28 tools this month, spanning containers, infrastructure as code, observability, networking, backups, the homelab, cloud cost and scheduling: the usual defaults sitting next to this cycle's forks, rewrites and relicensed replacements.
No background daemon, no root requirement by default — just a CLI binary that happens to speak the same commands as Docker. Podman 6.0 landed in July 2026 and ripped out the old CNI/slirp4netns networking stack in favor of Netavark and Pasta, plus AMD GPU passthrough. One binary per host, nothing clustered, agentless by design. Pricing: free, open source (Apache-2.0).
Still the thing homelabbers and edge deployments reach for when they want real Kubernetes without the real Kubernetes footprint. The whole stack — containerd, Flannel, CoreDNS, Traefik — ships inside one binary under 100MB, with that same binary running as either server or agent across a multi-node cluster. The latest release, 1.37.1+k3s1, tracks upstream Kubernetes 1.37 as of September 2026. Pricing: free, open source (Apache-2.0); Rancher/SUSE sells optional paid support.
There's no shell to log into. Talos is an immutable OS built only to run Kubernetes, managed entirely through an API over gRPC. September's 1.14 release added a native BGP speaker, DNS-over-TLS/HTTPS, and declarative RAID/LVM volumes, enough that Sidero is treating it as a real feature release rather than a patch train. It needs a full cluster of control-plane and worker nodes; management itself stays agentless since talosctl talks straight to each node's API. Pricing: free, open source (MPL-2.0); Sidero Labs sells an optional paid fleet-management layer called Omni.
When Canonical pulled LXD in-house, the original development team forked it into Incus and kept it under Apache-2.0 with no CLA. It's now the one to use if you want system containers and VMs without Canonical's terms attached. It runs as a per-host daemon with optional multi-host clustering; LXC guests need no in-guest agent, though VMs can run one for exec and file operations. The 7.0 LTS line, out since May 2026, is supported through 2031. Pricing: free, open source (Apache-2.0).
HashiCorp's Business Source License on Terraform turned a free tool into a licensing question, and OpenTofu is the Linux Foundation-governed answer: a drop-in fork that's since pulled ahead with state encryption, the -exclude flag, and early variable evaluation that the Terraform OSS binary still lacks. It's one static binary, agentless, pull-config and push-apply like its parent. Pricing: free, open source (MPL-2.0).
No daemon to install on the target, no agent to keep patched. Ansible pushes YAML playbooks over plain SSH or WinRM, which is most of why it's stayed the default glue for config management for over a decade. Red Hat sells an Automation Platform on top (a controller, a hub, a subscription), but ansible-core itself has never charged for a feature. Pricing: free, open source (GPL-3.0-or-later); paid Red Hat/IBM platform available separately.
The same relicensing story that produced OpenTofu also produced OpenBao, forked from Vault's last MPL release. In October it patched a remote-code-execution chain days before Vault's own fix shipped, which is as clean a case as you'll get for "the fork is now ahead." It's a clustered server with a Raft backend handling dynamic secrets, PKI, and policy-as-code; applications call its API rather than running anything locally. Pricing: free, open source (MPL-2.0).
Most IaC tools run once and walk away; Crossplane's controllers stay running inside the cluster, continuously reconciling declared state against whatever the cloud actually looks like, so drift correction happens automatically instead of on a schedule you remember to re-run. CNCF graduated the project in October 2025, and Crossplane 2.0 extended its compositions to manage ordinary Kubernetes resources alongside cloud infrastructure. Pricing: free, open source (Apache-2.0).
Still the default metrics database for anyone self-hosting monitoring: one Go binary scraping /metrics endpoints, pull-based and agentless for anything that exposes them, though you'll still run node_exporter or cAdvisor as agents to get host and container numbers in the first place. When one binary stops being enough, Thanos or Mimir take over the cluster-scale job. Pricing: free, open source (Apache-2.0).
Grafana donated what used to be called Beyla to the CNCF in 2025, and the project, now going by OBI, hit beta at KubeCon EU in April 2026. It hooks into running binaries and the network stack via eBPF to emit HTTP, gRPC, and database traces with zero code changes and no SDKs to wire in. It runs as an agent, one per host or pod, and it's still pre-1.0, so expect breaking changes between minor releases. Pricing: free, open source (Apache-2.0).
Pitched directly at ELK and Loki's resource bills, VictoriaLogs claims up to 30x less RAM and 15x less disk for the same log volume. It runs as a single zero-config binary small enough for a Raspberry Pi, scaling out to a storage/select/insert cluster only once you actually need one. It doesn't ship its own collector — point Filebeat, Fluent Bit, Vector, or plain OTLP at it. Pricing: free, open source (Apache-2.0); a paid Enterprise build adds extra features on top.
The self-hosted status page homelabbers default to, and it's kept shipping: version 2.0 reworked the data model and added a MariaDB backend, 2.1 brought multi-region probes through Globalping, and August's 2.5 added NTP monitoring. One container polls your HTTP, TCP, DNS, and ping targets and fires off alerts through more than 90 integrations, with no agents on the monitored side. Pricing: free, open source (MIT).
Automatic HTTPS was Caddy's whole pitch when it launched, and it's still the reason people pick it over nginx for a reverse proxy: point it at a domain and it handles Let's Encrypt or ZeroSSL certificates without you ever touching certbot. One static Go binary, no dependencies, agentless, fine running standalone or in front of a whole fleet. Pricing: free, open source (Apache-2.0); paid commercial support available separately through Ardan Labs.
Built on WireGuard, Pangolin bundles a zero-trust reverse proxy, VPN, and privileged access manager, and since its August 2026 release it added browser-based RDP/VNC/SSH and an AI gateway for routing requests to OpenAI, Anthropic, Ollama, or vLLM. It needs a central server plus site-connector agents on each protected network, not a single binary. The Community Edition is free under a dual AGPL and commercial license, but that free-for-commercial-use window closes once a business clears $100K in annual revenue. Pricing: free self-hosted up to $100K/yr revenue (AGPL-3 + commercial license); paid Enterprise and Cloud tiers above that.
Headscale reimplements Tailscale's control server so your WireGuard key exchange never routes through Tailscale's own cloud — one binary, no required external database, talking to the exact same Tailscale client agents your devices already run. A release two days before this was written, 0.29.5, fixed exit-node steering and SSH checks, so the project is still moving fast despite being the established pick here. Pricing: free, open source (BSD-3-Clause).
A peer-to-peer WireGuard mesh with identity-based access control baked in — SSO, MFA, posture checks — rather than bolted on afterward. Mid-2026 it added Rosenpass post-quantum key exchange on top of WireGuard, the first mesh VPN in wide use to ship that, and a built-in reverse-proxy "Funnel" equivalent arrived in February. Clients run as agents on every device; the self-hosted management, signal, and relay service is AGPLv3, while the client code stays BSD-3. Pricing: free self-hosted (split BSD-3/AGPLv3 license); paid NetBird Cloud hosted option available.
The usual answer to "what do I actually run for backups": one dependency-free binary, encrypted and deduplicated by default, driven by cron or a systemd timer rather than any daemon. It backs up to local disk, SFTP, S3, B2, Azure, or GCS, and restic check plus restic restore exist specifically so you find out your backups don't work on a quiet Tuesday instead of during an actual outage. Pricing: free, open source (BSD-2-Clause).
The CNCF's answer for backing up a Kubernetes cluster's resources and persistent volumes. It needs the cluster to run in rather than a standalone binary, since the backup logic lives in controllers and CRDs inside it. Kopia has now replaced Restic as Velero's default file-system uploader, with the Restic path heading toward deprecation. Pricing: free, open source (Apache-2.0).
Encrypted, deduplicated, cross-platform snapshotting with a CLI and an optional GUI — one binary, no agent, backing up to the same range of object stores restic does. Its growing use as Velero's default uploader is the clearest sign it's winning the backend fight, though a May 2026 release restricted unauthenticated server access to loopback only, and a June patch fixed a race condition the maintainers flagged as a genuine data-loss risk. Pricing: free, open source (Apache-2.0).
The default home-automation hub for anyone who wants local control without a cloud account standing between them and their own lights. It runs as a dedicated OS image, a Docker container, or a plain Python install — a Raspberry Pi handles it fine. Monthly releases (2026.10.1 landed October 10th) keep integrations current without ever gating a feature behind a paywall. Pricing: free, open source (Apache-2.0); optional paid Nabu Casa Cloud add-on for remote access.
A Rust reimplementation of the Bitwarden server, built for people who want a real Bitwarden-compatible vault without running the official server's resource footprint. One Docker container is the entire deployment; your phone and browser just run the normal Bitwarden apps against it. It's unofficial and says so — back up your own vault, because the maintainers are explicit that they won't be liable if you don't. Pricing: free, open source (AGPL-3.0).
The self-hosted swap for Google Photos, with face and object search powered by its own ML pipeline and automatic backup from a free mobile app. July's 3.0 release swapped the vector database backend from pgvecto.rs to VectorChord, added non-destructive mobile editing, and previewed a drag-and-drop workflow builder: a real major version, not a version bump for its own sake. It runs as a Docker Compose stack of Postgres, Redis, the server, and the ML service. Pricing: free, open source (AGPL-3.0); optional one-time lifetime license purchase ($24.99 individual, $99.99 server) supports development without unlocking anything extra.
Kubecost spun its cost-allocation engine out as a CNCF project, and OpenCost is what's left once you strip the commercial SaaS wrapper away: deploy it in-cluster via Helm, point it at Prometheus, and it exposes a cost API with no license fee attached. August's 1.121.0 added per-token cost tracking for Kubernetes inference workloads, which says something about what people are running in these clusters now. Pricing: free, open source (Apache-2.0).
Runs terraform show -json through a pricing engine covering over 1,100 resource types across AWS, Azure, and GCP, so a cost estimate shows up in your pull request before anything gets applied. The CLI is one binary and free forever; the optional Infracost Cloud dashboard caps its free tier at 1,000 CI runs a month before the $250/mo Starter plan kicks in. Pricing: free CLI, open source (Apache-2.0); Infracost Cloud free up to 1,000 runs/month, paid from $250/mo.
Instead of managing autoscaling groups, Karpenter watches for unschedulable pods and provisions right-sized nodes directly against the cloud API, including Spot, with native interruption handling and fallback to on-demand. It runs as an in-cluster controller on an existing EKS cluster rather than a separate fleet of anything, and it just shipped 1.15.0 on October 10th. Pricing: free, open source (Apache-2.0); you pay only for the EC2 capacity it provisions.
Rundeck has been the job-scheduling and runbook-automation console ops teams reach for well over a decade now: a web console, CLI, and REST API sitting on a server install that talks to targets agentlessly via SSH or WinRM. PagerDuty sells an enterprise tier with clustering and HA on top, but the community edition stays free for small-scale, self-service use. Pricing: free, open source (Apache-2.0); paid PagerDuty Runbook Automation enterprise tier from roughly $125/user/month.
Event-driven automation with over 6,000 actions across 160+ integration packs, plus ChatOps for triggering and reviewing remediations from Slack or similar — people call it "IFTTT for ops" for a reason. It's a microservices stack talking over a message bus, so you're standing up several components rather than one binary, but nothing needs installing on the systems it acts against. Pricing: free, open source (Apache-2.0); a paid Enterprise Edition adds certified integrations and SLAs.
Built by Cronicle's original creator as its successor, xyOps runs on a central conductor plus lightweight "xySat" workers that don't even need Node.js installed. One Docker container is enough to try it, and multiple conductors can cluster for production or air-gapped setups. It can import existing Cronicle jobs and plugins directly, and the project commits in writing to a permanently free tier with no telemetry. Pricing: free, open source (BSD-3-Clause); optional paid support tier ($1,000/mo or $10k/yr) buys SLAs, not features.