Category: Device management
Managed Fleet: open source MDM with inventory and patching on your own server
Know which laptops you have, what they have installed, which are behind on updates and which fall short of the basics, from an open source dashboard running on your own server.
- Where it runs
- In your account, in your name
- Backups
- With tested restores
- Updates
- Planned and documented
- Licence
- Free version under MIT; Fleet Premium features under a commercial licence
In short
Fleet is an open source platform for managing Windows, Mac and Linux computers, as well as phones and Chromebooks. Its agent, fleetd, is built on osquery: it inventories hardware and software, flags programs with known vulnerabilities and checks policies. We set it up on your server, roll out the agent, write the policies as code and keep it up to date.
Or call us on 644 00 76 20
What do we take care of?
Once you have more than a handful of laptops, nobody knows offhand which ones have an encrypted disk, which have gone months without updates or who has installed what. Fleet answers those questions with data from each computer. For it to be useful, the agent has to reach every computer, someone has to decide what gets checked and someone has to look at the results.
Server
Fleet, MySQL and Redis sized correctly, with a TLS certificate, backups and updates.
Agents
fleetd on every computer, tracking the ones that stop reporting and enrolling new ones.
Inventory
Hardware, operating system and programs on each computer, searchable and exportable.
Policies
Yes-or-no questions about each computer, with the list of those that fail.
Vulnerabilities
Installed programs with known vulnerabilities (CVEs), computer by computer.
GitOps
Policies, queries, scripts and profiles in a repository, applied with fleetctl.
What is in the free version and what is not?
The free version covers what a small business or a software company needs most: knowing what is there and what does not comply. Anything that makes computers do something on their own, such as encrypting the disk or installing OS updates, is in Fleet Premium.
| Need | Free version (MIT) | Fleet Premium |
|---|---|---|
| Hardware and software inventory | Yes | Yes |
| Software with known vulnerabilities (CVEs) | Yes | Yes, with EPSS and CVSS scores and the CISA KEV catalogue |
| Policies and scripts | Yes | Yes |
| Configuration profiles on Mac and Windows | Yes | Yes |
| Enforce disk encryption and escrow the keys | No | Yes (FileVault, BitLocker and LUKS) |
| Enforce OS updates | No | Yes |
| Install applications and remotely lock or wipe a computer | No | Yes |
| Roles per group of computers and the dashboard’s own two-factor login | No | Yes |
With the free version, disk encryption and updates can be checked with policies and fixed with scripts; what it does not do is enforce them. For two-factor authentication on the dashboard, the usual approach is to log in with the company’s single sign-on, which is included in the free version.
What problems do we find most often?
- Agents that stop reporting: computers that leave the office and cannot reach the server, or an agent uninstalled without anyone noticing.
- Expired Apple certificate: if it is not renewed in time, or is renewed with a different Apple account, Macs stop receiving MDM commands.
- Policies nobody looks at: the dashboard stays red for weeks because failures do not reach anyone.
- Changes made by hand in the dashboard: nobody knows who changed a policy or why.
- Database with no backup: if MySQL is lost, so are the inventory and the MDM configuration.
When does it not make sense?
With three or four computers, an inventory in a spreadsheet and a regular check are usually enough, and running one more server does not pay off. If you already pay for Microsoft 365 with Intune and every computer runs Windows, it is worth using that before adding another tool. And if what you are after is detecting attacks rather than taking inventory, a SIEM such as Wazuh is a better fit. Fleet pays off when you have computers on several operating systems, when you are asked for evidence that they meet certain rules, or when you want the data on your own server.
How do we handle backups and updates?
All of Fleet’s information lives in MySQL, so we back it up off the server every day and run test restores. The configuration is also in the repository with GitOps, so it can be rebuilt. We update the Fleet server following its release notes, after backing up the database, and let the fleetd agent update itself, which is how it comes configured. The Apple certificate is renewed with the same company account before it expires.
What does day-to-day support look like?
In an office, Fleet is part of our IT support for small businesses: we use it to see which computers are behind and fix them. In a software company, the software inventory of the team’s laptops complements the platform’s vulnerability management. Either way, each month you get the state of your computers: those failing a policy, those with vulnerable software and what has been fixed. We go into more detail in the guide to managing computers with Fleet.
- fleetdAgent with osquery on each computer
- FleetServer, dashboard and API
- MySQLInventory, policies and configuration
- RedisQueues and cache
Where do we set it up?
In your account, with the provider you already use or the one that fits best. If the data has to stay in the EU, Hetzner and OVHcloud are the European options.
Providers we set it up on
- Hetzner
- AWS
- Google Cloud
- Own server
| Provider | How we set it up | Things to bear in mind |
|---|---|---|
| Hetzner | A cloud server with Fleet, MySQL and Redis, or MySQL on a second server, with backups to Object Storage. | Enough for the computers of a small business or a mid-sized software company. |
| AWS | Fleet in containers with RDS for MySQL and ElastiCache for Redis; Fleet publishes a Terraform guide for AWS. | |
| Google Cloud | Fleet in containers or on a virtual machine, with Cloud SQL for MySQL and Memorystore for Redis. | |
| Own server | Fleet, MySQL and Redis on your server or a virtual machine, published with a valid TLS certificate. | Computers must be able to reach the server from outside the office; otherwise they stop reporting when people take them home. |
What is included
- Fleet on your server or in your cloud account, with MySQL, Redis and a TLS certificate, and the dashboard behind a VPN or single sign-on.
- The fleetd agent installed on your Windows, Mac and Linux computers, with the installers kept for new starters.
- An up-to-date inventory of computers and software, flagging programs with known vulnerabilities.
- Yes-or-no policies (encrypted disk, firewall on, system up to date, screen lock) with the computers that fail them.
- Scripts to fix the usual issues on a computer without the user having to do anything.
- Mac and Windows MDM when needed: the Apple certificate, configuration profiles and their yearly renewal.
- Configuration in a repository with GitOps, so every change is reviewed and can be rolled back.
- Database backups with tested restores, and updates to the server and the agent.
Frequently asked questions
Is Fleet free?
The free version is MIT-licensed and you can use it without paying the vendor anything: inventory, policies, scripts, vulnerable software detection, configuration profiles and GitOps. Some features, such as enforcing disk encryption or OS updates, installing applications, or remotely locking and wiping a computer, are part of Fleet Premium, which is paid to the vendor per number of computers. We tell you beforehand what you actually need.
What does Fleet see about each person?
Computer data: hardware, operating system, installed programs, configuration and policy results. Fleet states in its documentation that it does not collect keystrokes, emails or webcam footage. Even so, it is worth telling your team what is collected and why, and we put it in writing.
Does it work for Macs?
Yes. To use it as an MDM for Macs, iPhones and iPads, Fleet has to be connected to the Apple push notification service with a certificate that is renewed every year, always with the same Apple account. We put it in the company's name and add the renewal to the calendar.
Do we need Intune or Microsoft Entra ID for Windows computers?
Not necessarily. Fleet can enrol Windows computers in its MDM through its own agent, without Intune. Only if you want automatic enrolment with Entra or Autopilot do you need Fleet Premium and a Microsoft Entra ID P1 licence per user.
Does Fleet replace an antivirus or Wazuh?
No. Fleet is for knowing the state of your computers and fixing them: inventory, patching, configuration and policies. Threat detection and event collection are something else; if you need them, we set them up with Wazuh.
Tell us about your case
Call or write to us and we'll tell you where you stand and where to start. Free, no strings attached.
Or call us on 644 00 76 20
Official documentation consulted
The technical details on this page are based on:
Reviewed on