CO-37 Core Operations Manager
CO-37 is self-hosted, agent-based patch management for Windows and Linux hosts with Checkmk integration. 15 hosts free — perfect for homelabs, test environments and small businesses. CO-37 also works exceptionally well in air-gapped environments. Supported platforms: Windows, Red Hat, SUSE and Debian/Ubuntu.
See pending updates on Linux and Windows hosts at a glance, run patches manually, and set your own schedules. Integrate with Checkmk, and plan reboots and downtimes. Hosts enrol themselves, an administrator approves them — from then on they are part of the system and can be managed. The heartbeat drives follow-up scans after a patch run and clears out stuck jobs.
Windows, Red Hat, SUSE Linux Enterprise/openSUSE Leap and Debian/Ubuntu — .msi, .rpm and .deb, all built from a single codebase. One version number for server, agent and watcher.
Through the official REST API. Downtimes are set automatically before reboots, for the configured duration, or manually whenever you need one.
Schedules, follow-up scans and clearing stuck jobs are all handled on the heartbeat — there is no separate scheduling service alongside it that could drift out of step.
Release package and agent code are signed with Ed25519. The signature is checked twice — in the backend on upload and in the watcher before unpacking — and an older package is rejected.
No permanent admin key. Every login is bound to a session, TOTP is available as a second factor, and running or scheduling a reboot needs its own permission, granted per account.
By default, new agent versions go to a pilot host first; the rest follow only once it has reported the new version. Optionally all at once — or not automatically at all.
For anyone who wants to run patch management centrally, with a clear overview — from the homelab through small and mid-sized businesses to the IT service provider with many customer instances.