Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. The largest vendors in configuration management software
cannot hold places 1 to 3. Places 1 to 3 go to challengers, vendors outside the best-known brands in a category,
wherever the category has them; the established names follow from place 4 in their ranked order. How it works: placement disclosure ·
editorial process.
The 11 tools, reviewed
#1 Rudder
Configuration and security automation from Paris · France · rudder.io
Open source core Compliance EU vendor
Rudder takes first place because it is the only product in this list that treats drift reporting as the main screen rather than an add-on. Every node shows compliance against the rules assigned to it, the feature list includes change requests, and the open source Core is a real product rather than a demo.
- Pricing: Per node / year. Annual per-node license on Enterprise and Corporate Security Suite plans, quoted on request; Rudder Core is free; a one-time onboarding fee applies in year one. Free plan: open source.
- Best for: Linux fleets that must prove compliance
- Strengths: Continuous configuration enforcement; Node inventory; Patch campaigns.
Where it falls short
The Rudder community is small beside Ansible or Puppet, so fewer ready-made roles and fewer Stack Overflow answers exist for odd problems.
Wrong for
Teams that already write everything as Ansible playbooks in Git and want to keep it that way.
Visit Rudder →
#2 CFEngine
The original lightweight policy-based configuration agent · Norway · cfengine.com
Open source Lightweight agent Policy language
CFEngine ranks second because it does the core job with the least machinery. The core components, including the agent, are written in C and policy lives in its own .cf language, so the footprint on each host stays small. The Community Edition under GPL 3 covers Linux, and the commercial Enterprise Edition adds Windows, dashboards and a web interface.
- Pricing: Open source + paid tiers. Community Edition is free under an open source license; Enterprise Edition is commercial, quoted on request, with a free trial. Free plan: open source.
- Best for: Large Linux estates with tiny agent budgets
- Strengths: Promise-based policy language; Autonomous agents; Drift correction.
Where it falls short
The promise-based policy language is unlike YAML or Ruby and many engineers find it hard to read at first. The module catalogue and the pool of people who know it are small beside Ansible or Puppet, and hiring is harder.
Wrong for
Small teams that want to be productive on day one with a familiar syntax.
Visit CFEngine →
#3 Salt Project
Fast remote execution plus configuration states · United States · saltproject.io
Open source Remote execution Event-driven
Salt is third because it does two jobs most rivals split: it runs a command across a whole fleet in seconds and it enforces declarative states. Minions keep an open connection to the master over a ZeroMQ bus, so results arrive as they happen, and salt-ssh covers machines where no agent is allowed. States are written in YAML with Jinja templating, which most administrators can read.
- Pricing: Open source + paid tiers. Open source and free to use; paid support and the VMware-branded enterprise edition are sold through Broadcom, so check the current quote. Free plan: open source.
- Best for: Teams that need to run commands on thousands of machines
- Strengths: Master and minion model; Agentless salt-ssh; YAML states.
Where it falls short
Broadcom now sponsors the project, and Broadcom's record with VMware licensing leaves some buyers wary of the commercial edition.
Wrong for
Buyers who need a vendor-supported product with published prices today.
Visit Salt Project →
#4 Ansible
Agentless automation in readable YAML playbooks · United States · redhat.com
Agentless YAML playbooks Red Hat
Ansible is the default answer for most small teams, which is exactly why it sits fourth under the rule on dominant vendors. Nothing is installed on the managed machine beyond SSH and Python, playbooks are plain YAML, and ansible-core is GPL 3 and free. Red Hat adds the Automation Platform with a web controller, RBAC and support on Standard or Premium subscriptions.
- Pricing: Open source + paid tiers. Ansible core is free under GPL 3; Ansible Automation Platform is a Red Hat subscription with Standard and Premium support, quoted by sizing. Free plan: open source.
- Best for: Small teams that want to start today
- Strengths: Agentless over SSH; YAML playbooks; Large module library.
Where it falls short
Push-based runs do not correct drift between runs unless someone schedules them. YAML logic gets awkward in long playbooks, and the web controller, RBAC and support are paid Automation Platform features rather than part of the free core.
Wrong for
Fleets of tens of thousands of nodes needing continuous self-healing, or teams that want a compliance dashboard out of the box.
Visit Ansible →
#5 Puppet
Declarative desired-state automation for large fleets · United States · puppet.com
Desired state Agent-based Perforce
Puppet comes fifth because it still does model-driven configuration at scale as well as anyone. Agents report to a server, the commercial Enterprise edition adds a web console and role-based access control, and reports show what changed. Puppet Core, announced as the vendor-backed route for former open source users, includes SLA-backed CVE fixes and CIS and DISA STIG policy modules, with a free Developer license up to 25 nodes.
- Pricing: Quote only. Puppet Core Developer license is free up to 25 nodes; commercial Core and Puppet Enterprise are custom-quoted for larger fleets. Free plan: free plan.
- Best for: Mid-size to enterprise server estates
- Strengths: Declarative Puppet language; Agent and server; Puppet Forge modules.
Where it falls short
Puppet's own open source distribution has moved toward Puppet Core under a vendor license, which changes the cost picture for long-time free users. The Puppet language and server setup take real time to learn, and the commercial prices are not published.
Wrong for
Teams below about fifty servers or those who only want ad-hoc tasks.
Visit Puppet →
#6 Chef
Ruby-based policy-as-code with published node pricing · United States · chef.io
Policy-as-code Ruby DSL Progress
Chef is sixth because it is one of the few vendors that prints a price per node on its pricing page. Business is $59 per node per year and Enterprise $189, with unlimited user seats and a 99.9 percent uptime figure for the hosted option. Recipes are Ruby, so developers get real loops and testing. The Chef Infra repository is Apache 2.0 and still active.
- Pricing: Per node / year. Chef lists Business at $59 per node per year and Enterprise at $189; Enterprise Plus is quoted on request. Free plan: free trial.
- Best for: Developer-heavy teams with compliance checks
- Strengths: Chef Infra cookbooks; Chef 360 platform; Node management.
Where it falls short
Ruby cookbooks are harder for operations staff who do not write code, and the plan table shows the cheapest Business tier without compliance audit, continuous compliance or application delivery.
Wrong for
Admin teams without developers who would own the cookbooks.
Visit Chef →
#7 orcharhino
Supported Foreman-style lifecycle management from Germany · Germany · orcharhino.com
EU vendor Lifecycle Patch management
orcharhino is seventh and the best answer for European buyers who care where their vendor sits. ATIX, a stock corporation registered in Munich, sells one subscription covering provisioning, patches, content and configuration across virtual machines, bare metal, proxies, desktops and IoT. The vendor publishes whitepapers on digital sovereignty and vendor lock-in aimed at public-sector IT. The subscription includes every feature, with workshops and managed services as extras.
- Pricing: Quote only. Subscription with a 1 or 3 year contract, priced by number of primary servers and managed systems and by 9x5 or 24x7 service level. Free plan: none.
- Best for: German-speaking public-sector and industrial IT
- Strengths: Provisioning; Configuration management; Content management.
Where it falls short
The website does not publish prices or a free tier, and the site is built German-first. It sits above other tools rather than replacing them, so a team still needs to learn a configuration tool as well.
Wrong for
Small teams on one cloud who just need a script runner.
Visit orcharhino →
Open source Salt-based Linux
Uyuni is eighth because it gives a free graphical console on top of Salt for Linux patching and provisioning. The server is a full Salt master, so admins can reuse Salt states, while the web interface handles channels, errata, compliance audits and image builds. Since July 2018 it has been the upstream for SUSE Manager, and the 2026.10 release expanded management for SLES 16.1.
- Pricing: Open source. Free and open source under GPL 2; the commercial route is SUSE Multi-Linux Manager, priced by SUSE on request. Free plan: open source.
- Best for: Linux admins who want a free patch console
- Strengths: Salt master built in; Patch and errata management; Provisioning.
Where it falls short
Windows machines are not its focus, and community support has no response commitment. Releases arrive every couple of months, and the project asks users to read the release notes before upgrading.
Wrong for
Organizations that need a vendor SLA, Windows management, or a European contract. orcharhino or the commercial SUSE product fit; for pure automation, Ansible.
Visit Uyuni →
#9 AWX
The free web UI and API for Ansible · United States · github.com
Open source Ansible UI Job scheduling
AWX is ninth because it adds scheduling, credentials and RBAC to Ansible at no licence cost. It is the project Red Hat Ansible Automation Platform is built from, so skills and playbooks carry over if a team later buys support. Workflows chain job templates, inventories pull from cloud accounts, and the API drives it from CI. Installation goes through an install guide and the AWX Operator.
- Pricing: Open source. Free under the Apache 2.0 license; you supply the servers and the engineering time, and there is no vendor support. Free plan: open source.
- Best for: Ansible users who want a free job scheduler
- Strengths: Web UI; REST API; Job templates.
Where it falls short
The repository carries a caution that releases are paused during a large refactoring, and the last release was July 2, 2024. There is no support contract, and upgrades are your own work.
Wrong for
Anyone who needs production support or a stable upgrade path.
Visit AWX →
#10 Red Hat Satellite
Patch, provision and compliance manager for RHEL fleets · United States · redhat.com
Red Hat RHEL Patch staging
Satellite is tenth because it is a lifecycle manager for Red Hat Enterprise Linux rather than a general configuration tool. It curates repositories into Dev, QA and Production stages, verifies signatures, discovers bare metal and wires in DNS, DHCP and identity services. Release 6.20 is in limited availability and ships as containers on a fresh RHEL 10 install.
- Pricing: Quote only. Sold as a Red Hat subscription, quoted on request; the page lists no prices and says a subscription may be required. Free plan: none.
- Best for: Organizations standardized on Red Hat Enterprise Linux
- Strengths: Content views; Patch deployment; Bare-metal provisioning.
Where it falls short
It centers on Red Hat Enterprise Linux, so other distributions are second-class. The 6.20 release requires a fresh install of RHEL 10, pricing is not public, and the product is heavy for a few dozen servers.
Wrong for
Mixed-distribution or Windows-heavy estates, and teams below a hundred servers.
Visit Red Hat Satellite →
Provisioning Source-available IBM
Terraform is eleventh because it answers a different question: what should exist, not how a server is set up. It describes cloud networks, instances and databases in HCL, plans the changes and applies them through thousands of providers. HCP Terraform prices per managed resource, with a trial credit of $500.
- Pricing: Usage-based. HCP Terraform lists $0.10 per resource per month on Essentials, $0.47 on Standard and $0.99 on Premium; Enterprise is custom. Free plan: free trial.
- Best for: Teams building cloud resources from code
- Strengths: HCL configuration language; State management; Provider ecosystem.
Where it falls short
The code is under the Business Source License, which is source-available rather than open source, and the company is now part of IBM. It does not manage packages, files or services inside a running operating system in a continuous way. Costs scale with resource counts.
Wrong for
Buyers who need packages, users and services kept consistent on existing servers.
Visit Terraform →
Questions and answers
What is the best configuration management software in 2026?
Rudder ranks first of 11, best for linux fleets that must prove compliance. CFEngine is second (large Linux estates with tiny agent budgets) and Salt Project third (teams that need to run commands on thousands of machines). Places 1 to 3 go to challengers, vendors outside the best-known brands, wherever the category has them.
What is the difference between Ansible and Puppet?
Ansible pushes playbooks written in YAML over SSH and needs no agent, so a run happens when somebody starts it or a scheduler does.
Is there free configuration management software?
Yes. Ansible core, Salt, CFEngine Community, Rudder Core, Uyuni and AWX are open source and cost no licence fees. Puppet Core offers a free Developer license for up to 25 nodes.
Do I need an agent for configuration management?
Not always. Ansible and Salt's salt-ssh run agentless over SSH, which suits small fleets and network gear. Agent-based tools such as Puppet, Chef, CFEngine and Rudder keep enforcing policy between runs and report back, which suits audited estates.
What is configuration drift and how do I stop it?
Configuration drift is the gap between the state a machine should be in and the state it is in after manual edits, emergency fixes and half-finished updates.
Is Terraform a configuration management tool?
Not really. Terraform provisions cloud resources, such as networks, instances and databases, and tracks them in state. It does not keep packages, files and services consistent inside an operating system.
Which configuration management tool is best for Windows?
Windows support depends on the edition. Rudder Enterprise, CFEngine Enterprise, Puppet, Chef and orcharhino all list Windows management, and Ansible manages Windows over WinRM or SSH. Satellite and Uyuni focus on Linux.
What is the best alternative to Chef?
Puppet is the closest comparison, because both use agents and a server and both suit large estates. Ansible is the simpler alternative when your team prefers YAML to Ruby, and Rudder is better for compliance reports without code.
Can I self-host configuration management software in Europe?
Yes. Every product here except Terraform's hosted service can run on your own servers, and several have European vendors: Rudder in France, CFEngine's Northern.tech in Norway, orcharhino from ATIX and Uyuni in Germany.
How much does configuration management software cost per server?
Prices vary. Chef lists $59 per node per year for Business and $189 for Enterprise. Terraform's HCP service lists $0.10 to $0.99 per resource per month.
How long does it take to roll out configuration management?
An agentless pilot with Ansible can run within an hour on a handful of servers.
