STCourses/reports/Open source course platforms.md

Build a new core from proven parts

No existing open-source project fits all three audiences (homelabbers, universities, companies) well enough to adopt as-is, and none is a sensible fork target. The best path is to build a new, modern core that is multi-tenant from day one and standards-first, and to assemble it from mature open-source building blocks. Open edX is the closest functional match. It has a modern React frontend, certificates, Tutor packaging and plugin-based multi-tenancy. It is also the heaviest to operate, is AGPL-licensed, changes its frontend architecture every release until mid-2027, and has deprecated its own ecommerce service. The newer projects each miss something essential. Frappe Learning has the broadest fully open feature set but weak standards support. LearnHouse has the best authoring UX, but payments, SSO, SCORM and multi-org are paid Enterprise features. ClassroomIO has pivoted to B2B customer training. CourseLit has nearly stalled. Moodle is easy to self-host but dated. Canvas's public repository has had no pushes since April 2026. The gaps are what make the product worth building: a combined LTI 1.3 platform and tool, cmi5 and xAPI with an embedded learning record store (LRS, which stores learner activity records), Open Badges 3.0 credentials, a native HLS video pipeline, hands-on labs, connectors to commercial course catalogs, and a "point at a folder" library for homelabbers. Two market events make the timing good: the Coursera–Udemy merger and Pluralsight's lender takeover both raise vendor-continuity risk for organizations that rely on them. Throughout this report, claims that the research notes marked as unverified background knowledge are labelled that way.

Twelve candidates exist, but none covers homelab to enterprise

The candidates fall into three tiers. The first tier is institutional LMSs (Moodle, Open edX, Canvas, Sakai, ILIAS, Chamilo). The second is modern lightweight platforms (Frappe Learning, LearnHouse, ClassroomIO, CourseLit). The third is WordPress plugins (Tutor LMS, LearnPress, Sensei, LifterLMS, MasterStudy) and small niche projects. The table summarizes the state as of 30 October 2026. Cells marked † come from background knowledge that the research did not re-verify in 2026.

Platform	License	Stack	Health (Oct 2026)	Multi-tenancy	Standards	Commerce	SSO	Self-host ease
Open edX	AGPL-3.0	Django + React MFEs, via Tutor	8.2k stars, 1,254 commits/yr, Verawood Jul 2026	eox-tenant plugin (AGPL, niche)	LTI block, SCORM XBlock†, xAPI analytics (Aspects)†	Legacy service deprecated, replacement unclear	SAML permanent in Verawood; OAuth2/OIDC†	Heavy (Docker/K8s, ~8 GB†)
Moodle	GPL-3.0	PHP monolith	7.6k stars, 3,228 commits/yr, 5.3 LTS Oct 2026	Paid Workplace, or open-source IOMAD	LTI 1.3 certified†, SCORM 1.2 strong, 2004 partial†	Payment subsystem; PayPal in core, Stripe via plugin†	OIDC/LDAP in core, SAML via plugin†	Easiest
Canvas OSS	AGPL-3.0	Rails + React	No pushes since 30 Apr 2026	Sub-accounts (not isolated)†	Strong LTI/CC/QTI†	Proprietary add-on†	SAML/LDAP/OIDC/CAS†	Hard; no official Docker image
Sakai	ECL-2.0 (permissive)	Java/Tomcat (JDK 17)	823 commits/yr, 25.2	Sites†	Strong LTI 1.3, CC, QTI†	Weak†	Strong SAML/Shibboleth†	Moderate
ILIAS	GPL-3.0	PHP	2,188 commits/yr, three supported branches	n/a	Strongest: SCORM 2004, xAPI/cmi5, LTI†	Limited shop†	Strong SAML†	Easy
Chamilo 3.0	GPL-3.0	Symfony + Vue 3 + Tailwind	5,950 commits/yr; stable since Sep 2026	Hierarchical multi-URL	Improved SCORM 2004 runtime	BuyCourses plugin with subscriptions	n/a	Easy
Frappe Learning	AGPL-3.0	Frappe (Python) + Vue + MariaDB	3.4k stars, 96 contributors, v2.68.0	Not documented	SCORM import only	Built-in payment gateway	Frappe OAuth†	Easy (easy-install.py)
LearnHouse	AGPL-3.0 + Enterprise License	Next.js + FastAPI + Postgres + Yjs	2.4k stars, 1.4.3; single lead maintainer	Enterprise only	SCORM Enterprise only	Enterprise only	Enterprise only	Easy (CLI with backup/doctor)
ClassroomIO	AGPL-3.0 (commercial licenses sold)	SvelteKit + Hono + Postgres	1.7k stars, very active; pivoted to B2B	Multi-org academies	None found	Paid tiers	Enterprise only	Fragile (MinIO breakage)
CourseLit	AGPL-3.0	Next.js + MongoDB	1 commit in 90 days, 15 contributors	n/a	None found	Stripe	n/a	Weak; paid MediaLit media service

Sources for the table: GitHub repositories for edx-platform, moodle, canvas-lms, sakai, ILIAS, chamilo-lms, frappe/lms, learnhouse, classroomio and courselit; the Verawood dev/op notes; the Chamilo v3.0.0 notes; and selfhosting.sh.

Licensing narrows the options before any feature comparison. Almost every modern candidate is AGPL-3.0, and so are Open edX and Canvas. The AGPL requires anyone running a modified version as a hosted service to publish their source changes. GPLv3 (Moodle, ILIAS, Chamilo) only requires source when the software is distributed, so a privately modified SaaS fork is allowed. Sakai's ECL-2.0 permits proprietary forks. These readings come from background knowledge of the license terms, not legal advice. The other main differences are in health. Open edX, Moodle, Chamilo, ILIAS and Frappe Learning all have strong release trains. Canvas's silence after April 2026 stands out: the repository recorded 4,314 commits in the preceding year, so six silent months is a serious warning sign. It could be a mirroring pause, though, and no Instructure announcement was found (canvas-lms). A secondary source says Instructure restructured Canvas into Core, Plus and Next tiers in April 2026 and still offers a self-hosted OSS edition. That source is unverified (bit4learn).

The WordPress plugins are actively shipped. Tutor LMS v4.2.0 and Sensei 4.26.4 both came out in autumn 2026. All of them use a freemium model where certificates, subscriptions and advanced grading sit in paid Pro add-ons (themeum/tutor; Automattic/sensei; learningrevolution.net). They suit solo creators but do not give a multi-tenant, standards-driven foundation. Among the niche projects, Pupilfirst (last release October 2024) and Leemons (last push May 2025) look stalled. Richie (MIT, Django CMS) is worth studying as a reference for catalog and portal UX (openfun/richie). awesome-selfhosted's "Learning and Courses" list still omits all four modern platforms, a sign of how young that tier is (awesome-selfhosted).

Open edX comes closest, but operating it is expensive

Open edX is the obvious "build on top" candidate. It is designed for MOOC-scale catalogs, ships built-in certificates, and offers many extension points: XBlocks, Django plugins, hooks and filters, and frontend plugin slots (fulcrum.rocks; Verawood notes). Verawood, the 22nd community release, shipped on 30 July 2026. It added an AI Extensions Framework, a new Instructor Dashboard, and PostgreSQL support for fresh installs. Tutor v22.0.3 packaged it by 27 October (Verawood product notes; tutor).

The cost shows up in Open edX's own release notes. By Xylon (June 2027), every frontend is being converted to a new "frontend-base" architecture. The older server-side filters are being replaced by frontend slots. Legacy Libraries are deprecated and must be migrated. Aspects analytics v4 is a breaking upgrade. Search is pinned to Typesense ≥ v30. A course-ID uniqueness migration can fail with an IntegrityError (Verawood dev/op notes). The release working group held Verawood back until test completion passed 80% (BTR notes). Any UI customization therefore has to be redone every six months until mid-2027.

Commerce is the decisive weakness for a Udemy-style product. The legacy Django Oscar ecommerce service was "last tagged for the Redwood release", and maintainers say "we are not fixing bugs or developing new features for it". Its replacement, the Commerce Coordinator, was shaped around 2U's needs, and the research could not confirm it is usable by others (ecommerce deprecated docs; DEPR #22). Multi-tenancy depends on eduNEXT's eox-tenant, which is maintained (v14.4.0, June 2026) but has only 13 stars (eox-tenant). Open edX's own installation docs expect operators to diagnose system problems from the command line (install docs). The often-quoted 4–8 GB RAM floor is unverified background knowledge. Either way, Open edX is a poor fit for a homelabber who wants a single docker compose up. Forking edx-platform would mean absorbing its six-monthly breaking changes under the AGPL. Building on top of it through plugins and frontend slots is the only realistic Open edX route.

The other institutional LMSs serve better as references or niche bases. Moodle is the easiest to self-host and has a deep plugin ecosystem. Version 5.3 LTS shipped in October 2026 (moodle.org). Its UI improvements are evolutionary, though (3rdwavemedia), and a modern single-page frontend would mean rewriting the UI on top of its web services. Its isolated multi-tenancy is the paid Workplace edition, which partners estimate at about $12k/yr for 1,000 users. The free alternative is IOMAD (compono; e-learndesign). Chamilo 3.0 is the dark horse. It uses Symfony with Vue 3 and Tailwind and offers hierarchical multi-URL tenancy. It also has a BuyCourses plugin with monthly and yearly subscriptions, improved SCORM 2004 runtime fields, certificate expiry, and an MCP server for AI clients. However, it only became stable in September 2026, and its contributors are concentrated around the BeezNest company (v3.0.0 notes). ILIAS and Sakai reportedly have the strongest university standards support: ILIAS for SCORM 2004 and cmi5, and Sakai for LTI, which Dr. Chuck led. That support is unverified background knowledge. Both are university-oriented and do not offer a consumer-grade catalog UX. Canvas still leads on usability ratings (selfhosting.sh). Its video, New Quizzes, Catalog and Credentials products are reportedly proprietary (unverified background), and its repository is silent, so treat it as a UX and API reference only.

Modern challengers either paywall or omit enterprise features

The modern platforms have the UX and stacks the user wants. Each one, though, leaves out or charges for a feature that universities and companies need.

Frappe Learning is the healthiest. It is backed by Frappe Technologies, has 96 contributors, and releases v2.x builds almost weekly (v2.68.0 on 28 October 2026). It has no paid tier inside the app because revenue comes from hosting (frappe/lms). Its open feature set is the broadest of the four modern platforms. It covers programs/learning paths, batches (cohorts) with seat limits, Zoom and Meet live classes, quizzes, assignments, and auto-issued certificates. It also supports SCORM upload and payments for courses, batches or certificates (Frappe Learning docs). Its limits are structural. It only imports SCORM, and SCORM export is still an open request (#1781). Sales tax at checkout is missing (#2349). Multi-tenancy is undocumented. The whole Frappe/MariaDB stack comes along with it, and the v15→v16 upgrade broke the stable Docker image (#2350) (#1781; #2349; #2350). Note that one 2026 article calls Frappe LMS "MIT". GitHub reports AGPL-3.0, so the article is wrong (lmspedia).

LearnHouse has the most modern authoring experience. It offers a Notion-like Tiptap editor, real-time collaboration, code execution with auto-grading in 30+ languages, AI playgrounds and an AI tutor. Its self-host CLI is also the friendliest, with setup, backup and doctor commands (learnhouse). But it is explicitly open-core. Its README marks Payments, SSO and Multi-Org as "(Enterprise)". The repository ships only SCORM stubs under ee-stub, and the pricing page puts SCORM, RBAC, audit logs, white-labelling and the self-hosted option in the Enterprise tier (repo tree; pricing). Forking it means rebuilding exactly the features the target audiences need, from a project led by one maintainer. Open bugs such as "Subscriptions are not working" (#1182) add to the risk (#1182).

ClassroomIO has multi-org academies on custom domains, a REST API, webhooks and an MCP server. It now describes itself as "an intelligent customer training platform" for SaaS companies. SSO is in its Enterprise tier, and the company sells commercial licenses on top of the AGPL (classroomio; pricing). Self-hosters have hit broken bundled MinIO images and video transcription stuck "in progress" (issues). CourseLit describes itself as a Teachable/Thinkific alternative with Stripe and a page builder. It has had one commit in three months, its users have been asking for multi-language support since 2024 (#508), and its media handling goes through the paid MediaLit service unless you self-host MediaLit (courselit; #508).

The pattern is the same across all four. The research found no evidence of LTI 1.3 in any of them (code search was rate-limited, so this is unconfirmed). None has xAPI or cmi5. None is a multi-instructor marketplace with revenue share. In two of them, the SSO that companies require is paid.

Every project falls short on standards, video and labs

Purchased content shapes the design more than the inspiration brands suggest. Commercial libraries are almost never handed over as files. They appear inside the customer's LMS through catalog sync and launch links, and progress flows back over xAPI or APIs. LinkedIn Learning integrates through LTI 1.3 with all three Advantage services. Deep Linking can launch a specific video segment, Assignment and Grade Services syncs grades, and Names and Roles Provisioning syncs rosters (Microsoft Learn). Udemy Business sends near-real-time xAPI statements to a customer LRS over OAuth, but only on its Enterprise plan (Udemy Business xAPI). Go1 exports SCORM only through a paid add-on (Go1 help). The industry pattern is "metadata local, media remote". A platform that hosts purchased courses therefore needs five pieces: an LTI 1.3 Advantage platform (consumer), a SCORM 1.2/2004 player, an OAuth-protected xAPI LRS endpoint, catalog connectors, and identity matching through SSO. Universities also need the reverse role, an LTI 1.3 tool provider, so the platform's courses can embed in Canvas, Moodle, Blackboard or Brightspace. That requirement now has a deadline: Blackboard requires LTI 1.3 by 30 September 2027 (Blackboard community).

The standards themselves are stable targets. xAPI is now IEEE 9274.1.1-2023, published under Apache-2.0, and "xAPI 2.0" turns several earlier recommendations into requirements (IEEE SA; xapi.com). cmi5 is the modern launch profile built on xAPI. Its production "Quartz" release is from about 2016, and no newer ADL release was found (Learning Guild). QTI 3.0 (May 2022) is still current, and Common Cartridge 1.4 is listed as "Candidate Final" (1EdTech QTI; 1EdTech CC). Open Badges 3.0 and CLR 2.0 are "native verifiable credentials, as defined by the W3C" (1EdTech CLR FAQ). Their final dates (June 2024 and roughly March 2025) come only from secondary sources. OB 3.0 uses a different data model from OB 2.0, so it should be designed in from the start rather than retrofitted. The research found no mature open-source OB 3.0 issuer. Badgr's open fork has only partial 3.0 support (Open edX forum).

Video is a gap in every candidate. No platform was found with native HLS transcoding, though this is unverified for the large LMSs. LearnDash's own documentation warns that serving video from the app server does not scale (LearnDash). The storage layer changed in 2026 as well. MinIO's community repository was archived on 25 April 2026 and is "no longer maintained". Community binaries stopped in October 2025 (minio/minio; It's FOSS). That is exactly what broke ClassroomIO self-hosts. New designs should target "any S3" and test against Garage (AGPLv3, in production at Deuxfleurs since 2020), whose maintainers consider a swappable S3 backend an "aggregate of independent works" (Garage; issue #840). Full DRM (Widevine, FairPlay, PlayReady) needs vendor licenses (unverified background), so signed URLs plus AES-128 HLS is the realistic open default.

Hands-on labs are the biggest open-source gap and the most valuable differentiator. Pluralsight bought Next Tech and A Cloud Guru to get them (Wikipedia). Kasm's Community Edition cannot be used commercially: its terms limit it to testing, non-profit and non-commercial use with 5 concurrent sessions (Kasm license). The research found no feature-complete open-source equivalent of Instruqt or Killercoda.

The homelab audience has its own gap. The only "Plex for courses" project found, uCourse, is unfinished and appears dormant since late 2023. Jellyfin and similar media servers have no idea of course structure or per-lesson completion (uCourse). The project should position this mode around content users own or are licensed to keep. Ingesting ripped Udemy or Pluralsight downloads likely violates those vendors' terms, though the primary terms-of-service text was not retrieved. Meanwhile, commercial platforms have made AI role-play and in-course tutors standard. Coursera reports its Coach on 97% of courses, and Udemy creators published more than 3,100 Role Plays in four weeks. Both figures are company-reported (Gulf Business; Business Wire). An open platform could match this with a pluggable LLM backend and keep learner data in-house.

Build new and reuse proven parts

The recommendation is to build a new core and not fork. Forking fails on every candidate. Open edX would bring six-monthly breaking changes and AGPL obligations without fixing its commerce or its operational weight. LearnHouse would leave you rebuilding its Enterprise features from a single-maintainer codebase. Frappe Learning ties you to the Frappe framework and MariaDB and would still need LTI, xAPI, cmi5 and multi-tenancy added. CourseLit is stalling. Building on top of an existing project is defensible only for a narrower goal. An institution that needs a MOOC portal in 2027 should deploy Open edX via Tutor (or a paid host) and extend it with plugins. A team that wants a working MVP in weeks could prototype on Frappe Learning or Chamilo 3.0. Neither of these reaches the stated goal: one modern codebase that a homelabber can run on a small box and a company can run as a multi-tenant SaaS.

The new core should own what no project does well. That means tenant-aware data (a single Postgres with tenant IDs and row-level security, with the same code path for single-tenant homelab mode, per background-knowledge patterns), a Git-friendly Markdown/MDX course format, LTI 1.3 in both directions, commerce and B2B seat licensing, catalog connectors and the lab orchestrator. Everything else should come from existing projects. Items marked † were not re-verified in 2026.

Need	Reuse	License	Note
SCORM 1.2/2004 runtime	scorm-again	MIT	Full Simple Sequencing in v3; AICC dropped; no cmi5 (GitHub)
xAPI LRS	Yet Analytics SQL LRS†	Apache-2.0†	Postgres/SQLite; xAPI 2.0 conformance claimed (GitHub). Learning Locker is GPL and commercial-first
cmi5	ADL CATAPULT† as reference and test suite	Apache-2.0†	You build the player yourself (GitHub)
LTI 1.3 tool side	pylti1.3† (Python) or ltijs† (Node, single maintainer)	MIT / Apache-2.0†	Platform-side libraries are scarce; use Moodle and Open edX code as reference (pylti1.3; ltijs)
Identity	Keycloak† (or Zitadel†, reportedly AGPL since v3) + SATOSA† for eduGAIN	Apache-2.0†	App speaks only OIDC; the IdP handles per-tenant SAML and SCIM (Keycloak; SATOSA)
Video	FFmpeg + Shaka Packager + hls.js/Vidstack†; optionally PeerTube runners†	LGPL/BSD/Apache/MIT†	Captions via faster-whisper or whisper.cpp (MIT)† (Shaka Packager; faster-whisper)
Object storage	Garage (homelab) or SeaweedFS† / Ceph RGW†	AGPLv3 / Apache-2.0†	Do not bundle MinIO (Garage)
Search and recommendations	Meilisearch† or Typesense† + pgvector†	MIT† / GPL-3.0† / PostgreSQL	(pgvector)
Payments and billing	Stripe Billing + Tax† (or a merchant of record); Lago (AGPL) or Kill Bill (Apache-2.0) only if usage billing becomes core		Seat-pool licensing is a build item (Lago; Kill Bill)
Interactive content	h5p-standalone (MIT)†	MIT†	Lumi's Node library is GPL-3.0† (h5p-standalone)
Labs	code-server†, JupyterHub + ltiauthenticator†, Kata/gVisor or Firecracker†, xterm.js/ttyd, Guacamole†	MIT/BSD/Apache†	Avoid Kasm CE for commercial use (JupyterHub ltiauthenticator)
Community	Discourse† as a companion		Optional integration

The project's own license should be chosen deliberately. Picking AGPL-3.0 would match the ecosystem (Open edX, Frappe, LearnHouse, Lago) and deter closed SaaS forks. It would also let you reuse AGPL components freely and keep a dual-license route open for commercial revenue, the way ClassroomIO does. Picking Apache-2.0 would maximize adoption by companies. In that case, keep AGPL and GPL components (Garage, Typesense, Zitadel, Lumi H5P) behind swappable network boundaries.

Build in this order. First, a single-binary or small-compose homelab mode with folder ingestion, progress tracking and HLS. Second, SCORM, an embedded LRS and the LTI tool provider, which is what universities need. Third, the LTI platform role, catalog connectors, SCIM and seat licensing for companies. Labs and AI role-play come last, because they cost the most to build and differentiate the most.

Conclusion

The research shows that this is less about the course player than about the integration layer that sits between everything else. Commercial vendors charge extra for interoperability: xAPI on Udemy's Enterprise plan, export as a Go1 add-on. Meanwhile, the open-source projects with modern UX either paywall standards and SSO or never built them. A vendor-neutral hub that speaks LTI 1.3 in both directions, runs SCORM and cmi5, and keeps progress in the customer's own LRS has a clear purpose, especially as the Coursera–Udemy merger and Pluralsight's lender takeover make organizations wary of depending on one vendor (Business Wire; Wikipedia). The homelab "Plex for courses" mode is the cheapest way to build community traction, and labs are where self-hosting turns a cost centre into an advantage.

Several points remain uncertain and should be checked before committing. Nobody in this research ran any candidate hands-on, so Chamilo 3.0 and Frappe Learning deserve a one-week spike each as benchmarks. Canvas OSS's future is unknown. Most standards-support claims for Moodle, ILIAS, Sakai and Canvas are unverified background knowledge and should be checked against the 1EdTech product directory. The 2026 status of LTI libraries, SQL LRS, Keycloak SCIM and Zitadel's license also needs re-confirming. Community sentiment from Reddit and Hacker News could not be retrieved, so demand for the homelab mode is inferred from tools like uCourse and Udeler rather than measured.