Engineering metrics
Self-hosted DORA metrics: the open-source options
The short version.
- "Open-source DORA tool" spans everything from a raw warehouse you wire up yourself to a finished product you deploy in an afternoon.
- Apache DevLake — the pipeline. Broadest connectors, Apache governance, you build the dashboards.
- Middleware — the lean option. Fastest path if the four keys are genuinely all you need.
- Deckgauge — the finished product. DORA next to flow, review quality, roadmaps and org data on day one.
- Pick on how much platform work you want to own, not on feature counts.
If you want DORA metrics but would rather not pipe your delivery data through someone else's cloud, you have more open-source options in 2026 than you probably realise. The catch is that the category covers wildly different shapes of thing. Here is an honest map, and how we would pick.
Why self-host DORA metrics at all?
Two reasons come up again and again with the teams we advise.
The first is data gravity. DORA is computed from your commits, pull requests, deployments and incidents — arguably some of the most sensitive operational data you have. Plenty of regulated organisations simply cannot hand that to a per-seat SaaS, and plenty more can but would spend two quarters in security review doing it. Self-hosting turns a procurement project into an infrastructure ticket.
The second is trust. When the metric lands on a dashboard, the first question a sharp engineer asks is "how is that number actually calculated?" With a self-hosted, open-source tool you can read the query. With a black box you can only argue about it — and you will lose that argument, because the person disputing the number has read more of the surrounding code than the dashboard has.
A third reason worth naming: cost shape. Per-seat SaaS scales with headcount, which means the tool you use to understand your team gets more expensive every time the team grows. Self-hosted analytics scales with data volume, and engineering metadata is small.
The open-source contenders
Apache DevLake — the pipeline
DevLake is the heavyweight. It ingests from a wide range of sources and models the data cleanly into a shared schema, then hands you Grafana to build dashboards on top. It is powerful, genuinely vendor-neutral, and governed by the Apache Software Foundation under Apache 2.0 — which for some organisations is decisive on its own.
It is infrastructure, not a product. You will spend real time on deployment, source configuration, and dashboard work before a leader sees a number they trust. The pre-built dashboards get you a first chart quickly; adapting them to your workflow states, issue types and definition of done is where the time actually goes. We wrote the longer take in DevLake gives you a database, we give you the product.
Middleware — the lean option
Middleware is self-hosted, open source, and aimed squarely at the four keys. If DORA is genuinely all you need and you want it running this week, it is hard to beat on time to value. The trade is scope: when the inevitable next question arrives — why is lead time rising, who is carrying review, where is work stuck — you will be adding another tool.
Grafana plus a warehouse — the DIY route
Often fed by DevLake. Maximum control, maximum maintenance. Correct when you have data engineering capacity and genuinely business-specific metric definitions; a slow-motion mistake when you do not, because the dashboards become a piece of untested software with one author who eventually changes team.
Deckgauge — the finished product
We built Deckgauge to be the thing you open rather than the thing you assemble. DORA lands next to flow, review quality, roadmaps and org data on day one, self-hosted, with a documentation page per widget explaining what each number means and how it can mislead you. Source-available under the FSL rather than Apache 2.0, and maintained by one company rather than a foundation — both real differences worth weighing.
Side by side
| Apache DevLake | Middleware | Deckgauge | |
|---|---|---|---|
| Shape | Data pipeline + Grafana | Focused DORA app | Full intelligence product |
| Licence | Apache 2.0 | Open source | Functional Source License |
| Governance | Apache Foundation | Single vendor | Single vendor (CodPal) |
| Four DORA keys | Yes | Yes | Yes, with benchmark tiers |
| Flow & review metrics | Build them | Limited | Included |
| Roadmaps / org views | No | No | Included |
| Own the data model | Yes — its main strength | No | Partly |
| Time to a trusted number | Days to weeks | Hours | Hours |
| Best when | You want a warehouse | You only need DORA | You want the whole picture |
How to choose
Be honest about how much platform work you actually want to own — that single question decides it more reliably than any feature comparison.
- You have a data team that wants a warehouse → DevLake or a Grafana stack. Owning the model is a feature for you, not a cost.
- You need the four keys and nothing else, quickly → Middleware.
- You want DORA inside a broader picture — flow, review quality, planning accuracy, who is overloaded — without assembling it → that is the gap we built Deckgauge to fill.
- Foundation governance is a hard requirement → DevLake. We are a single vendor and cannot offer that.
Deckgauge is a full open-source alternative to Jellyfish and LinearB, not just a DORA widget — and if you are comparing against Swarmia specifically, that comparison is here.
Whatever you pick, keep the numbers honest
One warning applies to every tool on this list. DORA is trivial to game the moment it becomes a personal target, and most tools quietly fudge the metrics they cannot truly measure. Deployment frequency and time to restore are estimates until you connect a real deployment or incident source — a good tool labels them as proxies rather than pretending. We go deep on this in DORA metrics without gaming them; it matters more than which logo is on the dashboard.
Frequently asked
- What are the open-source options for self-hosted DORA metrics?
- Apache DevLake, a data pipeline that normalises engineering data and ships Grafana dashboards over it; Middleware, a lean self-hosted tool focused on the four keys; a fully DIY warehouse plus Grafana; and Deckgauge, which delivers DORA alongside flow, review quality, roadmaps and org data as a finished product. All are free and self-hosted.
- Why self-host DORA metrics instead of using a SaaS?
- Two reasons dominate. Data gravity: DORA is computed from commits, pull requests, deployments and incidents, which is some of the most sensitive operational data a company has, and many regulated organisations cannot hand it to a per-seat SaaS. And trust: when a number is disputed, being able to read the query that produced it settles the argument, where a black box only prolongs it.
- Which self-hosted DORA tool is fastest to get running?
- Middleware if you only need the four keys, and Deckgauge if you want DORA to sit inside a broader picture — both are designed to be stood up and read rather than assembled. DevLake gets you data quickly but the time goes into adapting its Grafana dashboards to your workflow states and definitions of done.
- Can you get accurate DORA metrics without a deployment tool?
- Only partly. Lead time for changes can be measured directly from commit and merge timestamps. Deployment frequency and time to restore have to be inferred unless you connect a real deployment or incident source, so they are proxies. Any tool presenting them as measurements without that connection is overstating what it knows.
- Is Deckgauge open source?
- It is source-available under the Functional Source License: you can read, run, modify and self-host it for any purpose except building a competing commercial product. Apache DevLake, by comparison, is Apache 2.0 under Apache Software Foundation governance, which is a genuinely more permissive arrangement and matters to some organisations.
Deckgauge is free and runs in your own stack — deploy it yourself and read exactly how each metric is built. If you would rather have a fractional CTO stand it up and interpret your numbers with you, book an Engineering Health Check.