🩺 Vitals
- 🟢 Last active: 2026-10-08
- 📦 Latest release: 4.23.0.0 (2026-09-02)
- 🐞 Open issues: 1147
- 🌟 Stars: 3.1k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: cloudstack.apache.org
- Source: github.com/apache/cloudstack
- License: Apache 2.0
- Deployment: Native (On-Prem)
- Data Model: MySQL (management server); NFS, Ceph, and other primary/secondary storage backends
- Jurisdiction: United States 🇺🇸 (Apache Software Foundation)
- Compliance (SaaS): N/A
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Very High (5/5) - Multi-tier IaaS cluster: management server, MySQL, a hypervisor fleet, primary and secondary storage, and software-defined networking, each sized and operated per tier
- Maintenance: High (4/5) - Management-server and database upgrades, multi-host coordination, and storage and network tuning across the estate
- User Management: High (4/5) - Multi-tenant RBAC (accounts, domains, projects) with LDAP and SAML SSO and event audit logs, all free in the Apache release; no SCIM
1. The Executive Summary
What is it? Apache CloudStack is an open-source Infrastructure-as-a-Service platform: it turns a fleet of physical servers into a multi-tenant private cloud with a self-service portal and API, the same model a public cloud offers, run entirely on hardware the organization owns. From a single management layer it provisions and orchestrates virtual machines, networks, and storage across many hypervisors, including KVM, VMware, XCP-ng, and Proxmox, with built-in multi-tenancy, account isolation, and role-based access. Governed by the Apache Software Foundation, it is a mature, vendor-neutral answer to VMware Cloud Director for organizations building sovereign cloud infrastructure.
The Strategic Verdict:
- 🔴 For small teams or a handful of servers: Caution. CloudStack is a datacenter-scale IaaS orchestrator, and standing it up demands real expertise across hypervisors, storage, and networking. For a single virtualization cluster or a small estate, a lighter platform such as Proxmox VE is the better fit; CloudStack earns its complexity only at multi-tenant, multi-host cloud scale.
- 🟢 For enterprises and providers building a sovereign cloud: Strong Buy. CloudStack delivers a full multi-tenant IaaS on infrastructure the operator controls, with no per-core licensing and no hypervisor lock-in, and its Apache Software Foundation governance makes it immune to the acquisition shocks and subscription repricing that pushed the market to re-evaluate VMware. Everything, including multi-tenancy and RBAC, ships in the open-source release.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | VMware Cloud Director (Proprietary) | Apache CloudStack (Self-Hosted) |
|---|---|---|
| Licensing | Per-core subscription (Broadcom bundling) | $0 (Apache-2.0, no tiers) |
| Multi-Tenancy | Gated in premium editions | Native (accounts, domains, projects) |
| Hypervisor Lock-in | VMware-centric | KVM, VMware, XCP-ng, Proxmox |
| Support | Mandatory vendor subscription | Optional third-party (ShapeBlue and others) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Architecture: A CloudStack deployment is a multi-tier system: a management server backed by MySQL, a fleet of hypervisor hosts, primary storage for running volumes and secondary storage for templates and snapshots, and software-defined networking for tenant isolation. Storage is pluggable across NFS, Ceph, and other backends. This is infrastructure to architect deliberately, not a single-node install.
- Data Portability: Management state lives in a standard MySQL database, and virtual machines use standard hypervisor disk formats, so metadata and VM images back up and migrate with ordinary industry tools rather than a proprietary export path.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Neutral Governance: CloudStack is stewarded by the Apache Software Foundation, a US non-profit, but the software is a self-hosted deliverable with no telemetry or phone-home, so the CLOUD Act cannot reach a local deployment. The governance is the real signal: the Apache Way, an independent foundation with a large multi-vendor contributor base, makes the project resilient to single-company capture, rug-pull relicensing, or vendor abandonment. It is among the strongest governance postures a tool in this class can have.
- The Compliance Shift: The shift is absolute. CloudStack supplies the controls a regulated cloud needs (multi-tenant isolation, role-based access, encrypted volume support, API rate limiting, and event audit logs), but the operator bears the entire compliance burden: hypervisor hardening, database and network security, and any SOC 2, ISO 27001, or HIPAA audit. The platform makes a compliant cloud possible; it does not deliver one.
- License & Operational Risk: License risk is none. Apache-2.0 carries a patent grant and foundation-held IP, with no open-core tier and no copyleft network clause. The real risk is operational: this is a full IaaS the team must architect and run, and a misconfigured multi-tenant cloud fails in ways a single-server tool never could. The budget line is expertise or a third-party support partner, not a licence.
4. Market Landscape
🏢 Proprietary Incumbents
- VMware Cloud Director: The incumbent multi-tenant cloud platform, now under Broadcom. Its shift to per-core subscription bundling drove the cost increases that put open, self-hosted IaaS back on the boardroom agenda.
- Nutanix: The proprietary hyperconverged private-cloud platform. CloudStack is the choice when the priority is a fully open, hypervisor-neutral stack with no per-node licensing.
🤝 Open Source Ecosystem
- Proxmox VE: The lighter, single-cluster virtualization platform for smaller estates. Cross-shop it when the need is a VMware vSphere replacement rather than a multi-tenant cloud; CloudStack can even orchestrate Proxmox hosts as it scales up.
- OpenStack: The other major open-source IaaS, a modular, highly configurable cloud framework. It trades CloudStack's turnkey, single-application model for maximum flexibility at a higher operational cost.