Infrastructure for Multi-platform

YAML syntax has a learning curve. Debugging failed workflows is frustrating. Costs scale with build minutes. Complex workflows become hard to maintain.

Resource overhead compared to native. Security requires attention. Desktop licensing changes affected teams. Image size management is ongoing work.

Complexity is legendary. Small teams often do not need it. Operational burden is significant. The YAML can become unmanageable.

Smaller ecosystem than Terraform. Learning curve for infrastructure patterns. The state service is a dependency unless self-hosted.

More operational than PaaS alternatives. Pricing requires understanding. Some features are less polished. The free tier has limitations.

Less control than VMs or containers. Pricing scales with usage. Customization options are limited. Some workloads do not fit the model.

Self-hosting means self-operating. Some features are less polished than commercial alternatives. Single-server focus limits scale.

License: Apache-2.0 with an appendix that overrides it — no redistributing paid versions of CapRover, its paid features cannot be modified, and changes to the free features must stay free and open source. Read it before building on top. Documentation assumes Docker knowledge. Some advanced features require manual configuration. Less active development than alternatives.

Go git TUI — not a GitHub app, not magit (Emacs), not CI. You still need git installed and a terminal habit.

K8s package manager - not Argo CD/Flux GitOps sync, not a cluster itself. Templating can become spaghetti; you still own values, secrets, and upgrade discipline. Not Kamal/Coolify for VMs.

K8s cluster TUI - not Helm packaging, not a dashboard SaaS. Needs a working kubeconfig and cluster access. Not Lens Electron GUI.

Each new .envrc needs `direnv allow`. Not a secrets vault — still files on disk.

Not a password manager or key directory. You still distribute public keys yourself.

Self-host ops (or use Codeberg). Not GitHub feature-parity; Actions ecosystem is thinner.

Directory jumper only — not a file manager (Yazi), not a shell, not Atuin history. Needs a one-line shell init. Ranking learns from you; fresh machines feel empty until you walk around.

Vs Temporal (durable execution): Kestra is orchestration/control-plane UX, not a workflow SDK. Enterprise adds SSO/RBAC/audit/multi-tenant — contact sales, no public seat price. Cloud is usage/early-access, also sales-shaped. Self-host ops still yours.

Shell history tool — not a prompt (Starship), not a jumper (zoxide), not Dotfiles sync. Desktop/Hub team features are a separate product line (Hub not self-hostable). Atuin AI is free while in testing — treat that as temporary.

Vs Docker (encyclopedia): Podman wins on rootless/daemonless defaults, not on Desktop marketplace polish or every Compose edge case. Some tutorials still assume dockerd socket quirks. Image/build UX splits across Podman/Buildah depending on workflow.

Vs age (file encryption) and Infisical (secrets product): SOPS is the *structured config encryptor*, not a password manager and not a hosted vault UI. You still design key distribution, rotation, and who can decrypt in CI. Binary mode encrypts whole files when structure does not apply.

Vs Trivy/Gitleaks (scanners): Semgrep is SAST/SCA-shaped AppSec, not container CVE inventory or git-history secret regex alone. Teams starts ~$30/contributor/mo per product; Secrets is a separate SKU. Free Edition caps contributors/repos — OSS CLI without the SaaS seat is the uncapped escape hatch.

Vs Skaffold/Garden/DevSpace: Tilt is the Kubernetes *dev control plane*, not a prod CD system and not a Dockerfile replacement (Earthly/BuildKit still own image recipes). You need a cluster and a willingness to learn Tiltfile. Not magic for non-container monoliths.

Vs Docker Desktop GUI and vs kubectl TUIs: this is *Docker/Compose*, not Kubernetes. Needs a running Docker engine and socket access. Not a build/registry tool — pair with dive when you care about image layers.

Vs Trivy/Grype (vuln scanners) and Syft (SBOM generator, not yet a twin page here): dive is *size/layer forensics*, not CVEs or SBOMs. Needs Docker/OCI image access. CI integration is DIY compared to scanner SaaS.

Not a GitHub/GitLab host (see Forgejo). Learning curve is real: mental model differs from Git even when the on-disk store is Git. Ecosystem tooling and host UI still assume Git first. Contributions historically involve a Google CLA — product license stays Apache-2.0.

Tied to Cloudflare’s platform: Free → Standard paid usage when you exceed quotas. Not a generic Node host and not Docker-on-VPS. Local emulation is good, production semantics still Cloudflare’s. Account + API token required to ship.

You still own the repository password (lose it = lose data) and the backend bill/ops. Not a SaaS backup console with support SLAs. Scheduling, monitoring, and restore drills are on you. Complementary to object stores (Garage), not a replacement for app-level PITR.

Vs Biome (formatter+linter toolchain): Oxlint is the *linter* product (Oxfmt/Vite+ are separate). Some ESLint plugin edge cases still push hybrid setups. JS plugins called alpha on the docs. Not a bundler. It is part of the Oxc project, the Rust JavaScript toolchain whose parser it runs on (see Oxc below).

Vs Docker Engine / Podman: Colima is the *host runtime wrapper*, not a daemon replacement on Linux servers and not a registry. Still a VM on macOS — RAM/CPU allocation and mount quirks apply. GUI/enterprise support is not the product; Docker Desktop competitors with support desks are paid for a reason.

Vs asciinema (live cast recording) and freeze (Charm still frames): VHS is *scripted* GIF generation that needs a TTY-capable install path (ttyd/ffmpeg deps show up in real installs). Not an interactive recorder you click through. Keep hand-capture when the demo is exploratory, not scripted.

GPL-3.0 copyleft — fine for a CLI on your laptop; read the license before embedding into proprietary SaaS. Vs dig/nslookup (OS stock) and vs dog (Rust, quieter upstream): doggo is the maintained Go dig-with-DoH lane, not a recursive resolver and not dig dialect-complete. You still pick the upstream resolver.

Vs Grype (vuln *scan* from SBOMs/images) and Trivy (broader scanner): Syft is the *SBOM producer*, not the CVE verdict engine. Format choice and package coverage still need CI wiring; it does not replace signed attestations (cosign) or policy gates by itself.

Vs changesets / release-please (monorepo version+PR bots) and hand-edited CHANGELOG.md: git-cliff is a *generator from history*, not a publish orchestrator. Garbage commits in, garbage sections out — you still need commit discipline and a template you trust.

GoReleaser *Pro* is a paid closed-source distribution (extra installers, air-gap, NPM publish, AI notes, etc.). The MIT OSS CLI covers most open-source Go release lanes — do not confuse Pro marketing with the free binary. Vs hand Makefile + gh release: you still own signing keys, registry auth, and tag discipline.

Vs git-cliff (changelog *from commit history*) and release-please: Changesets is *intent-first* (you write the change note), not history-parser-first. Empty or late changesets mean silent version drift. It versions packages — it does not replace your publish secrets or npm 2FA.

Vs k3d/k3s (lighter single-binary k8s), colima (container runtime host), and minikube: kind is *Kubernetes-in-containers*, not a production control plane and not a substitute for cloud quotas. Needs a working container runtime; multi-node “realism” is still fake under one Docker host.

Vs Docker/Buildah (general image builders) and Earthly (Earthfile builds): ko is *Go-only containerize-from-source*, not a general Dockerfile/Buildah recipe engine. Non-Go runtimes and multi-language images are out of scope. Registry auth and base-image choice are still yours.

Vs Skopeo (copy/inspect without a daemon) and Dive (*layer/size forensics* TUI): crane is the *go-containerregistry Swiss-army CLI* (mutate, digest math, gcr helpers), not Dive’s UI and not Buildah’s image builder. No daemon; you still need registry credentials that work.

Vs Docker (encyclopedia — engine+Desktop), Podman (*run* containers/pods), ko (*Go-only* no-Dockerfile), and Hadolint (Dockerfile *linter*): Buildah is the *image builder*, not the runtime and not the linter. Learning curve if you leave Dockerfile mode for the scripted API.

Vs crane (go-containerregistry mutate/digest CLI) and Dive (layer UI): Skopeo is the *policy-friendly copy/inspect/sync* tool in the containers toolkit, not a layer explorer and not an image builder (that’s Buildah). Signing/policy config is powerful and easy to misconfigure once.

Vs just (CC0 *justfile* command runner): Task is *Taskfile.yml* with includes/deps as a first-class YAML graph — not a thin twin of just, and not Make’s implicit DAG. Still a command runner, not a build system or package manager. Pick one runner per repo or you will confuse newcomers.

Vs flannel/Calico defaults: Cilium is the deeper eBPF control plane — more power, more kernel/datapath expertise. Isovalent/Cisco commercial layers exist around the same codebase; self-host OSS carefully for upgrades and Hubble ops.

License: not a clean Apache-2.0 grant. NAVOP_LICENSE bans selling/reselling/paid redistribution, bundling into commercial products, paid download hosting, building competing products or services from its code, reverse engineering, and military use — free-channel redistribution only. Treat it as source-available. Vs Submarine (focused SSH/SFTP client): Navop is the broader ops+AI workspace. Vs Tabby (self-hosted coding assistant): Tabby is a local coding LLM product; Navop is connection/ops UI with agent features. Young native app — treat remote-desktop and AI connectors as maturing; verify release channel for your OS.

Vs Navop: Navop is the wider DB/RDP/AI ops suite; Submarine stays on SSH/SFTP done well. Vs Termius-class paid clients: no team vault cloud here — keys and sync are local/self-managed. Mid-★ (~374) kept as clean OSS remote-access fill; confirm Android/desktop release maturity for your workflow.

Created and still driven by ARMO, which sells a commercial platform on top, so expect docs and links to point there. Full-framework scans are noisy on a first run; pick one framework or a namespace scope before wiring it into CI. Image scanning wraps Grype, so it overlaps with Trivy if you already run that. The runtime operator is a real in-cluster footprint, not just a CLI.

It is a control panel with root-level power over your web server: never expose it to the internet without strong auth, and put it behind a VPN or allowlist. The MCP interface hands an agent the same power, so scope it carefully. AGPL-3.0 matters if you modify it and offer it to others over a network. Much of the community and docs traffic is in Chinese.

It is a single-host PaaS by design: no built-in multi-node scheduling or high availability, so one VM is one failure domain. There is no web dashboard in the core project; you work in the CLI. Database plugins are convenient, but you still own backups and upgrades on that box.

It is a dashboard, not monitoring: it shows status but does not alert you. Configuration is hand-edited YAML, and complex layouts take trial and error. Do not expose it publicly without auth in front, since it can reveal what you run.

Configuration is YAML only, with no editor in the UI. It is a reading dashboard, not an app launcher with integrations as deep as Homepage. Still pre-1.0. Stars have grown fast (about 290 a week since 2024), but this is an established, actively released project.

It overlaps heavily with Homepage; Dashy leans toward UI customisation, Homepage toward service widgets. The Vue frontend is heavier than minimal dashboards like Glance or Homer. Status checks are simple pings, not alerting.

It is one big Java application, heavier than Gitea or Gogs. Starting with 16.9.0, Intel Macs and FreeBSD are no longer supported. Issues and PRs live on the project's own instance (code.onedev.io), not GitHub, so the GitHub repo is a mirror. Fewer third-party integrations than GitLab.

Development is slower and more conservative than its fork Gitea/Forgejo, and there are no built-in CI runners or package registry. The API is still described as experimental. Release cadence is a few per year.

The community blocklist works by sharing signals: your instance reports attacking IPs to CrowdSec's network, so read the data policy. The web Console and premium blocklists are a commercial layer on top of the free engine. Tuning parsers and scenarios for custom apps takes real effort.

It is a wrapper, so restic's model (and its repository format) is what you are really adopting. It manages backups on the machine it runs on; it is not a central server for a fleet. Mostly a single-maintainer project.

Its own README warns there are no warranties and to use it at your own risk. You run a core server plus an agent on each host, so it adds moving parts. It is Docker-centric, not a Kubernetes replacement. Smaller community than Portainer.

It does not talk to your devices or discover anything on its own; you populate it by import, API or plugins, and keeping it accurate is a process problem. It needs Postgres and Redis. NetBox Labs sells NetBox Cloud and Enterprise; the Community edition stays free.

Running your own resolver makes it a single point of failure for your whole network, so run two. It is a .NET app, heavier than a minimal resolver like Unbound. Mostly built by one company and core developer.

You are centralising SSH keys and passwords for your servers in one web app, so it must be patched, backed up and kept off the open internet. Feature plugins each live in their own repo and move at different speeds. Young compared to Guacamole or Teleport.

Users still have to trust the server not to serve malicious JavaScript, so it must run over HTTPS with HSTS. Anyone with the full link can read a paste without a password. PHP is a deliberate choice; it is not a Go single binary.

Small project with a single main maintainer, so expect a narrower feature set than a full wiki. The MCP endpoint gives an assistant write access to your snippets, so scope the API key. GPL-3.0 if you redistribute modified versions.

Check the license before you depend on it: code outside the /proprietary directory is Apache-2.0, but anything in /proprietary is under the Dokploy Source Available License, which requires a commercial agreement for production use. Stars have grown fast (about 290 a week since 2024) for a real, widely used project. Still 0.x, and you run Docker Swarm underneath.

Running stateful databases on Kubernetes is only a good idea if your team already runs Kubernetes well; storage class and node failures become database problems. Backups still need testing. Commercial support comes from third parties listed in the project.

It reads what the cluster still holds, so it does not replace a log store for history or search across days. Large clusters with chatty workloads can strain the API server. Still pre-1.0.

It is deliberately not a full LDAP server: schema and features are limited, so some enterprise apps will not work. Still 0.x. Pair it with an SSO layer like Authelia for modern login flows.

v2 moved all configuration to CLI arguments and ignores .env files, which breaks older deployment recipes — read the migration guide. Much smaller community than Keycloak, Zitadel or Authentik. You own security updates.

Self-hosting is a multi-service setup (Go servers, Postgres, Redis and more), and docs lean toward Authgear Cloud. Smaller community than Keycloak or Zitadel. SMS and WhatsApp OTP need your own provider and its costs.

Nginx only (via auth_request); for Traefik or Caddy, other forward-auth tools fit better. It authenticates but offers only basic authorization by domain, user or team. Tagged releases are infrequent, so follow main or the Docker images.

You have to install and trust its CA certificate on the device, and apps that pin certificates won't work without extra steps. The last release was in May, though commits continue. Use it only on traffic you are allowed to inspect.

The app is free for personal use, but the pricing page says you need a paid license to use it at work (from $79/year per person). A younger ecosystem than Postman, with fewer team features.

The hosted Artillery Cloud dashboard is a separate paid product; the CLI is the free part. Running at scale bills your own AWS account. k6 is the main alternative if you prefer scripting in JavaScript only.

Remote caching and distributed CI run through Nx Cloud, a paid service with a free tier. Plugins and generators add their own conventions and upgrade churn. For a small repo, Turborepo or plain workspaces are lighter.

The last tagged release is 1.7.7 from March 2024, though the repo still gets commits. Exposing a shell on the web is risky: put it behind real auth and TLS, not just basic auth.

The LICENSE file is MIT except packages/ee, which is under a commercial license, so this is open-core and some enterprise features need a paid plan. GitHub shows no single license. Still pre-1.0.

Some features, such as advanced SSO and granular access control, sit in paid plans. Apps live inside the platform, not as plain code you can export. The self-hosted image is heavy.

The AI features (app generation, AI query builder, agent builder) are Enterprise, and the README's quick-start Docker image is the enterprise LTS build, so check what you are running. The MCP server is in beta. AGPL-3.0 matters if you modify it and offer it as a service. Appsmith is the closest alternative.

Terraform is under BUSL-1.1 (Business Source License): free to use and self-host, including in production, but you can't offer it as a competing paid hosted or embedded service. Each version becomes MPL-2.0 four years after release. OpenTofu is the MPL-2.0 fork. GitHub shows the license as NOASSERTION because BUSL is not an OSI license; the LICENSE file is the one to read.

License first: Vault 1.15.0 and later are under BUSL-1.1, which is source-available, not open source. You may use it in production and host it for your own organization. You may not offer it to third parties as a paid hosted or embedded product that competes with IBM's paid Vault. Each version becomes MPL-2.0 four years after release. GitHub shows NOASSERTION; read the LICENSE file. Some features, such as namespaces and performance replication, are Enterprise-only. Running it well (unsealing, HA storage, backups) takes real ops work. OpenBao is the MPL-2.0 fork.

It is a heavy multi-service install: core, portal, job service, the registry itself, Postgres, Redis and a scanner, set up with the installer and Docker Compose or the Helm chart. That is overkill for one developer or a small homelab; a single-binary registry like zot is lighter.

It is a big control plane with many CRDs and a steep learning curve, and the proxies cost CPU and memory on every node or pod. Debugging a misbehaving mesh is its own skill. With a handful of services, plain Kubernetes networking plus a gateway is usually enough.

A young project (about a year old), and most commits come from one contributor. The server can push package upgrades to every enrolled host, so lock it down like any fleet-control tool. AGPL-3.0 means that if you modify it and offer it as a service, you must publish your changes. A paid managed cloud exists; self-hosting is free.

A much smaller community than Harbor, and team features such as per-project RBAC and replication policies are thinner. Because it follows the OCI spec closely, test older Docker-format tooling against it before migrating.