DevOps & Deployment

eBPF-based networking, security, and observability for Kubernetes

Cilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.

Fast and lightweight Docker Desktop alternative for macOS

OrbStack is a macOS application that replaces Docker Desktop with lightweight container and Linux VM management. Its docs emphasize fast starts, lower CPU and memory overhead, and native macOS integration with menu bar controls, file sharing, and network access to containers by name, with exact gains depending on workload. Supports Docker, Kubernetes, and full Linux VMs.

Distributed AI compute engine for scaling Python and ML workloads

Ray is an open-source distributed computing framework built for scaling AI and Python applications from a laptop to thousands of GPUs. It provides libraries for distributed training, hyperparameter tuning, model serving, reinforcement learning, and data processing under a single unified API. Ray's public site highlights OpenAI and other enterprise users. Maintained by Anyscale with Apache-2.0 open-source licensing.

Run GitHub Actions locally for fast feedback

Act is an open-source tool that runs GitHub Actions workflows locally using Docker containers that match GitHub's execution environment. It provides instant feedback on workflow changes without pushing to a repository, supports matrix builds, secret management, and artifact handling. Act can also replace Makefiles by using workflow files as task definitions, making it useful for both CI/CD development and local task automation across development teams.

Drop-in authentication for modern JavaScript apps

Clerk is a complete authentication and user management platform for React, Next.js, and modern JavaScript frameworks. It provides pre-built UI for sign-in, sign-up, user profiles, organizations, MFA, passkeys, JWT sessions, webhooks, and billing. The Hobby plan supports up to 50,000 monthly retained users per app, with Pro, Business, and Enterprise tiers for growing teams.

Build, share, and run containers

Industry-standard container platform for building, shipping, and running applications in isolated, reproducible environments. Package apps with all dependencies into portable containers using Dockerfiles and images. Docker Compose orchestrates multi-container applications. Docker Hub hosts millions of pre-built images. Docker Desktop provides GUI management on Mac/Windows. Essential for local development, CI/CD, and production deployments. The foundation of modern containerized infrastructure.

Serverless GPU compute platform for AI inference and training

Modal is a serverless compute platform that lets developers run AI workloads on GPUs with a Python-first SDK. Functions deploy with decorators, auto-scale from zero to thousands of containers, and bill per second. It supports LLM inference, fine-tuning, batch jobs, and sandboxes, with current GPU options including B200, H200, H100, A100, L40S, A10, L4, and T4. Modal’s 2026 Series C valued the company at $4.65B.

Identity-aware VPN and reverse proxy for zero-trust remote access

Identity-based remote access platform built on WireGuard that combines reverse proxy and VPN capabilities. Pangolin supports clientless browser access for web apps and client-based private-resource access across macOS, iOS, Windows, Linux, and Android, with zero-trust rules, peer-to-peer tunnels, automatic SSL, SSO/OIDC options, and cloud or self-hosted deployment.

Declarative GitOps continuous delivery tool for Kubernetes.

Argo CD is the most popular GitOps continuous delivery tool for Kubernetes. It continuously monitors Git repositories and automatically syncs application state to match the desired configuration. A CNCF graduated project used by thousands of organizations for deploying to Kubernetes clusters.

Run GitHub Actions on faster bare-metal runners with lower Ubuntu per-minute pricing

Blacksmith is a drop-in replacement for GitHub-hosted runners that executes Actions on bare-metal gaming CPUs and source-shaped cache infrastructure. Migration requires a one-line YAML change. Features include colocated warm caches, persistent Docker layer caching on NVMe, CI observability with log search, and Firecracker microVM isolation. SOC 2 Type 2 certified, with Ubuntu x64 pricing at $0.004/min and 3,000 free minutes/month.

Official MCP server for GitHub repo operations

GitHub MCP Server is the official Model Context Protocol server from GitHub that connects AI assistants to repositories, issues, pull requests, workflows, and code search. It exposes 100+ operations with toolset filtering, permission scoping, and audit logging, available in both remote-hosted and self-hosted Docker deployment modes.

Frontend cloud platform

Frontend cloud platform and the creators of Next.js, providing instant Git-push deployments, a global edge network, and serverless compute for modern web apps. Automatic preview URLs for every pull request, Edge Functions for low-latency dynamic content, Image Optimization, Web Analytics, and the Vercel AI SDK for building AI-powered apps. Supports Next.js, React, Svelte, Nuxt, Astro, and all major frameworks. Generous free tier for personal projects and used by enterprises like Washington Post.

Enterprise identity platform by Okta

Auth0 is an enterprise identity platform by Okta providing authentication, authorization, and user management as a service. Supports social login, passwordless, MFA, SAML, OIDC, machine-to-machine auth, and custom database connections. Features Actions for serverless extensibility, Organizations for B2B multi-tenancy, and adaptive MFA with risk assessment. SDKs for all major platforms. Free tier includes 25,000 MAU. Used by thousands of enterprises globally.

Hybrid CI/CD platform with self-hosted agents and cloud orchestration

Buildkite is a hybrid CI/CD platform that separates orchestration from execution. Its SaaS control plane manages pipelines, UI, authentication, and coordination while agents run builds on self-hosted or hosted infrastructure. Current pricing lists Personal at $0, Pro at $30 USD per active user/mo, P95 billing for self-hosted agents, Test Engine, Package Registries, and hosted Mac/Linux agent options.

Open-source identity and access management

Keycloak is an open-source IAM solution with 25K+ GitHub stars by Red Hat. Provides SSO, social login, LDAP/Active Directory federation, standard protocol support (OIDC, OAuth 2.0, SAML), fine-grained authorization, user federation, and admin console. Features identity brokering, multi-tenancy via realms, and client adapters for Java, JavaScript, and Node.js. Self-hosted with no per-user licensing, making it ideal for organizations needing full control over identity infrastructure.

Kubernetes cost monitoring and optimization platform

Kubecost is an IBM Apptio / Cloudability product for Kubernetes cost visibility, allocation, and optimization, built around the Kubecost/OpenCost ecosystem. It helps map infrastructure spend to Kubernetes namespaces, deployments, pods, labels, and teams. OpenCost remains the vendor-neutral Apache-2.0 open-source project for cloud-native cost allocation with AWS, Azure, GCP, and Prometheus integrations.

Zig-built headless browser engineered for AI agent workloads

Open-source headless browser written in Zig for AI agents, crawling, and automation. Lightpanda omits graphical rendering, keeps DOM and JavaScript execution, exposes CDP for Puppeteer/Playwright/chromedp, and adds Agent, PandaScript, and MCP workflows. Current public benchmarks claim about 9x faster execution and 16x less memory than Chrome.

Run LLMs locally with one command

Tool for running large language models locally on your machine with a simple CLI interface. Download and run Llama 3, Mistral, Gemma, Phi, Code Llama, and dozens of other open-source models with a single command. Features model management, GPU acceleration (NVIDIA/AMD/Apple Silicon), OpenAI-compatible API server, Modelfile for customization, and multi-model switching. Ideal for offline AI development, privacy-sensitive use cases, and local testing. 120K+ GitHub stars.

Self-hosted AI platform with ChatGPT-like interface for local and cloud LLMs.

Extensible, self-hosted AI platform with 290M+ Docker pulls and 124K+ GitHub stars. Supports Ollama, OpenAI-compatible APIs, and any Chat Completions backend. Features built-in RAG, multi-user RBAC, voice/video calls, Python function workspace, model builder, and web browsing. Runs entirely offline with enterprise features including SSO and audit logging.

2x faster LLM fine-tuning with 70% less VRAM on a single GPU

Unsloth is an open-source framework for fine-tuning large language models up to 2x faster while using 70% less VRAM. Built with custom Triton kernels, it supports 500+ model architectures including Llama 4, Qwen 3, and DeepSeek on consumer NVIDIA GPUs. Unsloth Studio adds a no-code web UI for dataset creation, training observability, model comparison, and GGUF export for Ollama and vLLM deployment.

Open-source identity provider for self-hosted SSO and access management

Authentik is an open-source Identity Provider supporting SAML, OAuth2/OIDC, LDAP, RADIUS, and SCIM for self-hosted single sign-on. It provides customizable authentication flows, multi-factor authentication, user management, and proxy-based SSO for applications without native support. Positioned as a modern Keycloak alternative with 22K+ GitHub stars, free Open Source use, and paid Enterprise/Enterprise Plus plans.

Open-source feature flags and A/B testing platform

GrowthBook is an open-source platform for feature flags, A/B testing, and product experimentation. It includes Bayesian and frequentist statistics engines, warehouse-native analytics connecting to BigQuery, Snowflake, and Databricks, and SDKs for 15+ languages. GrowthBook supports targeting rules, gradual rollouts, and an MCP server for AI agent integration. Self-hostable via Docker.

Self-hosted multi-model AI chat platform

LibreChat is an open-source ChatGPT-like interface with 35K+ GitHub stars supporting multiple AI providers in a single self-hosted platform. Connect OpenAI, Anthropic, Google, Mistral, local models via Ollama, and custom endpoints simultaneously. Features conversation branching, file uploads, code interpreter, plugins, presets, multi-user support with RBAC, and LDAP/SSO authentication. Privacy-focused alternative to commercial AI chat services with full data ownership.

Merge queue, CI insights, flaky-test controls, and stacked pull requests for GitHub teams

Mergify is a pull request automation platform that keeps main branches green with merge queue batching, merge protections, CI Insights, flaky-test detection, and stacked pull requests. Its Stacks workflow turns commits on one local branch into focused PR chains, helping teams review large AI-generated or feature-heavy changes without losing queue safety.

Code quality and security analysis platform

SonarQube is an open-source code quality and security platform with 10K+ GitHub stars that inspects code for bugs, vulnerabilities, code smells, and security hotspots. It enforces quality gates in CI/CD pipelines, supports 30+ languages in Team plans and 40+ in Enterprise, and remains the industry standard for static code quality management.

Unified code-to-cloud security platform for developers

Aikido Security is an all-in-one AppSec platform unifying SAST, DAST, SCA, CSPM, secrets detection, container scanning, IaC analysis, and runtime protection in a single developer-friendly dashboard. Cuts false positive noise by 95% through reachability analysis that evaluates vulnerabilities in actual deployment context. Features AI AutoFix for one-click remediation, CI/CD gating, and AI-powered pentesting agents. Trusted by 50,000+ organizations. Supports 50+ programming languages.

All-in-one self-hosted AI app with RAG, agents, and multi-user support

AnythingLLM is an open-source, privacy-first AI application that turns any document into an interactive knowledge base. It bundles document ingestion, vector storage (built-in LanceDB), RAG pipelines, AI agents, and multi-user access into a single deployable package. Supports 30+ LLM providers including OpenAI, Anthropic, Ollama, and local models. With 62K+ GitHub stars and MIT license, it runs as a desktop app or Docker container with zero configuration required out of the box.

Lightweight server monitoring with Docker stats and alerts

Beszel is a lightweight, self-hosted server monitoring platform built in Go that tracks CPU, memory, disk, network, GPU, temperature, and Docker container metrics with historical data visualization and configurable alerts. Its simple hub-and-agent architecture deploys in minutes and consumes minimal resources compared to traditional monitoring stacks like Prometheus and Grafana.

Backend development framework with built-in infrastructure automation

Encore is a backend development framework for TypeScript and Go that automates infrastructure provisioning from application code. Developers define APIs, databases, cron jobs, and pub/sub topics using framework primitives, and Encore generates the necessary cloud infrastructure on AWS or GCP. Includes local development tooling with service catalog, tracing, and automatic API documentation.

Self-hosted AI platform with RAG, agents, and 40+ connectors

Onyx is an open-core, self-hostable AI knowledge platform for enterprise search, RAG chat, deep research, custom agents, and workplace connectors. It connects to 40+ apps, supports permission-aware retrieval, and offers Cloud, Docker/Kubernetes, and enterprise deployment paths for teams that need controlled internal AI search.

Infrastructure as Code using real programming languages — TypeScript, Python, Go, C#, Java.

Pulumi is a modern Infrastructure as Code platform that lets teams define cloud infrastructure using familiar programming languages instead of DSLs. Supports TypeScript, Python, Go, C#, Java, and YAML across major clouds, Kubernetes, and a broad Pulumi Registry with Terraform-derived provider coverage. Offers testing, IDE autocomplete, reusable components, and Pulumi Cloud state/governance features.

Developer-first security platform

Snyk is the leading developer security platform providing continuous scanning for vulnerabilities in code (SAST), open-source dependencies (SCA), container images, and infrastructure as code. Integrates directly into IDEs, Git repositories, CI/CD pipelines, and container registries. Features AI-powered fix suggestions, license compliance checking, and real-time vulnerability database. Free for individual developers with paid plans for teams. Supports 30+ programming languages.

Open data platform wrapping any SQL database with instant APIs

Directus is a database-first open data platform that wraps any existing SQL database with instant REST and GraphQL APIs, a no-code admin dashboard, and built-in authentication. Unlike traditional headless CMS platforms that impose their own data model, Directus introspects your existing schema and works on top of it — supporting PostgreSQL, MySQL, SQLite, MS SQL, MariaDB, and CockroachDB out of the box.

Automate your workflow from GitHub

GitHub's built-in CI/CD and workflow automation platform that runs directly in your repository. Define workflows in YAML triggered by Git events (push, PR, release), schedules, or manual dispatch. Massive marketplace of 20,000+ community-maintained actions for testing, building, deploying, and automating tasks. Supports matrix builds, caching, secrets, environments with approval gates, and self-hosted runners. Free for public repos with generous minutes for private repos.

AI-powered Kubernetes diagnostics in plain English

K8sGPT is a CNCF Sandbox project that scans Kubernetes clusters, diagnoses issues, and explains problems in plain English with actionable remediation steps. It codifies SRE expertise into built-in analyzers for Pods, Services, Deployments, Ingress, PVCs, CronJobs, and more. K8sGPT connects to AI backends including OpenAI, Azure OpenAI, Google Gemini, Amazon Bedrock, Cohere, and local models via Ollama, with data anonymization to protect sensitive cluster information.

Container orchestration at scale

Kubernetes (K8s) is the industry-standard open-source container orchestration platform originally developed by Google and now maintained by the CNCF. Automates deployment, scaling, self-healing, and networking of containerized workloads across clusters of machines. Runs everywhere from laptops (kind, k3s) to every major cloud (EKS, GKE, AKS), and is the foundation of modern cloud-native infrastructure.

Open-source multi-model AI chat framework with plugin ecosystem

LobeChat is a source-available AI chat and agent workspace for OpenAI, Claude, Gemini, Ollama, DeepSeek, and Qwen. It includes RAG, 10,000+ MCP-compatible plugins, Agent Groups, TTS/STT, Vercel/Docker self-hosting, and 79K+ GitHub stars.

Modular open-source identity infrastructure with Kratos, Hydra, and Keto

Ory provides a suite of modular open-source identity components: Kratos for user management and authentication, Hydra for OAuth2 and OIDC, Oathkeeper for API gateway authorization, and Keto for fine-grained permission management. Used by OpenAI and other major organizations. API-first design with Go-based microservices that deploy independently or together as Ory Network cloud.

Open-source authentication with self-hosting

SuperTokens is an open-source authentication solution with 14K+ GitHub stars providing email/password, passwordless, social login, MFA, session management, and user management. Designed for self-hosting with Docker — full control over user data with no vendor lock-in. Pre-built UI components for React, Vue, and vanilla JS. Backend SDKs for Node.js, Python, and Go. Managed cloud option also available. Emphasizes security with rotating refresh tokens and anti-CSRF protection by default.

Infrastructure as Code

HashiCorp's infrastructure-as-code tool for provisioning and managing cloud resources declaratively using HCL (HashiCorp Configuration Language). Write infrastructure definitions once and deploy to AWS, GCP, Azure, DigitalOcean, and 4,000+ providers. Features state management for tracking resources, plan/apply workflow for safe changes, modules for reusability, and workspaces for environment isolation. The industry standard for multi-cloud IaC with 48K+ GitHub stars.

Open-source background jobs and AI workflows for TypeScript

Trigger.dev is an open-source platform for building and deploying background jobs, AI agents, and long-running workflows in TypeScript. It eliminates serverless timeouts with durable task execution, automatic retries, queue-based concurrency control, and elastic scaling. Used by 30,000+ developers at companies like MagicSchool and Icon.com, it processes hundreds of millions of agent runs monthly. Backed by a $16M Series A led by Dalton Caldwell's Standard Capital fund.

Open-source high-performance key/value datastore

Valkey is a Linux Foundation-backed, BSD-3-Clause open-source fork of Redis 7.2.4 for caching, queues, and real-time data workloads. Current 9.1 and 8.1.8 releases continue performance, security, module, and cluster work while preserving Redis-compatible migration paths. It has 26K+ GitHub stars and managed-service support from AWS, Google, Oracle, Ericsson, and others.

Headless browsers in Docker for automation at scale

Browserless is a headless browser-as-a-service platform that deploys Chrome, Firefox, and WebKit in Docker containers for web scraping, testing, and AI agent automation. It provides Puppeteer and Playwright-compatible APIs, a built-in MCP server for connecting AI assistants to browser automation, screenshot and PDF generation, and connection pooling for high-concurrency workloads. Available as self-hosted source-available software or managed cloud.

Autonomous Kubernetes cost optimization

CAST AI automates Kubernetes cost optimization by analyzing workloads in real time and taking direct action on clusters, including right-sizing pods, selecting optimal instance types, and leveraging spot instances automatically. The platform achieves up to 60% cost reduction without human intervention, offering a free cluster audit that identifies savings opportunities before any commitment.

Self-hosted Heroku/Vercel alternative

Open-source, self-hostable PaaS alternative to Heroku, Vercel, and Netlify with 44K+ GitHub stars. Deploy static sites, APIs, full-stack apps, databases, and 280+ one-click services on your own VPS or bare metal via SSH. Features auto Let's Encrypt SSL, Git integration (GitHub/GitLab/Bitbucket/Gitea), S3 backups, Docker Swarm support, and a REST API for CI/CD automation. Self-hosted version is free forever with no features behind paywalls.

Zero-instrumentation Kubernetes observability powered by eBPF

Coroot is an open-source observability platform that uses eBPF to automatically instrument Kubernetes applications without code changes. It provides application maps, latency analysis, log correlation, and continuous profiling with automatic anomaly detection. Replaces the need for manual instrumentation with agents that capture metrics, traces, and logs at the kernel level.

Modern data orchestration for ML and analytics

Dagster is an open-source data orchestration platform with 15K+ GitHub stars combining pipeline scheduling with software-defined assets, built-in data quality checks, and a modern developer experience. Defines data assets declaratively rather than imperatively. Features asset lineage visualization, partitioned processing, sensor-based triggers, comprehensive testing, and integrated observability. A modern alternative to Airflow for teams wanting asset-centric orchestration.

Secrets security and non-human identity governance across code, CI/CD, endpoints, CLI/IDE/API, and MCP workflows.

GitGuardian is a secrets security and non-human identity governance platform for finding, triaging, and remediating leaked credentials across repositories, CI/CD, developer endpoints, CLI/IDE workflows, APIs, and MCP-connected environments. It combines managed incident workflow with developer-side prevention, Endpoint Protection, and broader credential lifecycle governance.