Headwind MDM on Ubuntu 24.04 LTS

Headwind MDM is an open source Mobile Device Management server for Android. It gives you a single admin console and a REST API to enrol company devices, push configurations, applications and policies over the air, group devices, and monitor the state of your estate. It is an established self hosted alternative to proprietary MDM services, with full source code access and no vendor lock in. This cloudimg image runs the official open source Headwind MDM 5.40.1 web application on Apache Tomcat 9 with a bundled PostgreSQL 16 database on Ubuntu 24.04 LTS.

Deploying Headwind MDM yourself means installing a servlet container, provisioning a database, fetching and deploying the web application, wiring a reverse proxy, disabling the default administrator account and generating a device shared secret. This image does all of that for you. The application and its database run as pinned containers on a private network under one systemd unit, the application is published to loopback only, the database is exposed on no host port at all, and an nginx reverse proxy fronts the console and the REST API on port 80 alongside an unauthenticated health endpoint for load balancer probes. Your fleet, configurations and uploaded application files live on a dedicated, independently resizable data disk.

Secure by default is the point of this image. Upstream Headwind MDM seeds a default administrator account and a static device shared secret when it first creates its database. On this image the administrator password, the device shared secret and the database password are all generated as unique random values on the first boot of your virtual machine and stored in a root only file, and the reverse proxy refuses every console route until that replacement has completed and been verified. The upstream default is therefore never reachable over the network, not even during initialisation, and the design fails closed rather than open. Build time state is wiped before capture, so your database, administrator account and every secret are created fresh on your own virtual machine.

The public enrolment base URL is resolved to your virtual machine's own address at first boot, so the server works immediately, and it is fully customer configurable afterwards; no domain is ever baked in. Browse to the virtual machine on port 80, sign in with the generated administrator credentials, set your enrolment URL, and start enrolling Android devices.

Headwind MDM is distributed under the Apache License 2.0, free and open source with no per device or per deployment fee. This image ships the open source community server only. cloudimg is not affiliated with or endorsed by Headwind MDM or h-mdm.com; the name is used only to identify the software included. cloudimg provides the packaging, the secure by default configuration, the per instance secret automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.