openziti/ziti

What is it?

Key features

• 01Dark services with no listening ports, invisible to scanners and unauthorized users.
• 02Cryptographic identities for users, services, devices, and non-human workloads.
• 03Policy-based, per-service access control that can be revoked in real time.
• 04End-to-end encryption using libsodium for data and mTLS for authentication.
• 05Tunnelers for existing applications and SDKs for embedding directly in code.
• 06REST management API and web-based admin console.

Use cases

• Replacing VPN access to internal services with per-service authorization.
• Connecting services across multiple clouds, on-prem data centers, and edge sites.
• Exposing self-hosted services like Home Assistant without open router ports.
• Securing machine-to-machine and IoT connections with unique device identities.

Quick start

1. 1

   Download the compose file with wget

   wget https://get.openziti.io/dock/all-in-one/compose.yml
2. 2

   Start the local network with Docker Compose

   docker compose up
3. 3

   Download the ziti binary from the GitHub releases page

4. 4

   Bring up a local development network with the CLI

   ziti edge quickstart

Things to know

• !The quick starts set up a local development network, and production deployments are covered by separate product documentation.
• !Production use requires self-hosting effort and configuring identities, services and policies.

In collections

Topics

FAQ

What is ziti?

Open-source zero-trust networking platform that makes services invisible to unauthorized users, with identity-based access and end-to-end encryption. OpenZiti is a zero-trust overlay network. Every user, service, device, or workload gets a cryptographic identity, and each connection must pass identity checks and an access policy before it is allowed. Services run with no listening ports, so they cannot be scanned or reached by unauthorized clients.

Is ziti free to use? What license does it have?

ziti is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is ziti still maintained?

Actively maintained. The last commit to ziti was on Nov 7, 2026.

What can I use ziti for?

Replacing VPN access to internal services with per-service authorization. Connecting services across multiple clouds, on-prem data centers, and edge sites. Exposing self-hosted services like Home Assistant without open router ports. Securing machine-to-machine and IoT connections with unique device identities.

How do I install ziti?

Download the compose file with wget: wget https://get.openziti.io/dock/all-in-one/compose.yml Start the local network with Docker Compose: docker compose up Download the ziti binary from the GitHub releases page Bring up a local development network with the CLI: ziti edge quickstart

Where can I get ziti?

The source code and installation instructions are on GitHub: https://github.com/openziti/ziti