Open Source Feature Flags - The Honest Self-Host Reality (2026)

“Open source” is the most abused phrase in the feature-flag market. Four tools claim it, and they mean four genuinely different things - from a tool you can run air-gapped in production to a tool whose own docs tell you not to self-host and that you assume all the risk if you do.

If you are evaluating open-source feature flags because you want data residency, no vendor lock-in, or protection against the wave of acquisitions hitting this space, the license on the box is not enough. You have to read the self-host reality underneath it. Here is the honest version for each of the four, and a plain note on the popular tools that are not open at all.

The short version

Tool	License	Genuinely self-hostable	The catch
Flagsmith	BSD-3-Clause	Yes, supported	Running the Django and Postgres stack is real DevOps work
GrowthBook	MIT core	Yes, unlimited users at $0	Needs an instrumented data warehouse to deliver value
Unleash	AGPL-3.0-or-later	Yes, incl. air-gapped	RBAC, SSO, SCIM all gated to paid Enterprise
PostHog	MIT	Officially unsupported	Docs say no guarantees, you assume all risk
LaunchDarkly	Closed (SDKs only)	No	Proprietary SaaS
Statsig	Closed (SDKs only)	No	Warehouse-native is not self-hosting
ConfigCat	Closed (SDKs MIT)	No	Backend is hosted SaaS
Optimizely	Closed (SDKs only)	No	Proprietary DXP

Flagsmith - the most transparent, and the cleanest self-host

Flagsmith is the tool to start with if open source and self-hosting are the point. The core platform is licensed BSD-3-Clause, one of the most permissive licenses there is, and the project’s stance is that core functionality stays open, always. The open-source build is not a crippled teaser either - it includes flags, remote config, segmentation, basic A/B testing, 15+ SDKs, and genuine self-hosting via Docker, Kubernetes/Helm, on-prem and air-gapped deployments. This is a real, supported self-host path, which is exactly the thing LaunchDarkly and Statsig structurally cannot offer.

It is also the most honest tool in the category on price - every core cloud tier is published (Free at $0, Start-Up at $40/mo annual, Scale-Up at $250/mo), so if you decide self-hosting is not worth the ops burden, the managed option is the cheapest paid entry here anyway. Flagsmith is bootstrapped, roughly 12 people, London-based, founded 2018 - so no acquisition roadmap risk, and because it is BSD-3, the code outlives the company regardless.

The honest catch. “Free and open source” hides a cost - running the Django and Postgres stack in production is real DevOps. It is more resource-intensive than the Node or Go alternatives, and third-party comparisons call it tricky to get right. And the exact list of features gated behind the paid Enterprise license is not fully published, so verify before assuming a specific enterprise feature is in the open build. For a team with DevOps capacity that wants no lock-in, it is the standout. For a small team without it, the cheap cloud tier is usually the better call.

GrowthBook - MIT, warehouse-native, and a real self-host

GrowthBook is the open-source pick when experimentation - not just toggling - is the reason you are here. The core is MIT-licensed, and the self-hosted open-source edition runs unlimited users at $0. What makes it different from the others is that it is warehouse-native: it queries the BigQuery, Snowflake or Databricks warehouse you already run rather than ingesting a copy of your events, so your analytics data never leaves your infrastructure. That is a genuine privacy and cost advantage for a self-hoster.

Underneath sits the deepest experimentation stats engine of the open-source flag tools - CUPED, sequential testing, Bayesian analysis, multi-arm bandits and SRM checks - across 24 SDKs. It was founded 2020, went through Y Combinator, and has a reported Series A of $22.6M from Khosla and Nexus.

The honest catch. Two things. First, the value assumes you already have a properly instrumented warehouse and someone who understands the statistics - no warehouse, far less value. Second, the license is not uniformly MIT: the bulk of the code is MIT, but several directories sit under a separate GrowthBook Enterprise License, and the visual editor, bandits, SSO and SCIM are gated to Enterprise. The self-host is real and free, but it is a data-team tool, not a plug-and-play toggle service.

Unleash - genuinely open, until you need SSO

Unleash is the mature self-host standard, and for good reason - an 11-year track record, roughly 13.7k GitHub stars, a G2 of 4.7 across 122 reviews, and an AGPL-3.0-or-later core that is a genuinely useful product rather than a demo. You get flag management, activation strategies, gradual rollouts, kill switches, canary, 25+ SDKs and Unleash Edge for low-latency evaluation. You can run it air-gapped, keep all your data, and never touch MAU pricing.

The honest catch, and it is the big one for open-source buyers. The free AGPL build is not the whole platform. RBAC, SSO/SAML, SCIM and extra environments are all gated to paid Enterprise tiers. A recurring review complaint is being surprised you cannot use SSO without moving to a paywall. There is also no read-only or viewer seat, so once product managers, designers or QA need access, every one of them is a paid seat ($75 each, 5-seat minimum on the paid tier). Unleash is genuinely free if you can live inside the OSS feature set - and it stops being free the instant your org requires enterprise access controls, which most do past a certain size. Know which side of that line you are on before you build on it.

One more note on the license itself: AGPL-3.0 is a copyleft license, stricter than BSD-3 or MIT. If you modify Unleash and offer it over a network, the AGPL’s network clause obliges you to make your changes available. For most teams self-hosting an unmodified build that is a non-issue, but it is worth knowing if you plan to fork it into a product.

PostHog - open source on paper, unsupported in practice

This is the one to be blunt about, because the marketing and the reality diverge. PostHog’s main product is open source under MIT, and self-hosting technically gives you the same product as Cloud. That sounds like a real open-source self-host story. It mostly is not.

PostHog officially does not recommend self-hosting, and self-hosted deployments are unsupported. Its own docs say it plainly - no guarantees, no tagged releases (you run the latest image), PostHog does not publish CVEs for self-host, and you “assume all responsibility and risk.” PostHog steers the vast majority of users to Cloud and says so openly. So if you are evaluating PostHog specifically because you need to self-host for data residency or compliance, be honest with yourself: this is a run-it-yourself-at-your-own-risk option, not a supported enterprise path the way Flagsmith or Unleash offer one.

None of that makes PostHog a bad product - as a flags-plus-analytics platform on Cloud it is genuinely strong, its flags are cheap (first 1M requests/mo free), and its experiments read straight from your product metrics. Just do not buy it for the self-host promise. For most teams the real product is PostHog Cloud, and the MIT license is more about transparency than a practical deployment target.

What is not open source at all

So readers know what they are giving up when they leave the open-source options, here are the popular tools that are proprietary SaaS. In each case the client SDKs are open source, but the platform - the part that stores, serves and manages your flags - is closed and cannot be self-hosted:

• LaunchDarkly - closed SaaS. Only the client SDKs are open. Enterprise gets a Relay Proxy, but there is no way to run the full platform yourself.
• Statsig - the SDKs are open on GitHub, but the platform is proprietary. Its “warehouse-native” Enterprise deployment runs compute on your Snowflake or BigQuery, which helps with data residency but is not self-hosting the application.
• ConfigCat - the SDKs are MIT-licensed, but the management dashboard and backend are hosted SaaS with no self-hostable server.
• Optimizely - proprietary SaaS. The SDKs are open and evaluate locally in-process, but the backend that manages your flags is closed.

If self-hosting or data residency is a hard line, these four are dealbreakers by definition, and the four open-source tools above are your field.

So which open-source tool should you pick?

The honest routing:

• You want the cleanest, most transparent open-source flags and have DevOps capacity - Flagsmith (BSD-3). The most permissive license and the most honest vendor.
• You want rigorous experimentation on your own data and have a warehouse - GrowthBook (MIT). Unlimited users at $0 self-hosted.
• You want the mature self-host standard and can live without SSO on the free tier - Unleash (AGPL-3.0). Just price Enterprise before you need access controls.
• You want analytics and flags together and are happy on Cloud - PostHog (MIT), knowing the self-host path is unsupported.

The deeper reason open source matters here is protection. This category is consolidating fast - four notable acquisitions and rebrands in under two years - and a permissive license is the one thing that guarantees a bad ownership outcome still leaves you with a product you control. On that test, Flagsmith and GrowthBook come out strongest, because they pair a genuine self-host with a permissive license and no acquisition overhang. Every license and figure here was verified against each vendor’s materials on 23 July 2026 and links back to our full tool reviews.