that automates configuration for Sonarr, Radarr, and other *arr apps by syncing custom formats from TRaSH-Guides.
coreCFEngine is a self-hosted, open-source configuration management system automating infrastructure, security, and compliance at scale.
0 comments