Softwr

Automation Integration · head to head

jBPM vs Nebula

jBPM logo

jBPM

Automation Integration

Long-running Java BPMN engine, now developed inside Apache KIE with commercial support from IBM

From
Free
Rated
-
Full reviewWebsite
Nebula logo

Nebula

Networking

Certificate based overlay network from Slack, with identity and firewall rules carried in the certificate

From
Free
Rated
-
Full reviewWebsite

The short version

  • Each has a real cost: jBPM the project moved to the Apache Software Foundation as Apache KIE and is still in incubation, which is a weaker governance signal than a vendor-owned product and a harder case to make to an architecture board.; Nebula the open source project has no user interface, no enrolment workflow and no revocation service, so certificate issuing, distribution and expiry become scripts you write and then have to keep working.
  • They diverge on capability: jBPM covers BPMN 2.0 execution, Nebula covers Certificate carried identity.
  • Prices and features above were last checked on 31 August 2026.

Where they differ

Only the attributes on which jBPM and Nebula actually diverge.

Attributes where jBPM and Nebula differ
AttributejBPMNebula
PlatformsLinux, Windows, Docker, KubernetesLinux, macOS, Windows, iOS, Android, FreeBSD
CategoryAutomation IntegrationNetworking

Identical on both: starting price (Free), pricing model (Open source, no licence fee), free tier (Yes), user rating (Not yet rated).

What each one covers

Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.

Only in jBPM

  • BPMN 2.0 execution
  • Drools integration
  • Human task service
  • Kogito compilation
  • Process designer
  • Timers and signals
  • REST and Java APIs
  • Case management

Only in Nebula

  • Certificate carried identity
  • Group based host firewall
  • Lighthouse discovery
  • Noise protocol encryption
  • Unsafe routes
  • Managed option

What people use each for

The jobs each tool is most often brought in to do.

jBPM

  • A Java organisation already running jBPM 7 that needs to decide between the Apache KIE line, Kogito or migration awaynot Nebula
  • A team that wants BPMN processes and Drools business rules executing in one runtime without integrating two productsnot Nebula
  • A government or banking system with long-running processes needing durable timers and full audit history at no licence costnot Nebula
  • A Quarkus estate adopting Kogito to run compiled processes with container-appropriate startup timesnot Nebula

Nebula

  • Flattening a network across several clouds and datacentres without VPC peering or route tablesnot jBPM
  • Very large fleets where a central policy service on the connection path is unacceptablenot jBPM
  • Environments that already run an internal certificate authority and want the network to use itnot jBPM
  • Replacing per host iptables rules with policy written against roles that follow the hostnot jBPM

Where each one falls short

Documented limitations, not opinions. Every one is a constraint you would hit in normal use.

jBPM

  • The project moved to the Apache Software Foundation as Apache KIE and is still in incubation, which is a weaker governance signal than a vendor-owned product and a harder case to make to an architecture board.
  • The classic jBPM 7.x line has not had a Red Hat-sponsored release since 2023, so staying on it means running effectively frozen software while the development happens under a different name.
  • Kogito is architecturally different from the classic runtime, using ahead-of-time compilation, so moving forward is a migration project rather than a version upgrade.
  • Commercial support has shifted to IBM Business Automation Manager Open Editions, which means renegotiating with a different vendor under different terms than Red Hat customers signed.
  • The tooling and workbench have long been the weakest part, and organisations routinely build their own process administration interfaces because the shipped ones are dated.

Nebula

  • The open source project has no user interface, no enrolment workflow and no revocation service, so certificate issuing, distribution and expiry become scripts you write and then have to keep working.
  • Revoking a compromised host means distributing a blocklist entry to every other host and reloading them, which is a fleet wide operation rather than a click, and easy to get wrong under pressure.
  • Changing a host group membership means reissuing and redeploying its certificate, so policy changes are a deployment rather than a configuration edit.
  • There is no identity provider integration or single sign on in the open source version, so it maps well to servers and badly to a fleet of user laptops.
  • NAT traversal is best effort and hosts behind symmetric NAT need a relay configured deliberately, so connectivity failures show up as intermittent rather than immediate and are awkward to diagnose.

Pricing, plan by plan

jBPM

Free
  • jBPMFree
    • Apache 2.0 licence with no usage restrictions
    • Full BPMN engine, human tasks and Drools integration
    • Community support via Apache KIE mailing lists

Nebula

Free
  • NebulaFree
    • Full functionality under the MIT licence
    • No host limit
    • You operate the certificate authority and lighthouses
  • Defined Networking$undefined/month
    • Hosted control plane and enrolment
    • Managed certificate lifecycle and revocation
    • Policy and DNS interface

Which should you pick?

Choose jBPM if

  • You need bpmn 2.0 execution.
  • You want to start without paying.
  • You work on Linux, Windows, Docker, Kubernetes.
  • You also want drools integration.
jBPM review

Choose Nebula if

  • You need certificate carried identity.
  • You want to start without paying.
  • You work on Linux, macOS, Windows, iOS, Android, FreeBSD.
  • You also want group based host firewall.
Nebula review

Questions people ask

Is jBPM or Nebula better?
Neither clearly leads. jBPM starts at Free and Nebula at Free, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
Which is cheaper, jBPM or Nebula?
jBPM starts at Free and Nebula at Free.
Does jBPM or Nebula run on more platforms?
jBPM runs on Linux, Windows, Docker, Kubernetes. Nebula runs on Linux, macOS, Windows, iOS, Android, FreeBSD.
Can I use jBPM for free?
Both have a free tier, so you can try either at no cost before committing.
What is jBPM best used for?
jBPM is most often used for a java organisation already running jbpm 7 that needs to decide between the apache kie line, kogito or migration away, a team that wants bpmn processes and drools business rules executing in one runtime without integrating two products, a government or banking system with long-running processes needing durable timers and full audit history at no licence cost, a quarkus estate adopting kogito to run compiled processes with container-appropriate startup times. Of those, a java organisation already running jbpm 7 that needs to decide between the apache kie line, kogito or migration away and a team that wants bpmn processes and drools business rules executing in one runtime without integrating two products are not what Nebula is typically brought in for.
What can jBPM do that Nebula cannot?
jBPM covers BPMN 2.0 execution, Drools integration, Human task service, Kogito compilation. Nebula covers Certificate carried identity, Group based host firewall, Lighthouse discovery, Noise protocol encryption.

Answered from the vendors’ own pages

jBPM: Is jBPM dead?

No. Development continues as part of Apache KIE, with releases through 2025, but the Red Hat-sponsored 7.x line has been static since 2023.

Nebula: Does it use WireGuard?

No. Nebula predates the common WireGuard mesh tools and uses the Noise protocol framework with its own certificate format.

jBPM: Who provides commercial support?

IBM, through Business Automation Manager Open Editions, following the transition away from Red Hat Process Automation Manager as a growth product.

Nebula: Can I run it without Defined Networking?

Yes, entirely. Defined Networking sells the control plane conveniences, not the network itself.

jBPM: What is Kogito?

The cloud-native successor that compiles processes ahead of time for Quarkus and Spring Boot, architecturally different from the classic jBPM runtime.

Nebula: How do I revoke a host?

Add its certificate fingerprint to the blocklist in the configuration of the other hosts and reload them. There is no online revocation check.

jBPM: Does it cost anything?

No. It is Apache 2.0 licensed with no fee. Costs are support contracts and the engineering effort to run it.

Nebula: Is it a good fit for laptops?

Less so than the identity provider based tools. There is no single sign on, so every laptop needs a certificate issued and renewed by whatever process you build.

Share

Related pages

More on jBPM

More on Nebula

Keep looking

Other head to heads