By ByteBot
HashiCorp archived the Boundary Community Edition GitHub repository on October 8 — no advance notice, no transition period, no guidance on forking. The repo is read-only. Security patches stop. Bug fixes stop. A new CVE lands tomorrow and Boundary CE gets nothing. Teams running it in production are now holding a frozen asset that is one vulnerability away from becoming a liability.
What Boundary CE Actually Does
If you are not already running it, here is the short version: Boundary replaces shared SSH keys and VPN access with identity-based sessions. You authenticate through your organization’s identity provider (Okta, Azure AD, Ping), get a short-lived credential for the specific host, database, or Kubernetes cluster you need, and that credential disappears when the session ends. No shared keys. No standing access. Full audit trail.
It is the kind of tool that compliance teams love and that developers learn to appreciate once they stop getting paged about rotated SSH keys at 2 AM.
IBM’s Open Source Playbook, One More Time
The archival did not come from nowhere. This is the fourth act of a play that started in August 2023, when HashiCorp switched Terraform, Vault, Consul, and Nomad from the Mozilla Public License to the Business Source License 1.1. BSL is not open source — it bars commercial production use and prohibits competitive services. The community forked: OpenTofu now handles Terraform workloads, OpenBao handles Vault. Both live under the Linux Foundation.
IBM closed its $6.4 billion acquisition of HashiCorp in February 2025. Boundary CE survived another eighteen months. It did not survive October 2026.
“The ‘Hashi’ of the HashiCorp is far gone. IBM and ‘Corp’ are redundant.”
Hacker News, on the Boundary CE archival
The stated reason from HashiCorp: focus on HCP Boundary and Boundary Enterprise to build “a market leading human and agentic privileged access solution.” Translation: Boundary is a product now, not a project. The official HashiCorp forum post is characteristically brief.
Three Replacements Worth Running
The good news is that the alternatives are genuinely good. Here is where to look:
Teleport
Teleport is the most complete like-for-like replacement. It handles SSH, Kubernetes, and database access under one umbrella, ships a full Community Edition under Apache 2.0, and includes the session recording that Boundary CE notably lacked. If your organization runs compliance audits or needs forensic-level access logs, Teleport is the natural destination. The operational footprint is larger — it requires running a Teleport cluster — but the feature depth justifies it for teams that need it.
Warpgate
Warpgate is the lean option: a clientless, self-hosted bastion host written in Rust with 7,355 GitHub stars and active maintenance as of July 2026. It handles SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP, and VNC without requiring any software on the target machine. Sessions are recorded, 2FA and SSO are supported, and the resource footprint is low. For smaller teams or anyone who wants a simpler operational model than Teleport, Warpgate is worth a serious evaluation.
Pomerium
Pomerium is the right answer if your primary access patterns are web applications and internal HTTP services rather than SSH and databases. It is an identity-aware reverse proxy — no client software, integrates with any OIDC provider, and sits in front of internal tooling to enforce policy. It does not replace Boundary’s SSH and database brokering, but for teams whose main use case is accessing internal dashboards and staging environments, Pomerium is lighter and simpler.
What to Do This Week
Your current Boundary CE deployment keeps running — there is no kill switch. But running production access management software with no future security patches is a risk that needs a timeline.
Start with an audit: what hosts, databases, and Kubernetes clusters route through Boundary CE? That inventory tells you the migration scope. If the list is short, Warpgate is a reasonable weekend project. If it is long and compliance requirements are in play, start evaluating Teleport now rather than after the first unpatched CVE creates urgency. The Infisical migration guide is a good starting point.
A Boundary fork may emerge — OpenTofu and OpenBao proved the community will act when the tooling matters enough. As of October 14, no fork exists. Do not count on one arriving before you need to migrate.
