Device Management

osquery23.5k★

osquery turns an operating system into a database you can query with SQL. Running processes, open sockets, installed packages, kernel modules, browser extensions: all of it becomes a table. Facebook built it, the Linux Foundation stewards it now, and it is free under a dual Apache-2.0 or GPL-2.0 grant. It is an agent with no server, which is both the point and the limitation. You get a daemon on each host that answers queries and can log scheduled results, but you supply the infrastructure to collect those results and act on them. Fleet exists specifically to be that layer. Security and IT teams reach for it for the same reason: one query language across macOS, Windows and Linux beats maintaining three separate tools. Solo: interesting, rarely necessary. Large teams: this is close to table stakes for endpoint visibility. The catch is that osquery answers questions and fixes nothing. No remediation, no policy enforcement, no console. Budget for the pipeline around it, or run Fleet and let someone else have built it.

MeshCentral7.0k★

MeshCentral gives you remote desktop, terminal and file transfer to machines anywhere, through a browser, on a server you control. It is the open source answer to commercial RMM suites, and the feature list sits closer to them than the price suggests. Apache 2.0, completely free, no paid edition and no per-device charge. Node.js server with agents for Windows, macOS and Linux. Setup is a Node install plus certificate configuration, and the documentation is thorough in a way that reflects a maintainer who has been at this for years. Commercial RMM tools bill per endpoint per month and those invoices scale badly. Solo operators and small teams supporting machines remotely: this removes a real line item. Large teams: workable, but confirm the audit and access-logging features match your compliance requirements. The catch is that you are now running remote-access infrastructure exposed to the internet. That is a security obligation, not merely an ops one. Get TLS, authentication and device-group permissions right before pointing it at anything that matters.

Fleet6.7k★

Fleet manages laptops, servers and phones through osquery, which means you query your fleet with SQL instead of clicking through a console. Apple, Windows, Linux, iOS, Android and ChromeOS are all covered, and the free tier includes working MDM rather than a demo. Self-hosting is Go with MySQL and Redis. It scales to very large fleets and the documentation is unusually good, but expect a real deployment project rather than an afternoon. Fleet Premium is $7 per host per month and moves a lot behind that line: zero-touch setup, BYOD enrollment, script execution, vulnerability scanning with EPSS and CVSS scoring, file integrity monitoring, role-based access control and audit logging. The split is fair. Visibility and inventory stay free, compliance and remediation cost money. At 500 devices Premium runs $42,000 a year, so do the arithmetic before assuming it is cheap. The catch is the license. Fleet is MIT except the ee/ directory, which is proprietary, and the client-side JavaScript carries its own terms. Open core, not uniformly open source, and that boundary matters if you intend to modify it.

MicroMDM2.7k★

MicroMDM is an Apple MDM server you run yourself, and it is the main open source entry point against Jamf. It speaks Apple's MDM protocol directly: enrollment, commands, profile installation, DEP and VPP handling, all exposed through an API. Go, MIT licensed, free with no commercial tier. The tradeoff is immediate. Jamf sells a polished console, a support contract and an integration catalog. MicroMDM gives you a correct protocol implementation and expects you to build the workflow around it. That suits teams with engineers who would rather script device management than click through it. Solo and small teams: without existing Apple fleet expertise, Jamf or Fleet will cost less in hours than this costs in hours. Large teams with platform engineers: real control and no per-device invoice. The catch is keeping pace. Apple changes MDM behaviour with every major macOS release, and tracking that is an ongoing commitment. Check recent commit activity against the current macOS version before betting a fleet on it.

Uyuni573★

Uyuni handles the unglamorous half of infrastructure work: patching, configuration and lifecycle management across a Linux estate. It is the upstream of SUSE Multi-Linux Manager, so this is enterprise systems management with the badge removed, not a weekend project. GPL-2.0 and free. It manages SUSE, Red Hat, Debian, Ubuntu and openSUSE clients, handles content staging, and owns the software channels your servers pull packages from. Java underneath, and a substantial install that wants a dedicated server rather than a container on a laptop. Solo and small teams: far too much machinery for the problem. Medium and large teams running dozens or hundreds of Linux hosts under a compliance requirement: this is the free version of something companies pay real money for. The catch is weight. Uyuni is heavy to install, heavy to operate, and its documentation quietly assumes you already speak SUSE. Ansible or Foreman will get a smaller estate patched for a fraction of the setup cost.