Is Windmill a drop-in replacement for Rundeck?

Not literally, because the two platforms target hosts differently. Rundeck dispatches a job to a filtered set of nodes from a node inventory over SSH or WinRM. Windmill runs a job on a worker, and reaches other machines either by placing a worker there or from inside the script. The script bodies themselves port directly: a bash or PowerShell step in a Rundeck job is a bash or PowerShell script in Windmill, and the job options become typed arguments that generate the run form.

Does Windmill have a node inventory and node filters?

No. There is no nodes page, no node filter syntax and no per-node dispatch primitive in Windmill. The documented substitutes are: an ansible_inventory resource passed to an Ansible playbook script, which then becomes a field on the run form; an ssh_target resource picked per run; and running a worker on the target host and routing jobs to it by tag. If a maintained inventory with per-node dispatch and health checks is central to how your team works, Rundeck is built around that and Windmill is not.

How does Windmill run commands on remote hosts?

Three documented ways, and two of them are Enterprise. Agent workers run the Windmill binary on the target host and connect back over outbound HTTP only, including on Linux, Windows and Apple targets; they are an Enterprise feature. The #ssh directive reroutes a bash script to a host described by an ssh_target resource, with host key pinning, live logs and exit code propagation; it is Enterprise and off by default. In the open-source edition, you call ssh from inside a script, or use the ssh_exec wrapper scripts published in the Windmill repository, which keep the SSH mechanics but lose typed arguments and structured results.

Is Rundeck still open source and maintained?

Yes. The rundeck/rundeck repository is Apache 2.0, the copyright line reads PagerDuty, Inc., and releases have continued through v6.3.0 in October 2026. PagerDuty sells the supported distribution as Runbook Automation, available self-hosted or as SaaS, and its licensing page states that a Runbook Automation subscription is the only way to get professional support from PagerDuty and the core Rundeck team.

What is commercial-only in Rundeck?

Rundeck publishes a community-versus-commercial table. Workflow execution, community plugins, key storage, basic task scheduling and the job activity log are in the open-source edition. High availability clusters, the Runner, failed job resume, node health checks, retry failed nodes, single sign-on, certified enterprise plugins, advanced webhooks, load-balanced workloads, job queuing, workflow visualization, GUI-based ACL editing, AI-generated runbooks and the advanced scheduling features (job-independent scheduling, blackout calendaring, schedule forecasting, missed job fires) are listed as commercial.

Is pricing public on either side?

Windmill publishes per-seat and per-compute-unit pricing on its pricing page. For Rundeck, the open-source edition is free, and PagerDuty lists Runbook Automation on its pricing page as an add-on purchased separately without showing a price. The self-hosted download page states that a license is required to operate Runbook Automation Self-Hosted and points to sales.

Windmill

Windmill cloud

OSS

Windmill vs Rundeck

Eight questions teams ask during a bake-off, with an honest answer on each one for where Windmill or Rundeck is the better pick.

Try Windmill cloud Self-host in 3 mins

The 8 questions

01What you can buildWhich solution fits for your specific use case
02TargetWho the platform is built for
03Build experienceHow you build on each platform
04IntegrationsHow the platform integrates with your existing stack
05Migration & lock-inHow hard to get in, how hard to get out
06Enterprise requirementsAudit logs, observability, security, scale
07Licensing & pricingOpen source, pricing, self-hosting
08VerdictThe verdict

Windmill in one sentence

An open-source workflow engine and developer platform to build and orchestrate all your internal software: scripts, workflows, infrastructure automation, AI agents and internal apps. Made for engineers who want full code flexibility and local dev experience, both to build internal software and to manage the underlying infrastructure.

Rundeck in one sentence

An Apache 2.0 runbook automation server maintained by PagerDuty. A job is a sequence of commands and scripts dispatched over SSH or WinRM to a filtered set of hosts from a node inventory, with option forms so operators can run it themselves. The supported distribution is sold as PagerDuty Runbook Automation, self-hosted or SaaS.

01 · What you can build

Which internal software can you build and orchestrate?

Rundeck is built around one model: a job dispatched to hosts from a node inventory, which is exactly the shape of most fleet operations and the thing Windmill has no equivalent for. Windmill is built to centralize and orchestrate all your internal software in one place. Scripts, workflows, data pipelines, AI agents and operator UIs run on a single runtime with shared resources, auth and observability.

Primitive	Windmill	Rundeck
Operational runbooks Restarts, failovers, patching, provisioning and other ops tasks run on demand
Node inventory & remote execution A maintained list of hosts, filtered per run, with commands dispatched to each over SSH or WinRM
Operator forms from inputs A form someone else fills in to run the automation, generated from the definition
Approval steps inside a run Suspend a run until approvers act, with secret approve and reject links and a timeout
Scheduled tasks Cron jobs with retries, error handling and alerting
Workflows across systems Branches, loops, retries and error handlers over steps written in different languages		Partial
Scripts as standalone APIs A function exposed as a typed HTTP endpoint and a webhook without a wrapping workflow		Partial
Windows execution Run PowerShell and other Windows workloads on Windows hosts	Enterprise only
Data pipelines ETL, syncs and scheduled data jobs with parallel branches and managed tables
AI agent workflows Agents that call tools, branch on outputs and run as workflow steps
Low-code internal apps Drag-and-drop dashboards and admin tools with built-in components
Full-code internal apps Custom dashboards and admin tools built in React or Svelte

Two rows need their caveat spelled out. Rundeck workflows have node-first, sequential and parallel strategies, step-level error handlers and job references, and the Ruleset strategy plugin and workflow visualization are listed as commercial; a Rundeck job is also callable over the API and by webhook, so "standalone" is a matter of degree rather than a missing feature. On the Windmill side, native Windows workers are a self-hosted Enterprise feature, while Rundeck ships WinRM in the open-source edition.

02 · Target

Who is each platform built for?

Rundeck is aimed at operations teams who want to hand a safe button to someone else, and its job editor lets an admin assemble a runbook from scripts that already exist. Windmill is aimed at developer-led teams who want the same operator-facing forms, with the automation behind them written and reviewed as code.

Windmill

Rundeck

Primary audience

Windmill

Developer-led teams. Engineers own the platform end-to-end: code, Git, local dev, code review, CI/CD, AI coding tools, infrastructure as code. Operations work is one of the things they build on it, next to internal apps and data jobs.

Rundeck

Operations, SRE and platform teams with a fleet to look after. The project describes itself as "Enable Self-Service Operations: Give specific users access to your existing tools, services, and scripts", and that framing has held for a long time: the docs carry release notes going back to Rundeck 1.x.

Running without authoring

Windmill

Windmill parses the main function of a script, or a flow's inputs, into a JSON schema and renders a form from it. The Operator role runs and views what others built without authoring scripts, flows or apps, and folders and groups scope who sees what. The free self-hosted edition caps you at four groups.

Rundeck

This is Rundeck's oldest strength. Job options render a run page with text fields, enforced dropdowns, date pickers, masked password inputs, regex validation and choices loaded from a remote JSON endpoint. Who can run which job is set in aclpolicy YAML documents on the server; editing ACLs through a GUI is Commercial only.

Authoring and reviewing

Windmill

Authoring is writing code, so a non-developer will not write a runbook. The upside is that review is the review you already have: a script is a file, a flow is a YAML file, and both go through a pull request.

Rundeck

Jobs are authored in the web UI and stored in the server database. Anyone comfortable with the job editor can assemble one from existing scripts without writing much new code, which lowers the floor. The definition can be exported to YAML or XML for review, but the editing surface the team actually uses is the UI.

03 · Build experience

How do you build on each platform?

Windmill treats the runbook as code: a script with typed arguments that generates its own form and endpoint, with the whole workspace in Git. Rundeck treats the job as the unit, with the script as a field inside a definition that also carries the options, the node filter and the schedule.

Windmill

The runbook is a script. Windmill reads its arguments to generate the run form, the JSON schema and an HTTP endpoint, so the same file is what an operator runs and what a reviewer reads in a pull request. The flow file above it adds the orchestration: an approval step that suspends the run for 30 minutes, then the restart.

restart_service.sh
restart.flow.yaml

# restart_service.sh
service="$1"              # typed args, the run form is generated from them
host="$2"

set -euo pipefail
echo "restarting $service on $host..."
ssh "$host" "systemctl restart $service"
ssh "$host" "systemctl is-active $service"

summary: Restart a service
value:
  modules:
    - id: a
      summary: Approve the restart
      value:
        type: script
        path: f/ops/request_approval
        input_transforms:
          service:
            type: javascript
            expr: flow_input.service
      suspend:
        required_events: 1
        timeout: 1800
    - id: b
      value:
        type: script
        path: f/ops/restart_service
        input_transforms:
          service:
            type: javascript
            expr: flow_input.service
          host:
            type: javascript
            expr: flow_input.host

Rundeck

The job is the unit, and the script is a string inside it. One definition carries the options an operator fills in, the step sequence, the node filter that picks which hosts to dispatch to and the schedule. Jobs live in the server database and are edited in the web UI; this YAML is the import and export format, assembled here from the fields in the job definition reference.

jobs.yaml

- name: restart service
  description: ''
  loglevel: INFO
  options:
    service:
      required: true
      description: the service to restart
      values:
      - nginx
      - postgres
  sequence:
    keepgoing: true
    strategy: node-first
    commands:
     - script: |-
        #!/bin/bash

        echo restarting on $(hostname)
        systemctl restart @option.service@
        systemctl is-active @option.service@
  nodefilters:
    dispatch:
      threadcount: 1
      keepgoing: false
    filter: 'tags: web name: web-.* !os-family: windows'
  schedule:
    crontab: '0 30 */6 ? Jan Mon *'

Windmill

Rundeck

Authoring

Windmill

Write a script in the script editor or locally. Windmill parses the function signature to generate the input UI, the JSON schema and the argument types, and resolves dependencies into a per-script lockfile. A script runs on its own with an HTTP endpoint, a webhook and a schedule, and the flow editor composes scripts into a DAG with branches, loops, retries and approval steps.

Rundeck

Build a job out of steps. A step is a command, an inline script, a script file, a script URL, a reference to another job or a plugin step, and node steps run once per matching node while workflow steps run once per job on the server. Each step can have an error handler, and the strategy is node-first, sequential or parallel.

Languages and runtimes

Windmill

Fifteen documented language quickstarts: Bash, PowerShell and Nu, Python, TypeScript on Bun with a Node.js mode, Go, SQL, PHP, Rust, C#, Java, Ruby, R, Docker, REST and Ansible. An Ansible script declares its inventory, Galaxy collections and Python dependencies in a header, and the inventory itself is a typed resource that shows up as a field on the run form.

Rundeck

Steps shell out, so the language is whatever the node can run. Execution is a pluggable system with SSH and WinRM by default and PowerShell available, an inline script can set its own scriptInterpreter, and Ansible is a supported node source and step. Dependencies on the target host are yours to manage, the same as any shell script.

Local dev & IDE

Windmill

Run scripts locally with the Windmill CLI, with a VS Code extension, native language tooling (LSP, type-checking, linting) and AI coding tools working against real source files.

Rundeck

The rd CLI lists and loads job definitions as files (rd jobs list -p project --file /tmp/jobs.yaml -F yaml, then rd jobs load), which is enough to script deployments. There is no local engine for iterating on a job outside a running server.

Secrets

Windmill

Resources (typed JSON for credentials and connection info) and variables (individual secrets) are reusable across scripts, flows and apps, encrypted at rest and scoped by folders and groups. External backends such as Vault and AWS Secrets Manager are Enterprise only.

Rundeck

Key Storage is in the open-source edition: a folder tree of keys and passwords used by node executors, plugins and job options. The backend plugins for Vault, AWS Secrets Manager, Azure Key Vault, CyberArk and Thycotic are bundled with the commercial version; the Vault plugin docs show a community path that is to build the jar yourself and drop it in libext/.

Git & CI

Windmill

Scripts, flows, apps, resources, variables, schedules, folders, groups and permissions are all files in Git, deployed through the CLI and Git sync. Internal tooling ships like application code: pull requests, review, rollback, CI. Git sync is free for up to 2 users, beyond that Enterprise only.

Rundeck

Rundeck includes a Git plugin for SCM that exports and imports job definitions against a remote repository, so job history can live in Git. It covers job definitions; users, ACL policy files and project configuration are managed separately, on the server or through the API.

04 · Integrations

How does the platform integrate with your existing stack?

Windmill makes the package ecosystems the integration layer: import the vendor's SDK and run, with no plugin to build or install. Rundeck has a mature plugin surface and, through PagerDuty, the tightest path from an incident to the automation that fixes it.

Windmill

Rundeck

Connecting out

Windmill

Any npm, PyPI, Go or Maven package is a first-class import with automatic per-script dependency resolution, so you call the vendor's real SDK with type inference in the editor. 50+ pre-built resource types cover databases, SaaS and infrastructure: paste credentials into a typed form once and share the resource across scripts, flows and apps.

Rundeck

A plugin system with a type per extension point: workflow step, node execution, file copier, resource model source, notification, logging, orchestrator, log filter and storage. Community plugins are in the open-source edition, and PagerDuty's docs list plugin suites for AWS, Azure, GCP, Kubernetes and ServiceNow. Certified enterprise plugins are Commercial only.

Receiving events

Windmill

Native triggers for webhooks, cron, custom HTTP routes, email, WebSocket, Postgres CDC, MQTT and AMQP in the open-source edition, and for Kafka, NATS, SQS, GCP Pub/Sub and Azure Event Grid on Enterprise only. Every script also gets an HTTP endpoint and a webhook URL, and Windmill can be driven from an LLM client as an MCP server.

Rundeck

Jobs run on a schedule, from the API, from the CLI, from a webhook or from another job; advanced webhooks are Commercial only. The distinctive one is the incident path: PagerDuty's product pages describe triggering diagnostics and remediation from PagerDuty AIOps, plus running automation from Jira, ServiceNow and Slack. If you already page on PagerDuty, that integration is a real advantage.

Extending

Windmill

A new integration is a script with a new import: save and run, no restart and no image rebuild. Custom logic can be exposed as a typed script, packaged as a resource type, or published to the workspace Hub for the team.

Rundeck

First-class plugins are Java or Groovy jars dropped next to the server. For the shorter path, script plugins let you "extend Rundeck using any scripting language (Bash, Python, Ruby, etc.) without setting up a Java development environment", packaged as a zip with a plugin.yaml. Either way, installing a plugin is a server-side operation.

05 · Migration & lock-in

How hard to get in, and how hard to get out?

Rundeck is quick to adopt when your automation is already scripts on hosts, and it exports its job definitions as files rather than holding them hostage. Windmill keeps the switching cost low from the other direction: the step code is ordinary code that keeps running after you leave.

Windmill

Rundeck

Getting in

Windmill

Paste a bash, PowerShell or Python script into the editor, declare its arguments, and you have a form, an endpoint and a schedule. Rundeck job options become typed arguments and inline script steps port as they are. What has no direct translation is the node filter: you decide per runbook whether to place a worker on the host, call out over SSH, or run an Ansible playbook against an inventory resource.

Rundeck

Rundeck's own pitch is wrapping what you already have: "Create workflows that span the different scripts, tools, APIs, and system commands to standardize operations tasks." If your automation is already shell scripts on hosts you can reach over SSH, a first useful job is close at hand.

Getting out

Windmill

Step logic is standard code (Bash, PowerShell, Python, TypeScript, Go, SQL) that runs anywhere, and the CLI exports the whole workspace as plain files. What you lose by leaving is the runtime, the forms and the permissions model, not the step code.

Rundeck

Inline script bodies are standard shell or PowerShell and port cleanly. The job wrapper does not: options, node filters, dispatch settings, error handlers, job references and @option.x@ or ${option.x} substitution have to be rebuilt elsewhere, and any plugin step is a rewrite against the vendor's API. Definitions do export as YAML or XML, so you leave with readable files.

06 · Enterprise requirements

Audit logs, observability, security, scale

Both platforms gate real things, and the gates sit in different places. Rundeck keeps access control, key storage, the activity log and an audit trail file in the open-source edition, and puts high availability, SSO and SIEM streaming behind the commercial product. Windmill keeps RBAC, audit logs, SSO for up to 10 users and queue-based horizontal scaling in the open-source edition, and gates dedicated workers, autoscaling, agent workers, SAML and SCIM.

Windmill

Rundeck

Observability

Windmill

Real-time streaming logs, per-run inputs, outputs and duration, worker queue metrics and a Prometheus exporter, with a trace ID on every job.

Rundeck

Execution history and the job activity log are in the open-source edition: who ran what, when, with which options, and the full log output. Node health checks, the system report and the operational dashboards are Commercial only.

Audit logs

Windmill

Every side-effecting action is recorded with the user who caused it, filterable by date, user, action and operation. Retention in the database defaults to 14 days on the Community Edition and 365 days on Enterprise; continuous export to object storage and OpenTelemetry audit records are Enterprise only.

Rundeck

Since 4.6.0 the open-source edition writes an audit trail log file of user and system activity with the origin, resource and action. Streaming those events to Datadog, New Relic, Splunk or a webhook is Commercial only, so SIEM integration in the open-source edition means parsing the file yourself.

Access control & SSO

Windmill

A fine-grained ACL over groups and folders, with RBAC and per-item roles, is in the open-source edition, capped at 4 groups and 10 SSO users on free self-hosting. Uncapped SSO, SAML, SCIM group sync and custom roles are Enterprise only. Windmill is SOC 2 Type II certified.

Rundeck

Access control is in the open-source edition, written as *.aclpolicy YAML documents that grant actions on resources per user or group, in an application or project context. Editing them through a GUI is Commercial only, and the SSO docs are titled "Rundeck SSO Security (Commercial)" with Okta, Ping and Azure AD supported, so single sign-on means buying Runbook Automation.

Isolation

Windmill

Multiple isolated workspaces on one instance, each with its own users, resources, secrets and access controls. The database is partitioned by workspace. Free self-hosting is capped at 3 workspaces; unlimited is Enterprise only.

Rundeck

Projects separate jobs, nodes and ACL context on one server, and node data can be shared between projects when more than one team owns the same hosts. There is no tenant layer above projects.

Scale & availability

Windmill

Jobs are queued and picked up by workers, routed by tag to worker groups; add workers to add throughput. Tag-based routing and basic group config are in the open-source edition. Dedicated workers, autoscaling, init and periodic scripts, priority tags, queue metrics and agent workers are Enterprise only.

Rundeck

This is the sharpest line in Rundeck's own community versus commercial table: high availability clusters, auto takeover, load-balanced workloads, job queuing, failed job resume, retry failed nodes and the Runner are all Commercial only. A single open-source server is a single point of failure by design.

07 · Licensing & pricing

Open source, pricing, and self-hosting?

Rundeck's core is Apache 2.0, more permissive than Windmill's AGPLv3 for modification and redistribution, and the project is still releasing. Windmill publishes its Enterprise pricing upfront, where Runbook Automation is an add-on with no public price and a license you request from sales.

Windmill

Rundeck

Open-source license

Windmill

AGPLv3 core, free and unlimited to self-host. Enterprise features (SSO beyond 10 users, dedicated workers, agent workers, external secret backends, extended audit log retention) ship in a separate proprietary codebase. Managed cloud available.

Rundeck

Apache 2.0, and still shipping: the repository states "Rundeck is free open source software licensed under the Apache Software License v2.0" with a PagerDuty copyright line, and releases have continued through v6.3.0 in October 2026. Apache 2.0 is the more permissive of the two licenses if you plan to modify and redistribute.

Commercial product

Windmill

One product with an Enterprise tier, self-hosted or cloud. The open-source edition and the commercial one are the same platform and the same UI, with features unlocked by a license key.

Rundeck

A separate distribution. PagerDuty's licensing docs call Runbook Automation "a tested, supported, and enterprise-ready distribution of Rundeck" and state that a subscription "is the only way to receive professional support from PagerDuty and the core Rundeck team". It was renamed from Process Automation and, before that, Rundeck Enterprise, so older material uses all three names.

Pricing visibility

Windmill

Public per-seat and per-compute-unit pricing on the pricing page, with a calculator for self-hosted and cloud. No sales call needed to get a number.

Rundeck

The open-source edition is free. For the commercial one, PagerDuty's pricing page lists Runbook Automation as an add-on purchased separately, with no price shown, and the self-hosted download page states that a license is required and points to sales. Expect a sales conversation for a number.

08 · Verdict

The verdict

Windmill and Rundeck answer different questions. Rundeck answers "which hosts, and what runs on them": a job is a sequence of steps dispatched over SSH or WinRM to a filtered set of nodes, with an option form in front of it. Windmill answers "what is the automation, and who can run it": a script with typed arguments that gets a form, an endpoint and a place in a flow, with the hosts handled by where the worker runs or by what the script calls.

Rundeck can be the better pick if the node inventory is the point. Nothing in Windmill replaces node sources that pull from AWS or a CMDB, node filters by tag and attribute, and fan-out with per-node results. If you already page on PagerDuty and want remediation one step from the incident, that path is theirs. One caveat to price in: high availability, SSO and SIEM streaming are commercial, so a production-grade open-source Rundeck is a single server with ACL files and a local audit log.

Windmill is the better pick if you want runbooks to be code. Steps are written in Bash, PowerShell, Python, TypeScript, Go, SQL or Ansible, the form an operator sees is generated from the function signature, approval steps suspend a run until approvers act, and the whole workspace (scripts, flows, resources, permissions) lives in Git and deploys through pull requests. The same runtime also carries data pipelines, AI agents and internal apps, so the operations tooling is not a separate island. Be clear-eyed about our gates: native Windows workers, agent workers and the #ssh directive are Enterprise features, where Rundeck's remote execution is free.

There is also a reason this choice looks different than it did a few years ago. More automation is now drafted with AI coding tools, and a draft is only as safe as the review it gets. A bash script and a flow YAML file go through the same pull request as the rest of your code; a job assembled in a web UI is reviewed by whoever opens it next. That is an argument for code, not a verdict on either product. If you are deciding between the two, the fastest way to judge is to spend an afternoon in each.

Frequently asked questions

: Not literally, because the two platforms target hosts differently. Rundeck dispatches a job to a filtered set of nodes from a node inventory over SSH or WinRM. Windmill runs a job on a worker, and reaches other machines either by placing a worker there or from inside the script. The script bodies themselves port directly: a bash or PowerShell step in a Rundeck job is a bash or PowerShell script in Windmill, and the job options become typed arguments that generate the run form.
: No. There is no nodes page, no node filter syntax and no per-node dispatch primitive in Windmill. The documented substitutes are: an ansible_inventory resource passed to an Ansible playbook script, which then becomes a field on the run form; an ssh_target resource picked per run; and running a worker on the target host and routing jobs to it by tag. If a maintained inventory with per-node dispatch and health checks is central to how your team works, Rundeck is built around that and Windmill is not.
: Three documented ways, and two of them are Enterprise. Agent workers run the Windmill binary on the target host and connect back over outbound HTTP only, including on Linux, Windows and Apple targets; they are an Enterprise feature. The #ssh directive reroutes a bash script to a host described by an ssh_target resource, with host key pinning, live logs and exit code propagation; it is Enterprise and off by default. In the open-source edition, you call ssh from inside a script, or use the ssh_exec wrapper scripts published in the Windmill repository, which keep the SSH mechanics but lose typed arguments and structured results.
: Yes. The rundeck/rundeck repository is Apache 2.0, the copyright line reads PagerDuty, Inc., and releases have continued through v6.3.0 in October 2026. PagerDuty sells the supported distribution as Runbook Automation, available self-hosted or as SaaS, and its licensing page states that a Runbook Automation subscription is the only way to get professional support from PagerDuty and the core Rundeck team.
: Rundeck publishes a community-versus-commercial table. Workflow execution, community plugins, key storage, basic task scheduling and the job activity log are in the open-source edition. High availability clusters, the Runner, failed job resume, node health checks, retry failed nodes, single sign-on, certified enterprise plugins, advanced webhooks, load-balanced workloads, job queuing, workflow visualization, GUI-based ACL editing, AI-generated runbooks and the advanced scheduling features (job-independent scheduling, blackout calendaring, schedule forecasting, missed job fires) are listed as commercial.
: Yes, that path is the same shape as a Rundeck job option form. Windmill parses the main function of a script or the flow inputs into a JSON schema and renders a form from it, and the Operator role runs and views what others built without authoring scripts, flows or apps. Authoring is still code, so the division of labour is developers writing runbooks and operators running them. On the free self-hosted edition, groups are capped at four.
: Windmill publishes per-seat and per-compute-unit pricing on its pricing page. For Rundeck, the open-source edition is free, and PagerDuty lists Runbook Automation on its pricing page as an add-on purchased separately without showing a price. The self-hosted download page states that a license is required to operate Runbook Automation Self-Hosted and points to sales.

Build your internal platform on Windmill

Scripts, flows, apps, and infrastructure in one place.

Get started for free