DevOps & Deployment

IaC orchestration layer for scaling Terraform and OpenTofu

Terragrunt is an infrastructure-as-code orchestration tool that wraps Terraform and OpenTofu to keep configurations DRY, manage remote state, and coordinate multi-module deployments. The 1.0 release introduced stacks, filters, run reports, and backward compatibility guarantees after 900+ releases and tens of millions of infrastructure deployments. It provides a thin orchestration layer that eliminates duplication across environments without replacing the underlying IaC tools.

Open-source GitOps automation for Terraform and OpenTofu pull requests

Terrateam is open-source GitOps infrastructure orchestration for Terraform and OpenTofu pull requests. It automates plans and applies in GitHub workflows, supports monorepos and many workspaces, and adds apply-only locks, OPA/Rego policy checks, cost and drift signals, and approval controls without forcing teams into a separate IaC platform.

Hugging Face's open-source inference server for embeddings, rerankers, and classifiers

Text Embeddings Inference is Hugging Face's Apache-2.0 server for high-throughput embedding, reranking, and sequence-classification models. TEI packages token-based dynamic batching, optimized Transformers kernels, Safetensors loading, OpenAI-compatible embedding endpoints, Prometheus metrics, and configurable OpenTelemetry tracing in deployable CPU and GPU images.

Hugging Face's production LLM serving framework

Text Generation Inference (TGI) is Hugging Face's production-ready serving framework for large language models. It features flash attention, continuous batching, tensor parallelism, quantization via GPTQ/AWQ/EETQ, and Safetensors support. Powers Hugging Face's Inference API and Inference Endpoints, with an OpenAI-compatible API and Docker deployment. Supports LLaMA, Mistral, Falcon, and other popular model architectures.

CLI token usage tracker for AI coding agents

Tokscale is a CLI tool that tracks token usage and costs across AI coding agents including Claude Code, Codex, OpenCode, Gemini CLI, Cursor, and more. Built with a native Rust core for high-performance processing, it provides detailed breakdowns of input, output, cache, and reasoning tokens with real-time pricing calculations via LiteLLM data. Features include interactive 2D/3D contribution graphs, web visualization dashboards, global leaderboards, and JSON export for cost analysis.

Open-source SOAR platform with AI-powered playbooks

Tracecat is a YC S24-backed open-source SOAR (Security Orchestration, Automation and Response) platform that lets security teams build AI-powered playbooks for automated incident response. It provides visual workflow builders for creating response procedures, integrates with common security tools, and handles alert triage, enrichment, and remediation — positioned as an open-source alternative to Tines and Splunk SOAR.

NVIDIA's optimized AI model serving platform

Triton Inference Server is NVIDIA's open-source inference serving platform that deploys AI models from TensorRT, PyTorch, ONNX, TensorFlow, OpenVINO, Python, and more across cloud, data center, and edge environments. It supports dynamic batching, model ensembles, concurrent model execution on GPUs and CPUs, and real-time, streaming, and batch inference patterns. Includes Model Analyzer for profiling and Model Navigator for automated optimization.

Comprehensive open-source vulnerability scanner

Trivy is an open-source vulnerability scanner with 24K+ GitHub stars by Aqua Security that scans container images, file systems, Git repositories, Kubernetes clusters, and IaC configurations for security issues. Detects OS package and language-specific vulnerabilities, misconfigurations, secrets, and license violations in a single tool. Runs as a simple CLI with zero configuration needed. Supports SBOM generation, VEX for vulnerability filtering, and CI/CD integration.

AI-powered CI reliability and flaky test management

Trunk is a developer tools platform that tackles CI reliability through AI-powered flaky test detection, automatic quarantine, and merge queue management. It uses ML-based statistical analysis to identify flaky tests, isolates them to prevent pipeline blocks, and creates GitHub issues for resolution. Used by Zillow, Brex, and Faire, with $28.5M in funding and support for all major test frameworks.

High-performance build system for JavaScript and TypeScript

High-performance build system from Vercel for JavaScript and TypeScript monorepos. Turborepo intelligently caches task outputs based on content hashing, parallelizes builds across CPU cores, and shares cached results between team members via remote caching. A single turbo.json orchestrates tasks across packages with topological ordering, pruning, and composable configuration for reusable task snippets.

Autonomous coding agents that ship while you sleep

Twill is an autonomous coding agent platform that implements features, fixes bugs, and ships pull requests without manual intervention. Uses structured workflow of research, planning, human review, implementation in isolated sandbox, AI code review, then merge. Supports custom agent configurations with multiple LLM providers, isolated dev environments for verification, and integrations with GitHub, Linear, Sentry, Notion, and cloud platforms for end-to-end engineering automation.

Low-code AI platform for internal tools with RBAC

UI Bakery AI is a low-code platform with AI assistance specifically for building production-ready internal tools, featuring enterprise-grade RBAC, SSO integration, and SOC 2 compliance. It combines visual app building with AI-powered code generation for complex business logic, targeting internal operations teams who need admin panels and dashboards with proper security controls.

Open-source feature flag management platform

Unleash is the largest open-source feature flag platform, enabling teams to decouple deployment from release with gradual rollouts, A/B testing, and trunk-based development. It provides 15+ official SDKs for server and client frameworks, a web-based admin dashboard for managing feature toggles, and supports activation strategies like percentage rollout, user targeting, and environment-based rules. Self-hostable via Docker with PostgreSQL storage.

Instant serverless TypeScript platform for APIs, crons, and bots

Val Town is a collaborative platform for writing and deploying serverless TypeScript functions instantly from the browser. Create APIs, cron jobs, email handlers, and bots with a single Cmd+S. Features version control, collaboration, and a social coding model where functions can import from other users. YC-backed with 450K+ monthly active users.

Cloud-native distributed vector search engine built for Kubernetes with automatic indexing and horizontal scaling.

Vald is a highly scalable distributed approximate nearest neighbor (ANN) vector search engine designed for cloud-native, Kubernetes-based architectures. Maintained by LY Corporation and listed in the CNCF Landscape, it uses the NGT algorithm (developed at Yahoo Japan), supports automatic incremental index backup, and handles billion-scale datasets across loosely coupled microservice components that scale horizontally via Helm.

Developer-centric cloud cost analysis and optimization

Vantage provides visual cloud cost analysis with automated saving recommendations, integrating with CI/CD to track cost-per-commit for developer-centric FinOps. It offers the most developer-friendly cost reporting tool in the market with clear, actionable reports that engineers actually use, featuring a free tier and competitive Pro plans for growing teams and startups.

Lightweight microVM execution layer for AI agent code sandboxing

Vercel Sandbox provides a lightweight microVM execution environment for running untrusted code generated by AI agents safely. It creates isolated sandboxes that prevent generated code from accessing the host system, network, or other processes. Designed for AI coding platforms that need to execute user or agent-generated code without security risks to the host infrastructure.

Next-generation frontend build tool

Vite is the de facto standard frontend build tool with 72K+ GitHub stars, created by Evan You. Provides instant dev server startup using native ES modules, lightning-fast hot module replacement that stays fast regardless of project size, and optimized production builds via Rollup. Supports React, Vue, Svelte, Preact, and vanilla JS/TS out of the box with a rich plugin ecosystem. Achieves 98% developer satisfaction and has become the recommended tooling for most modern frameworks.

High-performance WebAssembly runtime for cloud and AI

WasmEdge is a CNCF sandbox WebAssembly runtime optimized for cloud-native, edge, and AI workloads. It provides a lightweight, secure, and portable execution environment that is faster than containers and safer than native processes. WasmEdge supports LLM inference via LlamaEdge, serverless functions, microservices, and plugin extensions for networking, AI, and cryptography across Linux, macOS, and Windows.

Batteries-included full-stack framework for React, Node.js, and Prisma

Wasp is an open-source full-stack web framework that brings the Rails-like batteries-included experience to the JavaScript ecosystem. It uses a declarative configuration file to define auth, database models, server operations, and routing, then compiles to a standard React and Node.js application with Prisma for data access. With 18,000+ GitHub stars and YC backing, Wasp eliminates boilerplate while giving AI coding agents clear structure and guardrails.

Lightweight self-hosted CI/CD engine for the Gitea stack

Woodpecker CI is a community-maintained open-source CI/CD engine forked from Drone CI, designed as the default continuous integration solution for self-hosted Git platforms like Gitea, Forgejo, and Codeberg. With simple YAML pipeline configuration, minimal resource usage (~100MB RAM), and Apache-2.0 licensing, it provides a lightweight alternative to Jenkins and GitHub Actions for developers who prefer infrastructure they control.

Open-source GraphQL Federation platform replacing Apollo GraphOS

WunderGraph Cosmo is an open-source GraphQL Federation platform with a schema registry, composition checks, and high-performance Go router. It has overtaken Apollo GraphOS as the dominant federation solution, with 87% of GraphQL Federation adopters using Cosmo versus Apollo's decline from 57% to 28%. Supports Federation v1 and v2, provides CI/CD schema validation, and includes a managed cloud option. Apache 2.0 licensed with active enterprise adoption.

Desktop hub for managing all your server connections

XPipe is an open-source desktop application that centralizes access to your entire server infrastructure through a unified interface. It connects to remote systems via SSH, Docker containers, Kubernetes clusters, LXC, and virtual machines — eliminating context switching between multiple terminal sessions and infrastructure tools without requiring any remote-side setup or installation.

AI-managed spot instances for production workloads

Xosphere automates the use of AWS Spot Instances for production workloads using ML to select instances based on availability and cost-performance balance. It installs in 10 minutes via CloudFormation and provides high-availability reliability with cheap spot pricing, automatically managing instance selection, interruption handling, and failover for teams wanting significant compute cost savings.

Open-source identity management with built-in multi-tenancy

ZITADEL is an open-source identity and access management platform that handles authentication, authorization, and user management for B2B and B2C applications. It supports OIDC, SAML, OAuth 2.0, Passkeys, MFA, and passwordless login out of the box. Built with multi-tenancy as a core feature, ZITADEL lets you manage multiple organizations with delegated admin access, custom branding, and isolated identity stores—all from a single deployment.

Sandbox any command with file, network, and credential controls

Zerobox is a security-focused command sandboxing tool that isolates command execution with fine-grained controls over file system access, network connectivity, and credential exposure. It wraps any shell command in a secure container that enforces policy restrictions, preventing unauthorized file reads, network calls, or environment variable leaks during execution.

AI-powered autonomous cloud cost optimization for AWS

Zesty uses AI to automatically optimize AWS cloud costs by analyzing usage patterns and making real-time resource adjustments. It manages Reserved Instance and Savings Plan portfolios autonomously, right-sizes EC2 instances based on actual utilization, and optimizes EBS volumes and storage costs. Claims average 51% savings on AWS compute spend with no engineering effort required.

GitHub's Kubernetes controller for autoscaling GitHub Actions runners

actions-runner-controller (ARC) is GitHub's official Kubernetes controller for managing self-hosted GitHub Actions runners. It automatically scales runner pods up and down based on workflow demand, provisioning runners when jobs queue and terminating them when complete. Supports runner groups, custom runner images, and organization-level runner management. Over 6,100 GitHub stars.

Lightweight OS for running AI agents in-process

agentOS is a portable open-source operating system for AI agents that delivers ~6ms cold starts at 32x lower cost than traditional sandboxes. Powered by WebAssembly and V8 isolates, it runs agents like Claude Code and Codex directly inside your process with granular permissions and host-managed tool access for S3, GitHub, and databases. Available as a simple npm package with no special infrastructure or vendor lock-in required.

SQL-based data transformation framework

dbt (data build tool) is an open-source SQL transformation framework with 10K+ GitHub stars that lets analytics engineers transform data in their warehouse using select statements. Brings software engineering practices to data — version control, testing, documentation, and CI/CD for SQL. Supports Snowflake, BigQuery, Redshift, Databricks, PostgreSQL, and more. Features Jinja templating, incremental models, snapshots, and a package hub of reusable transformations.

Nix-powered reproducible development environments

devenv uses Nix to create reproducible, declarative development environments that work consistently across machines. Define project dependencies, services, environment variables, and pre/post hooks in a single devenv.nix file. Supports automatic shell activation, process management for databases and services, and integration with direnv for seamless directory-based environment switching.

Infrastructure as Code orchestration and governance platform

env0 is an IaC orchestration platform that manages Terraform, OpenTofu, Pulumi, and CloudFormation workflows with built-in governance, cost estimation, and drift detection. It provides self-service infrastructure provisioning with policy guardrails, automated plan approvals, and budget controls. Supports custom deployment flows with OPA-based policy enforcement and RBAC.

Ultra-fast JavaScript bundler written in Go

esbuild is a JavaScript bundler written in Go with 38K+ GitHub stars that runs 10-100x faster than traditional bundlers like Webpack. Handles JavaScript, TypeScript, JSX, CSS bundling, and minification with near-instant build times. Used as the build engine inside Vite for production builds. Features tree shaking, code splitting, source maps, and a plugin API. Minimal configuration required — most projects need zero config files. Single binary with no JavaScript dependencies.

One-command local coding agent that auto-detects your hardware and picks the best model

hf-agents is a Hugging Face CLI extension that detects your hardware, recommends the best GGUF model using llmfit, and launches a local coding agent in a single command. It collapses the multi-step local LLM setup into hf agents run pi, automatically handling hardware profiling, model download, inference server startup, and coding agent activation.

Zero-friction single-binary Kubernetes distribution by Mirantis

k0s is a lightweight, CNCF-certified Kubernetes distribution packaged as a single binary with zero host dependencies. Backed by Mirantis, it simplifies cluster deployment by bundling all required components into one executable that works on any Linux system. Supports x86-64, ARM64, and ARMv7 architectures with automatic upgrades and a built-in control plane load balancer.

Lightweight Kubernetes distribution for edge, IoT, and development

k3s is a CNCF Sandbox lightweight Kubernetes distribution packaged as a single binary under 100MB. Created by Rancher Labs and now maintained by SUSE, it strips non-essential components and bundles containerd, Flannel, CoreDNS, and Traefik into a minimal but fully conformant K8s distribution. Ideal for edge computing, IoT, ARM devices, and local development environments.

Hot-swap between local LLM models via OpenAI-compatible API

llama-swap is an open-source tool that manages multiple local LLM models behind a single OpenAI-compatible API endpoint. It automatically loads and unloads models on demand, letting developers hot-swap between different models without restarting services. With 3.1K+ GitHub stars, it solves the common pain point of running multiple specialized models on limited hardware.

Kubernetes-native distributed LLM inference stack

llm-d is an open-source Kubernetes-native stack for distributed LLM inference with cache-aware routing and disaggregated serving. It separates prefill and decode stages across different GPU pools for optimal resource utilization, routes requests to nodes with warm KV caches, and integrates with vLLM as the serving engine. Apache-2.0 licensed with 2,900+ GitHub stars.

Find which AI models actually run on your hardware in one command

llmfit is a Rust-based terminal tool that matches over 200 LLM models from 30+ providers against your exact hardware specs. The interactive TUI scores each model on fit, speed, VRAM usage, and context length, helping you avoid downloading models that won't run on your machine. It supports Ollama, llama.cpp, MLX, Docker Model Runner, and LM Studio backends.

Run local code inside your Kubernetes cluster without deploying

mirrord lets developers run local processes as if they were inside their Kubernetes cluster — intercepting network traffic, environment variables, and file access at the OS level without any deployment or configuration changes. Backed by $12.5M in seed funding with investors including Sentry's co-founder, it claims up to 98% faster iteration cycles and 30% fewer production bugs by eliminating the gap between local and cluster environments.

Build native Node.js addons in Rust via Node-API

napi-rs is a framework for building compiled Node.js native addons in Rust through the Node-API interface, eliminating node-gyp and C++ toolchains. It provides async/await with Promise integration, extensive type mappings between Rust and JavaScript, and cross-compilation to Windows, macOS, Linux, FreeBSD, and Android across x64, ARM, and RISC-V. Used by major JS tooling projects, napi-rs enables Rust-speed performance in Node.js apps.

Lightweight virtual Kubernetes clusters

vCluster creates lightweight, isolated virtual Kubernetes clusters inside physical host clusters, enabling teams to run sandboxed environments for development, testing, and AI agent experimentation without provisioning separate infrastructure. Each virtual cluster has its own API server, control plane, and resource isolation while sharing the underlying compute, reducing infrastructure costs by up to 90% compared to full cluster provisioning.

Official Kubernetes and Helm reference stack built on the vLLM inference engine

Official vLLM reference implementation for scaling the existing inference engine on Kubernetes with Helm, request routing, KV-cache offload, autoscaling and Prometheus/Grafana observability.

OAuth 2.1 provider framework for Cloudflare Workers

workers-oauth-provider is Cloudflare's official OAuth provider library for Workers. It implements the provider side of the OAuth 2.1 protocol with PKCE support and RFC 8414 compliance. Handles token management automatically via Cloudflare KV storage. Gives fullstack teams a path to implement OAuth at the edge without heavy auth servers. TypeScript-native with npm package available.