gravitational/teleport

What Teleport does

Teleport is an infrastructure access platform that combines an identity-aware proxy, a certificate authority issuing short-lived credentials, a tunneling system, and centralized access control and audit. Instead of distributing long-lived SSH keys, database passwords, or Kubernetes tokens, it issues short-lived certificates bound to human or workload identity, with SSO and MFA layered on top.

It covers SSH nodes, Kubernetes clusters, PostgreSQL, MongoDB, CockroachDB and MySQL databases, Windows desktops, internal web applications, cloud consoles, and Model Context Protocol servers. Role- and attribute-based policies, just-in-time access requests, and session recording apply across these resource types. It is aimed at platform, security, and infrastructure teams replacing VPNs, bastion hosts, or ad-hoc SSH key management.

Quick start

Deployment is documented for self-hosted Linux, Kubernetes via Helm, and Docker; the Linux demo cluster is the shortest path to a single-instance setup. Follow the getting started guide or the Linux demo cluster guide to install the server, create an admin user, and register resources. The Docker installation guide covers running Teleport in a container. Alternatively, Teleport Enterprise Cloud is a managed deployment with a free trial signup (source:58).

To build from source, install Go, Rust, Node.js, libfido2, and pkg-config, preferably at the versions pinned in build.assets/versions.mk (source:62). Then:

git clone https://github.com/gravitational/teleport.git
cd teleport
make full

Binaries land in build. A minimal local run needs the data directory first:

sudo mkdir -p -m0700 /var/lib/teleport
sudo chown $USER /var/lib/teleport
./build/teleport start -d

Set DEBUG=1 to load the Web UI assets from the source directory during UI development. Dockerized builds use make -C build.assets build-binaries, which builds for the host architecture only.

Constraints and licensing

Building requires at least 1 GB of virtual memory for the Go compiler. Production deployments should use a released tag rather than master, which tracks the next major version. tsh links against libfido2 by default; the FIDO2 variable switches between dynamic, static, and disabled linking, and Touch ID builds need an Apple Developer account.

The API module under /api is Apache 2.0, while the rest of the repository is AGPL-3.0; Community Edition binaries distributed from the download page use a modified Apache 2.0 license. Teleport uses existing identity providers such as Okta, Google Workspace, Microsoft Entra ID, or GitHub for SSO.

HotRepo's take

Teleport entered the Go daily ranking at position 8 on 2026-11-15 with 21,097 stars and 2,190 forks, gaining 2 stars that day. The long discussion history goes back to 2016, when commenters debated whether it offered enough over OpenSSH and Kerberos, and one noted its transparent bastion tier and full session auditing as the differentiator reply; an early criticism centered on missing RBAC comment, which the current README lists as a core feature. The 2016 threads also show the project fielding trust and authorization questions while it matured, rather than launching with them settled.