Unleash

Last reviewed Sep 13, 2026 · 842 words

Unleash is worth self-hosting if you ship software to other people and want feature flags without paying LaunchDarkly per seat; it is not worth running for a homelab, because a flag server with nothing behind it is just a Postgres database with a login page. The Apache-2.0 core gives you flags, gradual percentage rollouts, per-user and constraint-based targeting, multiple environments, and SDKs for every mainstream language, in one container plus PostgreSQL and about 1 GB of RAM. The paid tiers add the governance layer, and whether that matters is the entire decision.

One container, one database, port 4242

services:
  db:
    image: postgres:16
    environment:
      POSTGRES_DB: unleash
      POSTGRES_USER: unleash
      POSTGRES_PASSWORD: pick-something-long
    volumes:
      - ./pgdata:/var/lib/postgresql/data
  unleash:
    image: unleashorg/unleash-server:latest
    ports:
      - "4242:4242"
    environment:
      DATABASE_URL: postgres://unleash:pick-something-long@db/unleash
      DATABASE_SSL: "false"
    depends_on:
      - db

First login is admin with password unleash4all; change it before you do anything else, then create a client API token under the project's API access page. The server is a Node.js application and is idle most of the time, since SDKs poll on an interval rather than calling per request, so the 1 GB figure is about Postgres and headroom rather than a busy process.

The SDK is the part that actually runs in production

The design that makes Unleash safe to self-host is that your application does not depend on the server being up. A backend SDK fetches the full flag configuration every 15 seconds or so, evaluates every flag locally in memory, and keeps the last good copy if the server disappears. Take Unleash down for an hour and nothing you have shipped notices. A minimal Node client looks like this:

const { initialize } = require('unleash-client');
const unleash = initialize({
  url: 'https://flags.example.com/api/',
  appName: 'billing-service',
  customHeaders: { Authorization: process.env.UNLEASH_TOKEN },
});
if (unleash.isEnabled('new-invoice-layout', { userId: user.id })) { /* ... */ }

Frontend and mobile apps should not hold a client token, so they go through Unleash Edge, a small Rust service that evaluates flags on their behalf with a frontend token. Add it when you have a browser or app consumer; skip it for a purely server-side deployment.

Rollouts, constraints, and the strategies people use

Every flag in an environment carries one or more activation strategies. The gradual rollout strategy takes a percentage and a stickiness field (usually the user ID) so the same 10 percent of users see the feature every time, which is the property that lets you roll back cleanly. Constraints layer on top: only users whose region context field is eu, or only requests after a date. Where this gets interesting for a self-hoster with an AI product is gating model versions and prompt changes per cohort so you can compare outputs; the pattern is written up in shipping AI behind flags. Environments (development and production out of the box) let one flag hold different strategies per stage, and a flag left on at 100 percent for months gets flagged as stale so you remember to remove the branch.

What the open-source edition does not include

Be clear-eyed here, because the marketing site is not. Single sign-on via SAML or OIDC, fine-grained role-based access, change requests with approvals, and the longer audit history are enterprise features. Open source has admin, editor, and viewer roles plus local users, which is fine for a team of 5 and a problem for a company that needs approvals on production changes. If those are the features you came for, budget for a licence or accept the limit. For a small team, the free edition is complete in the way that matters: no cap on flags, users, or evaluations.

The lighter options if Unleash is more than you need

Unleash's complexity is proportional to a real product team's needs. If you are one developer who wants a kill switch and a percentage rollout, Flagsmith is a comparable server with a slightly simpler model, Flipt runs as a single Go binary with a file or SQLite backend and no Postgres, and PostHog bundles flags with analytics and session replay if you are going to run analytics anyway. Where Unleash wins is SDK maturity and the local evaluation model; where it loses is that it is the heaviest of the four to keep patched.

What I'd do

If you have a product with real users and at least 2 developers, run Unleash open source with Postgres, change the default password, put it behind your reverse proxy with an identity-aware layer since SSO is not in the free tier, and adopt the stale-flag discipline from week one. If you are solo, run Flipt and save the Postgres. If you are a homelab looking for something to self-host, this is not it; Unleash only pays off when there is a deploy pipeline on the other end of the flag.