# 🔍 Competitive Analysis

This document tracks similar projects and competitive landscape analysis for RedFlag.

---

## Direct Competitors

### PatchMon - "Linux Patch Monitoring made Simple"

**Project**: PatchMon - Centralized Patch Management
**URL**: https://github.com/PatchMon/PatchMon
**Website**: https://patchmon.net
**Discord**: https://patchmon.net/discord
**Discovered**: 2025-10-12 (Session 2)
**Deep Analysis**: 2025-10-13 (Session 3+)
**Status**: Active open-source project with commercial cloud offering
**License**: AGPLv3 (same as RedFlag!)

**Description**:
> "PatchMon provides centralized patch management across diverse server environments. Agents communicate outbound-only to the PatchMon server, eliminating inbound ports on monitored hosts while delivering comprehensive visibility and safe automation."

---

## 🔍 DEEP DIVE: Feature Comparison

### ✅ What PatchMon HAS (Features to Consider)

#### **1. User Management & Multi-Tenancy**
- ✅ Multi-user accounts (admin + standard users)
- ✅ Roles, Permissions & RBAC (Role-Based Access Control)
- ✅ Per-user customizable dashboards
- ✅ Signup toggle and default role selection
- **RedFlag Status**: ❌ Not implemented (single-user only)
- **Priority**: MEDIUM (nice for enterprises, less critical for self-hosters)

#### **2. Host Grouping & Inventory Management**
- ✅ Host inventory with OS details and attributes
- ✅ Host grouping (create and manage groups)
- ✅ Repositories per host tracking
- **RedFlag Status**: ❌ Basic agent tracking only
- **Priority**: HIGH (useful for organizing multiple machines)

#### **3. Web Dashboard (Fully Functional)**
- ✅ Customizable dashboard with drag-and-drop cards
- ✅ Per-user card layout and ordering
- ✅ Comprehensive UI with React + Vite
- ✅ nginx reverse proxy with TLS support
- **RedFlag Status**: ❌ Not started (planned Session 4+)
- **Priority**: HIGH (core functionality)

#### **4. API & Rate Limiting**
- ✅ REST API under `/api/v1` with JWT auth
- ✅ Rate limiting for general, auth, and agent endpoints
- ✅ OpenAPI/Swagger docs (implied)
- **RedFlag Status**: ✅ REST API exists, ❌ NO rate limiting yet
- **Priority**: HIGH (security concern)

#### **5. Advanced Deployment Options**
- ✅ Docker installation (preferred method)
- ✅ One-line installer script for Ubuntu/Debian
- ✅ systemd service management
- ✅ nginx vhost with optional Let's Encrypt integration
- ✅ Update script (`--update` flag)
- **RedFlag Status**: ❌ Manual deployment only
- **Priority**: HIGH (ease of adoption)

#### **6. Proxmox LXC Auto-Enrollment**
- ✅ Automatically discover and enroll LXC containers from Proxmox
- ✅ Deep Proxmox integration
- **RedFlag Status**: ❌ Not implemented
- **Priority**: HIGH ⭐ (CRITICAL for homelab use case - Proxmox → LXC → Docker hierarchy)

#### **7. Manual Update Triggering**
- ✅ Force agent update on demand: `/usr/local/bin/patchmon-agent.sh update`
- **RedFlag Status**: ✅ `--scan` flag implemented (Session 3)
- **Priority**: ✅ ALREADY DONE

#### **8. Commercial Cloud Offering**
- ✅ PatchMon Cloud (coming soon)
- ✅ Fully managed hosting
- ✅ Enterprise support options
- ✅ Custom integrations available
- ✅ White-label solutions
- **RedFlag Status**: ❌ Community-only project
- **Priority**: OUT OF SCOPE (RedFlag is FOSS-only)

#### **9. Documentation & Community**
- ✅ Dedicated docs site (https://docs.patchmon.net)
- ✅ Active Discord community
- ✅ GitHub roadmap board
- ✅ Support email
- ✅ Contribution guidelines
- **RedFlag Status**: ❌ Basic README only
- **Priority**: MEDIUM (important for adoption)

#### **10. Enterprise Features**
- ✅ Air-gapped deployment support
- ✅ Compliance tracking
- ✅ Custom dashboards
- ✅ Team training/onboarding
- **RedFlag Status**: ❌ Not applicable (FOSS focus)
- **Priority**: OUT OF SCOPE

---

### 🚩 What RedFlag HAS (Our Differentiators)

#### **1. Docker Container Update Management** ⭐
- ✅ Real Docker Registry API v2 integration (Session 2)
- ✅ Digest-based image update detection (sha256 comparison)
- ✅ Docker Hub authentication with caching
- ✅ Multi-registry support (Docker Hub, GCR, ECR, etc.)
- **PatchMon Status**: ❓ Unknown (not mentioned in README)
- **Our Advantage**: MAJOR (Docker-first design)

#### **2. Local Agent CLI Features** ⭐
- ✅ `--scan` flag for immediate local scans (Session 3)
- ✅ `--status` flag for agent status
- ✅ `--list-updates` for detailed view
- ✅ `--export=json/csv` for automation
- ✅ Local cache at `/var/lib/aggregator/last_scan.json`
- ✅ Works offline without server
- **PatchMon Status**: ❓ Has manual trigger script, unknown if local display
- **Our Advantage**: MAJOR (local-first UX)

#### **3. Modern Go Backend**
- ✅ Go 1.25 for performance and concurrency
- ✅ Gin framework (lightweight, fast)
- ✅ Single binary deployment
- **PatchMon Status**: Node.js/Express + Prisma
- **Our Advantage**: Performance, resource efficiency, easier deployment

#### **4. PostgreSQL with JSONB**
- ✅ Flexible metadata storage
- ✅ No ORM overhead (raw SQL)
- **PatchMon Status**: PostgreSQL + Prisma (ORM)
- **Our Advantage**: Flexibility, performance

#### **5. Self-Hoster Philosophy**
- ✅ AGPLv3 (forces contributions back)
- ✅ No commercial offerings planned
- ✅ Community-driven development
- ✅ Fun, irreverent branding ("communist" theme)
- **PatchMon Status**: AGPLv3 but pursuing commercial cloud
- **Our Advantage**: Truly FOSS, no enterprise pressure

---

## 📊 Side-by-Side Feature Matrix

| Feature | RedFlag | PatchMon | Priority for RedFlag |
|---------|---------|----------|---------------------|
| **Core Functionality** | | | |
| Linux (APT) updates | ✅ | ✅ | - |
| Linux (YUM/DNF) updates | 🔜 | ✅ | CRITICAL ⚠️ |
| Linux (RPM) updates | 🔜 | ✅ | CRITICAL ⚠️ |
| Docker container updates | ✅ | ❓ | ✅ DIFFERENTIATOR |
| Windows Updates | 🔜 | ❓ | CRITICAL ⚠️ |
| Windows (Winget) updates | 🔜 | ❓ | CRITICAL ⚠️ |
| Package inventory | ✅ | ✅ | - |
| Update approval workflow | ✅ | ✅ | - |
| Update installation | 🔜 | ✅ | HIGH |
| | | | |
| **Agent Features** | | | |
| Outbound-only communication | ✅ | ✅ | - |
| JWT authentication | ✅ | ✅ | - |
| Local CLI features | ✅ | ❓ | ✅ DIFFERENTIATOR |
| Manual scan trigger | ✅ | ✅ | - |
| Agent version management | ❌ | ✅ | MEDIUM |
| | | | |
| **Server Features** | | | |
| Web dashboard | 🔜 | ✅ | HIGH |
| REST API | ✅ | ✅ | - |
| Rate limiting | ❌ | ✅ | HIGH |
| Multi-user support | ❌ | ✅ | LOW |
| RBAC | ❌ | ✅ | LOW |
| Host grouping | ❌ | ✅ | MEDIUM |
| Customizable dashboards | ❌ | ✅ | LOW |
| | | | |
| **Deployment** | | | |
| Docker deployment | 🔜 | ✅ | HIGH |
| One-line installer | ❌ | ✅ | HIGH |
| systemd service | 🔜 | ✅ | HIGH |
| TLS/Let's Encrypt integration | ❌ | ✅ | MEDIUM |
| Auto-update script | ❌ | ✅ | MEDIUM |
| | | | |
| **Integrations** | | | |
| Proxmox LXC auto-enrollment | ❌ | ✅ | HIGH ⭐ |
| Docker Registry API v2 | ✅ | ❓ | ✅ DIFFERENTIATOR |
| CVE enrichment | 🔜 | ❓ | MEDIUM |
| | | | |
| **Tech Stack** | | | |
| Backend language | Go | Node.js | ✅ ADVANTAGE |
| Backend framework | Gin | Express | ✅ ADVANTAGE |
| Database | PostgreSQL | PostgreSQL | - |
| ORM | None (raw SQL) | Prisma | ✅ ADVANTAGE |
| Frontend | React (planned) | React + Vite | - |
| Reverse proxy | TBD | nginx | MEDIUM |
| | | | |
| **Community & Docs** | | | |
| License | AGPLv3 | AGPLv3 | - |
| Documentation site | ❌ | ✅ | MEDIUM |
| Discord community | ❌ | ✅ | LOW |
| Roadmap board | ❌ | ✅ | LOW |
| Contribution guidelines | ❌ | ✅ | MEDIUM |
| | | | |
| **Commercial** | | | |
| Cloud offering | ❌ | ✅ | OUT OF SCOPE |
| Enterprise support | ❌ | ✅ | OUT OF SCOPE |
| White-label | ❌ | ✅ | OUT OF SCOPE |

---

## 🎯 Strategic Positioning

### PatchMon's Target Audience
- **Primary**: Enterprise IT departments
- **Secondary**: MSPs (Managed Service Providers)
- **Tertiary**: Advanced homelabbers
- **Business Model**: Open-core (FOSS + commercial cloud)
- **Monetization**: Cloud hosting, enterprise support, custom integrations

### RedFlag's Target Audience
- **Primary**: Self-hosters and homelab enthusiasts
- **Secondary**: Small tech teams and startups
- **Tertiary**: Individual developers
- **Business Model**: Pure FOSS (no commercial offerings)
- **Monetization**: None (community-driven)

### Our Unique Value Proposition

**RedFlag is the UNIVERSAL, cross-platform, local-first patch management tool for self-hosters who want:**

1. **True Cross-Platform Support** ⭐⭐⭐
   - **Windows**: Windows Updates + Winget applications
   - **Linux**: APT, YUM, DNF, RPM (all major distros)
   - **Docker**: Container image updates with Registry API v2
   - **Proxmox**: LXC auto-discovery and management
   - **ONE dashboard for EVERYTHING**

2. **Start Simple, Evolve Gradually**
   - Phase 1: Update discovery and alerts (WORKS NOW for APT + Docker)
   - Phase 2: Update installation (coming soon)
   - Phase 3: Advanced automation (schedules, rollbacks, etc.)

3. **Local-First Agent Tools**
   - `--scan`, `--status`, `--list-updates` on ANY platform
   - Check your OWN machine without web dashboard
   - Works offline

4. **Lightweight Go Backend**
   - Single binary for any platform (Windows, Linux, macOS)
   - Low resource usage
   - No heavy dependencies

5. **Homelab-Optimized Features**
   - Proxmox integration for LXC management
   - Hierarchical views for complex setups
   - Bulk operations

6. **Pure FOSS Philosophy**
   - No enterprise bloat (RBAC, multi-tenancy, etc.)
   - No cloud upsell, no commercial pressure
   - Community-driven
   - Fun, geeky branding

### The Proxmox Homelab Use Case (CRITICAL)

**Typical Homelab Setup**:
```
Proxmox Cluster (2 nodes)
├── Node 1
│   ├── LXC 100 (Ubuntu + Docker)
│   │   ├── nginx:latest
│   │   ├── postgres:16
│   │   └── redis:alpine
│   ├── LXC 101 (Debian + Docker)
│   │   └── pihole/pihole
│   └── LXC 102 (Ubuntu)
│       └── (no Docker)
└── Node 2
    ├── LXC 200 (Ubuntu + Docker)
    │   ├── nextcloud
    │   └── mariadb
    └── LXC 201 (Debian)
```

**Update Management Nightmare WITHOUT RedFlag**:
1. SSH into Proxmox node → check host updates
2. For each LXC: `pct enter <vmid>` → check apt updates
3. For each LXC with Docker: check each container
4. Repeat 20+ times across multiple nodes
5. No centralized view of what needs updating
6. No tracking of what was updated when

**Update Management BLISS WITH RedFlag**:
1. Add Proxmox API credentials to RedFlag
2. RedFlag discovers: 2 hosts, 6 LXCs, 8 Docker containers
3. Dashboard shows hierarchical tree: everything in one place
4. Single click: "Scan all" → see all updates across entire infrastructure
5. Approve updates by category: "Update all Docker images on Node 1"
6. Local agent CLI still works inside each LXC for quick checks

**This is THE killer feature for homelabbers with Proxmox!**

---

## 🚨 Critical Gaps We Must Fill

### CRITICAL Priority (Platform Coverage - MVP Blockers)

1. **Windows Agent + Scanners** ⚠️⚠️⚠️
   - We have ZERO Windows support
   - Need: Windows Update scanner
   - Need: Winget package scanner
   - Need: Windows agent (Go compiles to .exe)
   - **Limits adoption to Linux-only environments**
   - **Can't manage mixed Linux/Windows infrastructure**

2. **YUM/DNF/RPM Support** ⚠️⚠️⚠️
   - We only have APT (Debian/Ubuntu)
   - Need: YUM scanner (RHEL/CentOS 7 and older)
   - Need: DNF scanner (Fedora, RHEL 8+)
   - **Limits adoption to Debian-based systems**
   - **Can't manage RHEL/Fedora/CentOS servers**

3. **Web Dashboard** ⚠️⚠️
   - PatchMon has full React UI
   - We have nothing
   - Critical for multi-machine setups
   - Can't visualize mixed platform environments

### HIGH Priority (Core Functionality)

4. **Rate Limiting on API** ⚠️
   - PatchMon has it, we don't
   - Security concern
   - Should be implemented ASAP

5. **Update Installation** ⚠️
   - PatchMon can install updates
   - We can only discover them
   - Start with: APT installation (easy)
   - Then: YUM/DNF installation
   - Then: Windows Update installation
   - Then: Winget installation
   - **Phase 1: Alerts work, Phase 2: Installation**

6. **Docker Deployment** ⚠️
   - PatchMon has Docker as preferred method
   - We have manual setup only
   - Barrier to entry

7. **One-Line Installer** ⚠️
   - PatchMon has polished install experience
   - We require manual steps
   - Friction for adoption

8. **Proxmox Integration** ⚠️
   - PatchMon has LXC auto-enrollment
   - We have nothing (manual agent install per LXC)
   - User has 2 Proxmox clusters with many LXCs
   - Useful but NOT a replacement for platform coverage

### MEDIUM Priority (Nice to Have)

8. **Host Grouping**
   - Useful for organizing machines
   - Complements Proxmox hierarchy

9. **Agent Version Management**
   - Nice for fleet management
   - Less critical for small deployments

10. **systemd Service Files**
    - Professional deployment
    - Not hard to add

11. **Documentation Site**
    - Better than README
    - Important for adoption

### LOW Priority (Can Skip)

12. **Multi-User/RBAC**
    - Enterprise feature
    - Overkill for self-hosters (single-user is fine for most homelabs)

---

## 💡 Features We Should STEAL

### Immediate (Session 4-6)

1. **Rate Limiting Middleware** (HIGH)
   ```go
   // Add to aggregator-server/internal/api/middleware/
   // - Rate limit by IP
   // - Rate limit by agent ID
   // - Rate limit auth endpoints more strictly
   ```

2. **One-Line Installer Script** (HIGH)
   ```bash
   curl -fsSL https://redflag.dev/install.sh | bash
   # Should handle:
   # - OS detection (Ubuntu/Debian/Fedora/Arch)
   # - Dependency installation
   # - Binary download or build
   # - systemd service creation
   # - Agent registration
   ```

3. **systemd Service Files** (MEDIUM)
   ```bash
   /etc/systemd/system/redflag-server.service
   /etc/systemd/system/redflag-agent.service
   ```

4. **Docker Compose Deployment** (HIGH)
   ```yaml
   # docker-compose.yml (production-ready)
   services:
     redflag-server:
       image: redflag/server:latest
       # ...
     redflag-db:
       image: postgres:16
       # ...
   ```

### Future (Session 7-9)

5. **Proxmox Integration** (HIGH ⭐)
   ```go
   // Add to aggregator-server/internal/integrations/proxmox/
   // Proxmox API client for:
   // - Discovering Proxmox hosts
   // - Enumerating LXC containers
   // - Auto-registering LXCs as agents
   // - Hierarchical view: Proxmox → LXC → Docker containers

   type ProxmoxClient struct {
     apiURL string
     token  string
   }

   // Discovery flow:
   // 1. Connect to Proxmox API
   // 2. List all nodes and LXCs
   // 3. For each LXC: install agent, register with server
   // 4. Track hierarchy in database
   ```

   **Implementation Details**:
   - Use Proxmox API (https://pve.proxmox.com/wiki/Proxmox_VE_API)
   - Auto-generate agent install script for each LXC
   - Execute via Proxmox API: `pct exec <vmid> -- bash /tmp/install.sh`
   - Track relationships: `proxmox_host` → `lxc_container` → `docker_containers`
   - Dashboard shows hierarchical tree view
   - Bulk operations: "Update all LXCs on node01"

   **Database Schema**:
   ```sql
   CREATE TABLE proxmox_hosts (
     id UUID PRIMARY KEY,
     hostname VARCHAR(255),
     api_url VARCHAR(255),
     api_token_encrypted TEXT,
     last_discovered TIMESTAMP
   );

   CREATE TABLE lxc_containers (
     id UUID PRIMARY KEY,
     vmid INTEGER,
     proxmox_host_id UUID REFERENCES proxmox_hosts(id),
     agent_id UUID REFERENCES agents(id),
     container_name VARCHAR(255),
     os_template VARCHAR(255)
   );
   ```

   **User Value**:
   - One-click discovery: "Add Proxmox cluster" → auto-discovers all LXCs
   - Hierarchical management: Update all containers on a host
   - Visual topology: See entire infrastructure at a glance
   - No manual agent installation per LXC
   - KILLER FEATURE for homelab users with Proxmox

6. **Host Grouping** (MEDIUM)
   ```sql
   CREATE TABLE host_groups (
     id UUID PRIMARY KEY,
     name VARCHAR(255),
     description TEXT
   );

   CREATE TABLE agent_group_memberships (
     agent_id UUID REFERENCES agents(id),
     group_id UUID REFERENCES host_groups(id),
     PRIMARY KEY (agent_id, group_id)
   );
   ```

6. **Agent Version Tracking** (MEDIUM)
   - Track agent versions in database
   - Warn when agents are out of date
   - Provide upgrade instructions

7. **Documentation Site** (MEDIUM)
   - Use VitePress or Docusaurus
   - Host on GitHub Pages
   - Include:
     - Getting Started
     - Installation Guide
     - API Documentation
     - Architecture Overview
     - Contributing Guide

---

## 🏆 Our Competitive Advantages (Don't Lose These!)

### 1. Docker-First Design ⭐⭐⭐
- Real Docker Registry API v2 integration
- Digest-based comparison (more reliable than tags)
- Multi-registry support
- **PatchMon probably doesn't have this**

### 2. Local Agent CLI ⭐⭐⭐
- `--scan`, `--status`, `--list-updates`, `--export`
- Works offline
- Perfect for self-hosters
- **PatchMon probably doesn't have this level of local features**

### 3. Go Backend ⭐⭐
- Faster than Node.js
- Lower memory footprint
- Single binary (no npm install hell)
- Better concurrency handling

### 4. Pure FOSS Philosophy ⭐⭐
- No cloud upsell
- No enterprise features bloat
- AGPLv3 with no exceptions
- Community-first

### 5. Fun Branding ⭐
- "From each according to their updates..."
- Terminal aesthetic
- Not another boring enterprise tool
- Appeals to hacker/self-hoster culture

---

## 📋 Recommended Roadmap (UPDATED with User Feedback)

### Session 4: Web Dashboard Foundation ⭐
- Start React + TypeScript + Vite project
- Basic agent list with hierarchical view support
- Basic update list with filtering
- Authentication (simple, not RBAC)
- **Foundation for Proxmox hierarchy visualization**

### Session 5: Rate Limiting & Security ⚠️ CRITICAL
- Add rate limiting middleware
- Audit all API endpoints
- Add input validation
- Security hardening pass
- **Must be done before public deployment**

### Session 6: Update Installation (APT) 🔧
- Implement APT package installation
- Command execution framework
- Rollback support via apt
- Installation logs
- **Core functionality that makes the system useful**

### Session 7: Deployment Improvements 🚀
- One-line installer script
- Docker Compose deployment
- systemd service files
- Update/upgrade scripts
- **Ease of adoption for community**

### Session 8: YUM/DNF Support 📦
- Expand beyond Debian/Ubuntu
- Fedora/RHEL/CentOS support
- Unified scanner interface
- **Broaden platform coverage**

### Session 9: Proxmox Integration ⭐⭐⭐ KILLER FEATURE
- Proxmox API client implementation
- LXC container auto-discovery
- Auto-registration of LXCs as agents
- Hierarchical view: Proxmox → LXC → Docker
- Bulk operations by host/cluster
- One-click "Add Proxmox Cluster" feature
- **THIS IS A MAJOR DIFFERENTIATOR FOR HOMELAB USERS**
- **User has 2 Proxmox clusters → many LXCs → many Docker containers**
- **Nested update management: Host OS → LXC OS → Docker images**

### Session 10: Host Grouping 📊
- Database schema for groups
- API endpoints
- UI for group management
- Integration with Proxmox hierarchy
- **Complements Proxmox integration**

### Session 11: Documentation Site 📝
- VitePress setup
- Comprehensive docs including Proxmox setup
- API documentation
- Deployment guides
- Proxmox integration walkthrough

---

## 🤝 Potential Collaboration?

**Should we engage with PatchMon community?**

**Pros**:
- Learn from their experience
- Avoid duplicating efforts
- Potential for cooperation (different target audiences)
- Share knowledge about patch management challenges

**Cons**:
- Risk of being seen as "copy"
- Competitive tension (even if FOSS)
- Different philosophies (enterprise vs self-hoster)

**Recommendation**:
- **YES**, but carefully
- Position RedFlag as "Docker-first alternative for self-hosters"
- Credit PatchMon for inspiration where applicable
- Focus on our differentiators (Docker, local CLI, Go backend)
- Collaborate on common problems (APT parsing, CVE APIs, etc.)

---

## 🎓 Key Learnings from PatchMon

### What They Do Well:
1. **Polished deployment experience** (one-line installer, Docker)
2. **Comprehensive feature set** (they thought of everything)
3. **Active community** (Discord, roadmap board)
4. **Professional documentation** (dedicated docs site)
5. **Enterprise-ready** (RBAC, multi-user, rate limiting)

### What We Can Do Better:
1. **Docker container management** (our killer feature)
2. **Local-first agent tools** (check your own machine easily)
3. **Lightweight resource usage** (Go vs Node.js)
4. **Simpler deployment for self-hosters** (no RBAC bloat)
5. **Fun, geeky branding** (not corporate-sterile)

### What We Should Avoid:
1. **Trying to compete on enterprise features** (not our audience)
2. **Building a commercial cloud offering** (stay FOSS)
3. **Overcomplicating the UI** (keep it simple for self-hosters)
4. **Neglecting documentation** (they do this well, we should too)

---

*Last Updated: 2025-10-13 (Post-Session 3)*
*Next Review: Before Session 4 (Web Dashboard)*

---

## Potential Differentiators for RedFlag

Based on what we know so far, RedFlag could differentiate on:

### 🎯 Unique Features (Current/Planned)

1. **Docker-First Design**
   - Real Docker Registry API v2 integration (already implemented!)
   - Digest-based update detection
   - Multi-registry support (Docker Hub, GCR, ECR, etc.)

2. **Self-Hoster Philosophy**
   - AGPLv3 license (forces contributions back)
   - Community-driven, no corporate backing
   - Local-first agent CLI tools
   - Lightweight resource usage
   - Fun, irreverent branding ("communist" theme)

3. **Modern Tech Stack**
   - Go for performance
   - React for web UI (modern, responsive)
   - PostgreSQL with JSONB (flexible metadata)
   - Clean API-first design

4. **Platform Coverage**
   - Linux (APT, YUM, DNF, AUR - planned)
   - Docker containers (production-ready!)
   - Windows (planned)
   - Winget applications (planned)

5. **User Experience**
   - Local agent visibility (planned)
   - React Native desktop app (future)
   - Beautiful web dashboard (planned)
   - Terminal-themed aesthetic

### 🤔 Questions to Answer

**Strategic Positioning**:
- Is PatchMon more enterprise-focused? (RedFlag = homelab/self-hosters)
- Do they support Docker? (Our strength!)
- Do they have agent local features? (Our planned advantage)
- What's their Windows support like? (Opportunity for us)

**Technical Learning**:
- How do they handle update approvals?
- How do they manage agent authentication?
- Do they have rollback capabilities?
- How do they handle rate limiting (Docker Hub, etc.)?

---

## Other Projects in Space

### Patch Management / Update Management

**To Research**:
- Landscape (https://github.com/CanonicalLtd/landscape-client) - Canonical's solution
- Uyuni (https://github.com/uyuni-project/uyuni) - Fork of Spacewalk
- Katello (https://github.com/Katello/katello) - Red Hat ecosystem
- Windows WSUS alternatives
- Commercial solutions (for feature comparison)

### Container Update Management

**To Research**:
- Watchtower (https://github.com/containrrr/watchtower) - Auto-update Docker containers
- Diun (https://github.com/crazy-max/diun) - Docker image update notifications
- Portainer (has update features)

---

## Competitive Advantages Matrix

| Feature | RedFlag | PatchMon | Notes |
|---------|---------|----------|-------|
| **Architecture** | | | |
| Pull-based agents | ✅ | ✅ | Both use outbound-only |
| JWT auth | ✅ | ❓ | Need to research |
| API-first | ✅ | ❓ | Need to research |
| | | | |
| **Platform Support** | | | |
| Linux (APT) | ✅ | ❓ | RedFlag working |
| Docker containers | ✅ | ❓ | RedFlag production-ready |
| Windows | 🔜 | ❓ | RedFlag planned |
| macOS | 🔜 | ❓ | Both planned? |
| | | | |
| **Features** | | | |
| Update discovery | ✅ | ✅ | Both have this |
| Update approval | ✅ | ✅ | Both have this |
| Update installation | 🔜 | ❓ | RedFlag planned |
| CVE enrichment | 🔜 | ❓ | RedFlag planned |
| Agent local CLI | 🔜 | ❓ | RedFlag planned |
| | | | |
| **Tech Stack** | | | |
| Server language | Go | ❓ | Need to check |
| Web UI | React | ❓ | Need to check |
| Database | PostgreSQL | ❓ | Need to check |
| | | | |
| **Community** | | | |
| License | AGPLv3 | ❓ | Need to check |
| Stars | 0 (new) | ❓ | Need to check |
| Contributors | 1 | ❓ | Need to check |

---

## Action Plan

### Session 3 Research Tasks

1. **Deep Dive into PatchMon**:
   ```bash
   git clone https://github.com/PatchMon/PatchMon
   # Analyze:
   # - Architecture
   # - Tech stack
   # - Features
   # - Code quality
   # - Documentation
   ```

2. **Feature Comparison**:
   - Create detailed feature matrix
   - Identify gaps in RedFlag
   - Identify PatchMon weaknesses

3. **Strategic Positioning**:
   - Define RedFlag's unique value proposition
   - Target audience differentiation
   - Marketing messaging

### Questions for User (Future)

- Do you want to position RedFlag as:
  - **Homelab-focused** (vs enterprise-focused competitors)?
  - **Docker-first** (vs traditional package managers)?
  - **Developer-friendly** (vs sysadmin tools)?
  - **Privacy-focused** (vs cloud-based SaaS)?

- Should we engage with PatchMon community?
  - Collaboration opportunities?
  - Learn from their roadmap?
  - Avoid duplicating efforts?

---

## Lessons Learned (To Update After Research)

**What to learn from PatchMon**:
- TBD after code review

**What to avoid**:
- TBD after code review

**Opportunities they missed**:
- TBD after code review

---

*Last Updated: 2025-10-12 (Session 2)*
*Next Review: Session 3 (Deep dive into PatchMon)*