Device management on top of osquery and nanoMDM
Fleet is a self-hosted server for managing and inspecting an organization's devices: Macs, Windows PCs, Linux workstations and servers, iPhones and iPads, Android phones and Chromebooks. Its agent, fleetd, bundles osquery, Orbit (Fleet's own manager for osquery versions and config) and a Chrome extension that enrolls ChromeOS devices. The README credits nanoMDM as one of the projects Fleet is built on. The server ships as two static binaries: fleet runs the web UI, the REST API and the agent endpoints, and fleetctl drives the instance from a terminal.
The pitch is one tool for MDM, software deployment, patching and checking device state, on every OS a company runs.
Hosts you query in SQL, settings you keep in Git
- SQL across the fleet: a report is a saved SQL query that osquery runs on hosts, a policy is a yes-or-no query, and a label is the set of hosts that match a query.
- Config as YAML: labels, policies, reports, software and MDM settings live in files that
fleetctl gitopsapplies, so changes go through the team's usual CI and approval process. - Query cost on record: Fleet tracks the CPU, memory and network use of every query and temporarily disables one that gets too heavy on a host.
- Visible scope: Fleet Desktop shows users the status of their own machine, and the project says the agent is not built to log keystrokes, emails or webcams.
- Verifiable agent builds: Orbit binaries carry SLSA provenance attestations, which
gh attestation verifycan check when an EDR flags the agent. - Fits existing tooling: fleetd can be rolled out with Chef, Puppet, Ansible, Munki, Jamf or Intune.
MIT core, $7-per-host Premium, MySQL and Redis required
Two licenses in one repository. The LICENSE file puts everything outside the ee/ directory under MIT. Code inside ee/ falls under the Fleet Enterprise Edition license: it can be modified and used freely for development and testing, but running it in production takes a subscription sized to the number of hosts. The FAQ commits to never moving a free feature into the paid tier, and to keeping artificial host limits out of the open-source code.
The free tier stops short of remote wipe. The feature table on the pricing page puts cross-platform MDM, OS settings, scripts, policies, vulnerable-software detection, SSO and GitOps in the free edition. Premium, listed at $7 per host per month, adds remote lock and wipe, enforced disk encryption and OS updates, app deployment, zero-touch enrollment, host groups with their own settings, and CIS benchmark checks for macOS and Windows.
MySQL, Redis and TLS are required. Fleet needs MySQL 8.0.44 or later with a single writable primary; 9.6.0 is currently incompatible, and the FAQ advises against MariaDB. Redis 6.2 and 7 are tested, while Redis 8 and Valkey are known to work without being tested. Agents only connect over TLS. Fleet's own managed hosting is limited to deployments above 700 hosts.
Built for teams with thousands of computers, per the README. The docs put a single VPS at hundreds or even thousands of hosts and one Fleet server at tens of thousands, with MySQL usually the bottleneck. On the device side, support starts at macOS 15, iOS 17 and Android 14, and the only Windows client editions listed are Pro and Enterprise.
Pitched against Intune and Jamf Pro. The fleetdm.com homepage has comparison tables against both, plus Workspace ONE, Ivanti and PatchMyPC.
A minor release roughly every three weeks. Fifteen shipped in 2026, from 4.79.0 on January 14 to 4.93.0 on October 8. On October 4, the same SSO session fix went out on five release lines at once, 4.88 through 4.92. The latest version, 4.93.2, is dated October 21, 2026.