HashiCorp moved Vault from the OSI-approved MPL 2.0 license to the Business Source License in 2023, and after IBM's 2025 acquisition, Vault Enterprise pricing has climbed 10-15% annually while production-grade auto-unseal still requires a paid cloud KMS or physical HSM. CyberArk Conjur's enterprise tier compounds the same problem from a different angle, billing per authenticating workload identity — a number that multiplies fast once a Kubernetes cluster running 50 microservices starts counting every pod that calls the API. Self-hosting OpenBao gives you the same Vault API and secrets engines under Linux Foundation governance and a genuine MPL-2.0 license, so existing Terraform and Vault provider code runs unmodified against your own Postgres or Raft storage backend. SOPS goes further and removes the server entirely — secrets are encrypted with age or KMS keys and committed straight into your Git repo, decrypted only at deploy time by Flux or ArgoCD — while the External Secrets Operator syncs whichever backend you choose into native Kubernetes Secret objects via its own SecretStore and ExternalSecret CRDs.
| Name | Main Category | Sub-Category | Target Alternative | Free Tier Summary | Self-Hostable? | Short Description | Primary Link |
|---|---|---|---|---|---|---|---|
External Secrets Operator | DevOps & Application Hosting | Kubernetes Secrets Sync | AWS Secrets Manager / Vault (as a sync layer) | 100% Free - Self-Hosted (Apache-2.0, CNCF Sandbox project) | Yes - Kubernetes | Kubernetes operator that syncs secrets from 45+ external backends into native Kubernetes Secret objects via SecretStore and ExternalSecret CRDs, keeping workloads decoupled from any single vendor's SDK. | |
OpenBao | DevOps & Application Hosting | Secrets Management / Vault Fork | HashiCorp Vault (BSL) / CyberArk Conjur | 100% Free - Self-Hosted (MPL-2.0, Linux Foundation governed) | Yes - Docker | API-compatible, community-governed fork of Vault's last MPL-licensed release, giving teams the same secrets engines, auth methods, and Terraform provider without HashiCorp's Business Source License restrictions. | |
Infisical | DevOps & Application Hosting | Secrets Management & Environment Config | Doppler / HashiCorp Vault / AWS Secrets Manager | 100% Free - Self-Hosted (MIT core; SSO and dynamic-secrets-at-scale gated to paid tier) | Yes - Docker | Developer-focused secrets manager with a CLI, Kubernetes Operator, and built-in secret scanning; self-hosts on a simple Postgres-plus-Redis Docker Compose stack instead of a Raft cluster. | |
SOPS (Secrets OPerationS) | DevOps & Application Hosting | GitOps-Native Encrypted Secrets | AWS Secrets Manager / Doppler | 100% Free - Self-Hosted (MPL-2.0, CNCF Sandbox project) | Yes - Binary | Encrypts individual values inside YAML, JSON, ENV, and INI files using age, PGP, or cloud KMS keys, so encrypted secrets can be committed straight to Git and decrypted only at deploy time by Flux or ArgoCD, with no server to run. | |
CyberArk Conjur Open Source | DevOps & Application Hosting | Machine Identity & Policy-as-Code Secrets | CyberArk Conjur Cloud / HashiCorp Vault Enterprise | 100% Free - Self-Hosted (LGPL-3.0 server; Apache-2.0 API clients) | Yes - Docker | Runs as a Docker container backed by PostgreSQL, using a YAML policy language to define RBAC and machine-identity authentication for containerized and CI/CD workloads without Conjur Cloud's per-workload pricing. |
Stape bills per request once you outgrow its free tier. These open-source tag managers give you server-side tracking on infrastructure you control.
Typeform caps your responses and Qualtrics hides pricing behind a sales call — these self-hosted tools skip both.
Datadog and Checkly bill per test run across every check and location. These self-hosted tools give you unlimited synthetic checks instead.
Open-source RUM tools with session replay, JS error tracking, and Core Web Vitals — no per-session billing or vendor data caps.
Atlassian is retiring Opsgenie and Grafana archived its OSS on-call tool. Here are five self-hosted platforms that still page, escalate, and route alerts.
Self-hosted, open-source CDPs that replace Segment and mParticle's per-MTU pricing with Docker-deployable event routing and raw data ownership.
Five self-hosted platforms that track visitors without cookies or consent banners, replacing Google Analytics and Adobe Analytics for GDPR-first teams.
Four open-source platforms replicate Mixpanel and Amplitude's event funnels and retention cohorts without per-tracked-user billing spikes.
RDS and Cloud SQL restrict superuser access and bill per GB for IOPS and backups. These self-hosted platforms give you both back.
Neo4j Aura's per-GB pricing and node caps get expensive fast. These self-hosted graph databases handle the same Cypher queries and knowledge graphs for free.
Escape Hasura Cloud's per-hour and per-GB billing with open-source engines that turn any Postgres schema into a live GraphQL or REST API.
Airtable's per-seat pricing adds up fast. These open-source, self-hosted tools give you the same grid-and-view interface on a database you actually own.