Fleet combines MDM and osquery in one control plane
Fleet manages inventory, policies, scripts, software, patches, and device enrollment from a web interface, REST API, fleetctl, or GitOps files. The server speaks to Fleet's agent and native MDM channels, while osquery supplies detailed operating-system data. Linux, macOS, Windows, ChromeOS, iOS, and Android appear in the supported platform list, along with cloud and container workloads. That breadth is the reason to consider Fleet. It is also why replacing a small inventory script with Fleet can become an infrastructure project.
The repository splits that breadth across a Go server, a React and TypeScript interface, command-line tools, agent code, installers, schemas, Terraform, Helm charts, and enterprise code. Our checkout contained 20,224 files and about 1,814,450 source lines before dependencies. Fleet can be modular in use, but contributors still encounter one large monorepo. Teams should choose the jobs they intend to run, then test those specific device and server paths instead of treating one green command as coverage for the whole platform.
What happened when we ran it
Our sandbox installed 1,493 Yarn packages in 85 seconds and left 893 MB on disk. The root package exposed no build script or target, so the lab skipped that step. Its available tests completed successfully in 209 seconds. The run used commit 690894b, 3 CPUs, 8 GB of RAM, a Node 22 image, an unprivileged container, and no secrets. No test count was supplied, so a more precise pass total would be invented.
The 594 MB checkout had 107 CI workflow files, a Compose file, and no top-level tests directory. Those signals fit a project whose checks live in several subsystems rather than one folder. The successful command covered the available Node test path. Fleet's own testing guide separately documents Go unit tests, MySQL and Redis integration tests, S3 and SAML options, external-network checks, browser tests, and hands-on MDM flows. We did not run those suites in this lab measurement.
The 893 MB Node install is only one development layer
A full source build uses make deps, code generation, frontend bundling, and Go compilation. The build guide requires Go, GNU Make, Yarn, and Node 24.10.0. Our Node 22 image still installed dependencies and completed the measured tests, but that does not make Node 22 a supported contributor setup. There was no root build script for the generic Node harness to invoke. Fleet's documented build entry point is Make, which produces the fleet and fleetctl binaries.
Local development also starts a collection of services through Docker Compose. The repository defines MySQL, test and replica databases, Redis, S3-compatible storage, mail servers, a SAML identity provider, and LocalStack. Developers can run a smaller subset, yet database migrations and Redis remain part of a working server path. MDM development adds a Fleet server private key. This is well documented, but the 85-second package install is the first step rather than a complete local instance.
Production requires MySQL, Redis, and TLS
Fleet's reference architecture names 3 infrastructure dependencies: MySQL, Redis, and a TLS certificate. MySQL stores the main application state; Redis queues distributed-query results and caches data. Agents must connect over TLS with a certificate matching the hostname. The current guide requires at least MySQL 8.0.44, explicitly rejects MySQL 9.6.0, and supports a single writable primary with read replicas instead of multi-writer or group-replication setups.
Production work extends beyond getting the server to listen. Operators need database and object-storage backups, upgrade rehearsals, secret rotation, monitoring, capacity planning, and a recovery plan for device enrollment. Apple and Windows MDM add vendor certificates, tokens, and external service behavior. Open issue 50909 is a useful warning: a failed Apple VPP application install was reported to leave setup waiting for roughly 34 hours without an automatic retry, until an administrator intervened. Test the enrollment path with the software and policies users will actually receive.
Free and premium code have different production rights
Most code outside ee/ is available under MIT terms, while documentation uses CC BY-SA and third-party components keep their own licenses. The enterprise directory carries a separate license. It allows development and testing, but production use requires a valid Fleet Enterprise subscription for the correct host count. The root license spells out that directory boundary, so a public Git checkout does not make every server feature free for production.
The product boundary matters as much as the legal text. Fleet's release QA tracks free and premium behavior separately, and the deployment guide expects a license key for premium features. Before migration, map every required workflow to the current free or paid tier. Device enrollment, disk encryption, operating-system updates, identity-provider provisioning, and setup experiences can sit on different sides of that line. Buying or self-hosting first and sorting entitlements later is an expensive way to discover the split.
Version 4.91.1 shows active maintenance and real complexity
GitHub recorded a push on September 18, 2026, eight days after v4.91.1 was published. The repository had 6,880 stars and 3,631 combined open issues and pull requests when fetched. That count includes product work and pull requests, so it should not be read as 3,631 unresolved bugs. A live 4.92.0 QA issue was being updated the same day, with separate manual checks for core, Apple, Windows, Android, and premium behavior.
The latest patch release fixed timeouts around large software-install histories, a stuck host-activity queue, misleading host deletion after Apple Business release, and a SCIM membership-removal failure. These are mature-product bugs: they sit at the boundaries between Fleet, databases, identity providers, and vendor services. Fleet is the right choice when one team can own those boundaries and values a common device model. For a single endpoint job, osquery, Wazuh, or Velociraptor asks for less infrastructure and exposes a smaller failure surface.