Boundary CE Is Archived: Freeze Deployments, Plan Your Exit

Stop new Boundary Community Edition deployments and put existing clusters on a time-boxed exit plan. An installed cluster does not stop working because its repository is read-only, but HashiCorp says no new CE releases, maintenance updates, bug fixes, or security patches are planned. For a service controlling access to critical systems, indefinite operation turns every future defect into your problem.

Do not replace it in a weekend. Freeze the artifact you run, prove recovery, inventory every access path, and migrate through a measured parallel pilot.

This assessment reflects public project state checked on October 13, 2026. OpenSourceChoice did not operate a Boundary cluster or test a migration.

The decision at a glance

Why this matters now

HashiCorp announced the deprecation on October 9 and says the repository was archived effective October 8. The final README is unusually direct: the code and old binaries remain available, while new CE maintenance and security patches are not planned. The latest stable release is still 0.21.3 from April 30. The official Docker latest tag and Homebrew formula also resolve to that release.

This is not interest manufactured from one vendor post. The repository archive reached 84 points and 16 comments in the checked Hacker News discussion. Separate threads in r/hashicorp and r/IBM discussed the shutdown on October 12. Those numbers establish a current operator question, not technical safety.

The September repository history included dependency and API work, and open pull requests still contain a connection-cancellation fix and dependency updates. Archival leaves those contributions unmerged. Existing users therefore need to plan from the released artifact, not from unfinished code on main.

What Boundary still does—and what archival removes

Boundary brokers identity-based access to private targets without distributing network access broadly. Controllers hold configuration and authorization state in PostgreSQL; workers proxy approved sessions. Deployments can use OIDC, HCL configuration, APIs, Terraform-managed resources, and CLI or desktop clients for SSH, RDP, and TCP workflows.

None of that disappears from 0.21.3. Existing binaries, checksums, documentation, source, and container images remain downloadable. Internal production use also remains within the license's stated additional-use grant when it is not a competitive paid offering.

What disappears is the maintenance promise. Archival does not provide:

• fixes for a future vulnerability in Boundary or a bundled dependency;
• compatibility updates for PostgreSQL, operating systems, identity providers, browsers, or client platforms;
• review of the existing issue and pull-request queue;
• an upstream owner for regression triage or release engineering.

This is the distinction in our open-source project evaluation framework: available source preserves options, while active maintenance determines whether an operational dependency stays supportable.

Security, privacy, and license boundaries

The principal risk is security debt at the access-control layer. Version 0.21.3 fixed CVE-2026-7776, a TLS-handshake denial of service, and updated several vulnerable dependencies. That release proves patches were necessary before archival; it cannot promise the current build is the last one users will ever need. HashiCorp's vendor-level security bulletin channel remains online, but the CE notice says fixes are not planned.

Reduce exposure while migrating: pin 0.21.3 by checksum or container digest, restrict controller and worker management surfaces, monitor authentication and authorization failures, review privileged roles, shorten credentials where possible, and isolate the PostgreSQL and KMS boundaries. Treat any unsupported fork build as a new product that needs independent review.

Self-hosting keeps Boundary's control plane, database, and session path in infrastructure you operate. It does not eliminate sensitive metadata. Identity attributes, target names, authorization decisions, audit events, logs, backups, and support artifacts still require retention rules and access controls. A replacement changes those data flows, so document where identity, audit, and session records go before a pilot.

Boundary 0.14.0 and later use Business Source License 1.1. The current license permits internal production use but restricts paid hosted or embedded offerings that compete with IBM's paid versions. Each release changes to MPL 2.0 four years after publication. This is a version-specific legal boundary, not a blanket permission; review it before redistributing, embedding, or offering a service.

The real cost and the alternative

Staying indefinitely looks cheap because there is no new license invoice. The bill arrives as vulnerability assessment, dependency backports, test infrastructure, incident response, and staff time spent proving compatibility. Boundary's reference architecture also expects redundant controllers, workers, PostgreSQL, KMS, networking, monitoring, backups, and restore practice. Archival transfers the software lifecycle on top of those existing duties.

This is why the broader self-hosting cost test matters: name the patch owner, restore objective, and upgrade path. If any answer is “nobody,” continued operation is an unmanaged exception.

Evaluate Teleport Community Edition when you need one system for SSH, Kubernetes, database, and application access. Its public source is AGPL v3 outside the Apache-licensed API module, while official Community builds use a modified license. Confirm that your organization and deployment model comply, and compare the exact feature matrix. Teleport is not a drop-in migration: roles, certificates, agents, audit events, resource enrollment, and operational failure modes differ.

If your scope is only browser applications, a narrower identity-aware proxy may cost less to run than a full privileged-access platform. Let the inventory decide the product category before comparing feature lists.

A measurable 14-day exit pilot

1. Freeze and recover. Record the running version, package checksum or image digest, controller and worker configuration, Terraform state, PostgreSQL backup, KMS dependencies, and client versions. Restore them in an isolated environment.
2. Inventory access. List every target, role, group, OIDC mapping, credential source, worker route, automation account, audit consumer, and emergency path. Mark owners and business criticality.
3. Select a representative slice. Use at least five users, two roles, ten targets, one database, one SSH path, one application path, and one revocation scenario. Keep production Boundary as rollback.
4. Translate policy explicitly. Recreate least privilege rather than copying broad grants. Have resource owners approve effective access before users connect.
5. Measure outcomes. Require 100% successful authorized connections, 100% denied unauthorized attempts, revocation visible within five minutes, complete identity and target fields in audit events, successful worker or proxy failover, and a documented p95 connection time.
6. Prove operations. Restore the replacement control plane, rotate one credential, patch it once, and run an incident drill. Confirm on-call staff can diagnose both user denial and infrastructure failure.
7. Reverse the pilot. Send the slice back through Boundary within the recovery objective. Only then schedule migrations in bounded waves.

Final recommendation

Boundary CE remains runnable, but it is no longer a reasonable default for new infrastructure. Existing operators should pin and harden 0.21.3 only as a temporary bridge, then fund a migration before the first unpatchable defect turns planning into an incident.

The safe exit is evidence-driven: recover the old control plane, translate a representative policy set, prove security and audit behavior in parallel, and retain rollback until the replacement survives a real operating cycle.

Sources and verification notes

Primary sources:

• HashiCorp: Deprecation of Boundary Community Edition — deprecation scope, repository archival, and future product direction.
• Boundary repository and archival notice — read-only state, maintenance status, source, issues, and pull requests.
• Boundary 0.21.3 release — latest stable tag and publication date.
• Boundary change tracker — current known changes and CVE-2026-7776 guidance.
• Boundary 0.21.3 checksums — official artifact verification data.
• Boundary upgrade and database migration guide — backup, offline migration, compatibility, and rollback limits.
• Boundary self-managed quick start — CE capabilities and deployment model.
• Boundary system requirements — controller and worker operational requirements.
• Boundary license — BSL 1.1 use grant and version-specific MPL 2.0 change date.
• HashiCorp security bulletins — vendor product-security notices and subscription channel.
• Teleport repository and license — Community source scope, AGPL v3, API license, and official-build license distinction.
• Teleport getting started — current editions and supported access categories.

Interest signals:

• Hacker News: HashiCorp archives the Boundary open source repo — current operator discussion; used only as an attention signal.
• r/hashicorp: Boundary Community Edition being sunset — separate community response; used only as an attention signal.
• r/IBM: Boundary Community Edition deprecation — independent community discussion; used only as an attention signal.

Release, repository, package, documentation, and discussion state was checked on October 13, 2026 and should be revalidated before a production change.