Now with zero-touch Apple & Windows enrollment
Provision every developer's workstation before their first standup.
DevRig is the CLI developers already love for bootstrapping a laptop. DevRig Enterprise scales it to thousands of machines — with policy, identity, audit and drift control your security team signs off on.
$ brew install devrig
$ devrig apply backend-engineer
✔ 12 repos cloned · 9 tools installed · 4 access requests sent · configs pulledPlatform
Built for the whole fleet
Everything a security team needs to say yes, and everything a developer needs to never think about setup again.
Zero-touch onboarding
New hires unbox, sign in, and DevRig provisions the whole workstation — tools, dotfiles, secrets and access-groups — before their first standup.
Policy & compliance
Define golden configs as code. Enforce disk encryption, OS baselines and required agents across every machine, continuously.
SSO & SCIM
Wire DevRig to Okta, Entra or Google. Provisioning follows your directory — access-groups is granted on hire and revoked on offboard.
Fleet-wide audit logs
Every provision, override and secret access-groups is recorded and streamable to your SIEM. Answer “who changed what” in seconds.
Drift detection & repair
DevRig watches for configuration drift and reconciles machines back to their declared state — or alerts you when it can’t.
Remote & air-gapped
Provision laptops shipped straight to a home office, or run fully on-prem behind your own artifact mirror. No blockers.
Declarative
Config as code, secured
One reviewed file declares the entire workstation: enforced policy, toolchains, repos, access groups and secrets that never touch disk. Ship it through a pull request, apply it with one command, and let drift control keep it true.
- Policies enforced continuously, not just at install time
- Secrets pulled from Vault at runtime, never written to disk
- Access follows your directory — granted on hire, revoked on offboard
profile: backend-engineer
policy: baseline
enforce:
disk_encryption: required
os_min: "macOS 14.4"
agents: [osquery, vpn, edr]
repos:
- acme/platform-api
- acme/billing
install: [node, go, docker]
access:
- staging-deploy
- prod-read
configs:
source: vault://eng/runtime
write_to_disk: false
identity:
sync: okta
group: engineeringCLI vs. Enterprise
Start free. Scale when the fleet does.
The CLI is free forever, no account required. Enterprise adds the control plane your security and IT teams need.
| Capability | DevRig CLI | Enterprise |
|---|---|---|
| Declarative machine configs | Included | Included |
| One-command local setup | Included | Included |
| Centralized fleet dashboard | Not included | Included |
| SSO / SCIM directory sync | Not included | Included |
| Compliance policy enforcement | Not included | Included |
| Audit logs & SIEM export | Not included | Included |
| Drift detection & auto-repair | Not included | Included |
| SLA-backed support | Not included | Included |
Give every engineer a perfect machine on day one.
See it running against your identity provider and policies in a 30-minute demo — or try the CLI right now.
brew install devrig