Containers

• DockerContainer runtime that changed deployment

  Free / OSS · Freemium · 72.2k GitHub stars

  VerdictContainers are table stakes; Docker is how most start.

  CatchResource overhead compared to native. Security requires attention. Desktop licensing changes affected teams. Image size management is ongoing work.

• KubernetesContainer orchestration at scale

  Free / OSS · Apache-2.0 · 128k GitHub stars

  VerdictPowerful but only worth it at scale.

  CatchComplexity is legendary. Small teams often do not need it. Operational burden is significant. The YAML can become unmanageable.

• KamalDeploy Docker containers to your own VMs with one CLI

  Free / OSS · OSS/MIT · 14.7k GitHub stars

  VerdictThe honest alternative to a PaaS when you already have VMs.

  CatchYou still run Docker hosts. This is not a PaaS. Networking, disks, and what-if-the-VM-dies remain your problem. Kamal 2 changed proxy defaults — read the current docs, not a 2024 blog post.

• DaggerApache-2.0 CI as containers, programmable in your language

  Free / OSS · Apache-2.0 · 16.4k GitHub stars

  VerdictApache-2.0 portable CI. The pipeline is code; Cloud is optional; its pricing is not confirmed here.

  CatchYou need Docker or a compatible engine. Rewriting mature CI YAML is a project, not an afternoon. Dagger Cloud is a separate product with its own pricing.

• TopazApache-2.0 authZ: OPA Rego + embedded Zanzibar in one container

  Free / OSS · Apache-2.0 · 1.4k GitHub stars

  VerdictApache-2.0 combined authZ. Self-host free; not a single-model PDP.

  CatchOne container = OPA Rego + embedded Zanzibar directory (ABAC+ReBAC) — not Cerbos YAML-only PDP and not OpenFGA ReBAC-only Check API. Distinct from Cerbos and OpenFGA.

• Woodpecker CIApache-2.0 container-native CI; self-host forever, no paid tier

  Free / OSS · Apache-2.0 · 8k GitHub stars

  VerdictApache-2.0 container CI. Self-host free forever; no SaaS tier.

  CatchSelf-host only — not GitHub Actions managed UX. Smaller plugin ecosystem than Actions/Drone-era commercial. You own runners, secrets, and forge OAuth. Distinct from GitHub Actions and Buildkite hosted.

• CosignApache-2.0 Sigstore keyless container/artifact signing CLI

  Free / OSS · Apache-2.0 · 6.4k GitHub stars

  VerdictApache-2.0 Sigstore signing. Free CLI; policy engines are separate.

  CatchSigning CLI + public-good Sigstore infra — not a full policy admission controller (pair with Kyverno/OPA). Offline/air-gap needs different PKI. Registry must support referrers/OCI artifacts cleanly.

• TraefikMIT dynamic reverse proxy for Docker/K8s ingress

  Free / OSS · OSS/MIT · 65.3k GitHub stars

  VerdictMIT dynamic proxy for Docker/K8s. Free core; Hub is optional paid.

  CatchVs Caddy: dynamic Docker/K8s LB/Ingress lane, not auto-HTTPS-for-one-binary. Steeper label/static-vs-dynamic model. Not a PaaS. Hub/API-management SKUs are separate paid products you do not need for reverse-proxy duty.

• MailpitMIT local/CI SMTP sink — MailHog successor, not delivery

  Free / OSS · OSS/MIT · 10.7k GitHub stars

  VerdictMIT MailHog successor for local/CI. Free forever; not a mailer.

  CatchSink only — not delivery. Not Resend SaaS, not Postal/Listmonk outbound. Do not point production MX here. Distinct from Resend/Postal/Listmonk.

• PodmanApache-2.0 daemonless OCI containers and pods

  Free / OSS · Apache-2.0 · 33.1k GitHub stars

  VerdictApache-2.0 OCI engine. Free forever; pick it when rootless daemonless is the point.

  CatchVs Docker (encyclopedia): Podman wins on rootless/daemonless defaults, not on Desktop marketplace polish or every Compose edge case. Some tutorials still assume dockerd socket quirks. Image/build UX splits across Podman/Buildah depending on workflow.

• ColimaMIT container runtimes on macOS/Linux without Docker Desktop

  Free / OSS · OSS/MIT · 31.3k GitHub stars

  VerdictMIT local containers on Mac/Linux. Free forever alternative to Docker Desktop for builders who live in the CLI.

  CatchVs Docker Engine / Podman: Colima is the *host runtime wrapper*, not a daemon replacement on Linux servers and not a registry. Still a VM on macOS — RAM/CPU allocation and mount quirks apply. GUI/enterprise support is not the product; Docker Desktop competitors with support desks are paid for a reason.

• actMIT run GitHub Actions locally in Docker

  Free / OSS · OSS/MIT · 72.4k GitHub stars

  VerdictMIT local Actions runner. Free forever; debug the workflow before you burn a push.

  CatchVs hosted GitHub Actions and Woodpecker (self-host container CI): act is a *local emulator*, not a forge runner fleet and not a replacement for GitHub-hosted minutes. Event payload fidelity is incomplete; secrets, service containers, and some actions still surprise. Needs a Docker engine.

• sternApache-2.0 multi-pod Kubernetes log tail

  Free / OSS · Apache-2.0 · 4.9k GitHub stars

  VerdictApache-2.0 K8s log tail. Free forever; follow the fleet, not one pod at a time.

  CatchVs k9s (full Kubernetes *TUI*): stern is the *multi-pod log tail CLI*, not a cluster navigator, not Helm, not a dashboard. Needs kubeconfig and RBAC to read logs. Not Loki/Vector (log pipelines).

• GoReleaserMIT Go release automation — archives, checksums, Homebrew, Docker

  Free / OSS · OSS/MIT · 16.1k GitHub stars

  VerdictMIT Go release CLI. Free forever OSS path; Pro is optional paid power, not required to ship a tag.

  CatchGoReleaser *Pro* is a paid closed-source distribution (extra installers, air-gap, NPM publish, AI notes, etc.). The MIT OSS CLI covers most open-source Go release lanes — do not confuse Pro marketing with the free binary. Vs hand Makefile + gh release: you still own signing keys, registry auth, and tag discipline.

• kindApache-2.0 Kubernetes clusters inside Docker

  Free / OSS · Apache-2.0 · 15.6k GitHub stars

  VerdictApache-2.0 local kube. Free forever; spin a cluster in Docker, tear it down in CI.

  CatchVs k3d/k3s (lighter single-binary k8s), colima (container runtime host), and minikube: kind is *Kubernetes-in-containers*, not a production control plane and not a substitute for cloud quotas. Needs a working container runtime; multi-node “realism” is still fake under one Docker host.

• HadolintGPL-3.0 AST Dockerfile linter + ShellCheck on RUN

  Free / OSS · GPL-3.0 · 12.5k GitHub stars

  VerdictGPL-3.0 Dockerfile linter. Free forever; lint the recipe, dive the layers, lazydocker the running boxes.

  CatchGPL-3.0 copyleft — same class as ShellCheck; not MIT. Vs Docker (the engine), dive (*layer/size forensics*), and lazydocker (Docker/Compose *TUI*): Hadolint is the *Dockerfile linter*, not a runtime, not layer diffs, not a container dashboard.

• koApache-2.0 Go→OCI images without a Dockerfile

  Free / OSS · Apache-2.0 · 8.6k GitHub stars

  VerdictApache-2.0 Go→OCI. Free forever; Dockerfile-free when the app is Go.

  CatchVs Docker/Buildah (general image builders) and Earthly (Earthfile builds): ko is *Go-only containerize-from-source*, not a general Dockerfile/Buildah recipe engine. Non-Go runtimes and multi-language images are out of scope. Registry auth and base-image choice are still yours.

• craneApache-2.0 registry CLI — inspect, copy, mutate OCI images

  Free / OSS · Apache-2.0 · 4.1k GitHub stars

  VerdictApache-2.0 registry CLI. Free forever; Skopeo siblings, Dive forensics, crane for scriptable registry ops.

  CatchVs Skopeo (copy/inspect without a daemon) and Dive (*layer/size forensics* TUI): crane is the *go-containerregistry Swiss-army CLI* (mutate, digest math, gcr helpers), not Dive’s UI and not Buildah’s image builder. No daemon; you still need registry credentials that work.

• BuildahApache-2.0 rootless OCI image builds without Docker

  Free / OSS · Apache-2.0 · 9.1k GitHub stars

  VerdictApache-2.0 rootless image builds. Free forever; Podman runs what Buildah builds.

  CatchVs Docker (encyclopedia — engine+Desktop), Podman (*run* containers/pods), ko (*Go-only* no-Dockerfile), and Hadolint (Dockerfile *linter*): Buildah is the *image builder*, not the runtime and not the linter. Learning curve if you leave Dockerfile mode for the scripted API.

• SkopeoApache-2.0 copy/inspect OCI images without a daemon

  Free / OSS · Apache-2.0 · 11.3k GitHub stars

  VerdictApache-2.0 daemonless image copy. Free forever; pair with Buildah/Podman, use crane when you live in go-containerregistry scripts.

  CatchVs crane (go-containerregistry mutate/digest CLI) and Dive (layer UI): Skopeo is the *policy-friendly copy/inspect/sync* tool in the containers toolkit, not a layer explorer and not an image builder (that’s Buildah). Signing/policy config is powerful and easy to misconfigure once.

• DozzleMIT realtime Docker/Swarm/K8s log UI

  Free / OSS · OSS/MIT · 14.7k GitHub stars

  VerdictMIT live container log UI. Lightweight tail vs full observability stacks.

  CatchVs Grafana/Loki, ELK, Datadog (full observability): Dozzle is lightweight realtime log UI, not metrics/traces/storage/retention. If the container is gone, so is the history Dozzle never kept. Pair with a real log backend when you need audit trails.

• WasmtimeApache-2.0 Bytecode Alliance WebAssembly runtime

  Free / OSS · Apache-2.0 · 18.7k GitHub stars

  VerdictApache-2.0 Wasm runtime. Standards-track sandbox vs WasmEdge/Wasmer; not a container stand-in.

  CatchVs WasmEdge / Wasmer (alternate Wasm runtimes) and vs containers: Wasmtime is a Wasm runtime, not a Docker replacement for every workload. WASI/component maturity and host ABI choices still shape what you can port; not a general app platform by itself.

• SkillboxSelf-hosted versioned skills library with MCP and scoped clients

  Free / OSS · OSS/MIT · 271 GitHub stars

  VerdictMIT self-hosted skills library. Use when multiple agents need a versioned, scoped skill source you control.

  CatchVs Addy Agent Skills / Stitch Skills: Skillbox is the self-hosted library and MCP distribution plane, not a content pack of engineering or Stitch-specific skills. You run Postgres (or Docker Compose) and guard SKILLBOX_ADMIN_TOKEN; optional Jev tips inherit TypeSafe pricing.

• AI-Infra-GuardRed-team platform for agent, MCP, and skill infrastructure

  Free / OSS · Apache-2.0 · 6.9k GitHub stars

  VerdictApache-2.0 red-team platform for agent infrastructure. Worth running in a disposable, keyed environment; ship the attribution and scope every model credential.

  CatchVs Promptfoo and DeepEval: AI-Infra-Guard is an AI-infrastructure red-team platform, not only an eval runner; vs generic SAST, it understands agent/MCP/skill attack surfaces. Preserve the mandatory attribution — “Based on Tencent Zhuque Lab AI-Infra-Guard” — with the repository link in your deployment and derivative notices. Some tools also require an LLM_API_KEY, so a self-hosted scanner can still carry provider cost and credential risk.

• RakazoApache OSS persistent AI teammates — BYO model and sandbox

  Free / OSS · Apache-2.0 · 5k GitHub stars

  VerdictApache self-host teammate stack when you want persistent bots you own with pluggable models/sandboxes; budget Docker and keys, not just the UI.

  CatchVs OpenClaw and DeerFlow: Rakazo is a self-host teammate product (web/desktop/mobile + sandboxes), not a multi-channel messaging agent alone or a SuperAgent research harness. Default install is curl|bash of install-images.sh; beta; BYO model + optional paid sandbox providers; Treg has its own license rider if you embed it.

• AIO SandboxApache one container: browser+shell+files+VS Code+Jupyter+MCP

  Free / OSS · Apache-2.0 · 6.2k GitHub stars

  VerdictApache self-host all-in-one sandbox when one shared FS with browser+IDE+MCP beats a managed microVM — lock the API key and read the seccomp note before exposing it.

  CatchVs E2B, Daytona, and CubeSandbox (Thu managed/microVM sandbox lane): this is a self-host all-in-one container workstation, not hosted Firecracker sandboxes, a managed workspace SaaS, or a KVM density control plane. Quickstart docs use `--security-opt seccomp=unconfined`; set `SANDBOX_API_KEY` or API/Jupyter/VNC stay open by default.

• Open WebUISource-available Ollama/OpenAI chat UI — RAG, tools, multi-user

  Free / OSS · Open-Core · 156k GitHub stars

  VerdictSource-available Ollama/OpenAI chat UI when polished local RAG chat beats building one — branding rules are the Catch vs LibreChat MIT.

  CatchBranding lock — removing “Open WebUI” marks is forbidden above ~50 end users / 30 days without written permission or enterprise license (not OSI MIT/Apache). Vs LibreChat (MIT Agents/MCP/skills orchestration UI): LibreChat leans Agents/MCP/skills; Open WebUI leans Ollama-first chat+RAG+admin. You still BYO models, GPU, and upgrade discipline.

• DBXApache-2.0 agent-facing multi-engine DB client — MCP + CLI + Docker

  Free / OSS · Apache-2.0 · 27.4k GitHub stars

  VerdictApache multi-engine MCP/CLI client when agents must query many DBs you already run — not Neon/DuckDB hosting; distrust the ★ spike and the issue pile.

  Catch★22,325 in about 99 weeks (~225 a week), with 1,284 open issues: judge it on the MCP/CLI substance, not the star count. Vs Neon / hosted DuckDB: those are managed engines; DBX is the agent-facing multi-engine client that sits on connections you already have. MCP is a separate install from the desktop binary; some engines still need the DBX agent/JRE path.

• gVisorApache-2.0 userspace container sandbox — OCI runtime runsc for agent isolation

  Free / OSS · Apache-2.0 · 19.7k GitHub stars

  VerdictApache-2.0 OCI sandbox runtime when agent or untrusted containers need more than runc — Linux-only, syscall gaps, and you bring the orchestrator.

  CatchLinux only (kernel 5.6+ recommended). Not every syscall is implemented — exotic workloads fail or fall back. Heavy file and network I/O pay a measurable overhead versus runc. This is a runtime, not an SDK or an orchestration product: you still wire Docker/K8s/agent harnesses yourself. Vs Firecracker/Cloud Hypervisor (microVMs) and plain seccomp: gVisor is the userspace kernel middle path.

• BeszelMIT lightweight server + Docker monitoring — PocketBase hub, tiny agents, alerts

  Free / OSS · OSS/MIT · 26.4k GitHub stars

  VerdictMIT self-hosted server and container monitoring when Prometheus + Grafana is too much — free, quick to run, but a fixed metric set on a single-hub design.

  CatchFixed set of host and container metrics, not a general metrics platform: no PromQL, no custom app metrics, no logs or traces. The hub is one PocketBase (SQLite) app, so think small fleets, not hundreds of nodes with long high-resolution retention. The agent needs host access (and the Docker/Podman socket for container stats), so scope it like any privileged daemon. Vs Uptime Kuma (endpoint uptime), Dozzle (container logs) and Prometheus + Grafana (full metrics stack): Beszel is the resource-history-and-alerts middle seat.

More with this tag (24)

• Docker Agent — Apache-2.0 YAML-defined agents with MCP toolsets — runs as `docker agent`
• ToolHive — Apache-2.0 MCP server runner + gateway — each server in its own container
• TruffleHog — AGPL-3.0 secret scanner that finds leaked credentials and checks whether they still work
• Gitea — MIT self-hosted Git forge in a single Go binary — repos, PRs, issues, packages, Actions-compatible CI
• Docker Compose — Apache-2.0 multi-container apps from one YAML file
• containerd — Apache-2.0 CNCF container runtime under Kubernetes
• Scion — Apache-2.0 platform for running coding agents as teams
• Gotenberg — MIT Docker API that turns HTML and Office files into PDFs
• Dokku — MIT Docker-powered mini-Heroku on one server
• Homepage — GPL-3.0 dashboard with 100+ service widgets
• Glance — AGPL-3.0 lightweight self-hosted feed dashboard
• Komodo — GPL-3.0 build and deploy tool for Docker across many servers
• Termix — Apache-2.0 self-hosted SSH and server manager
• Dokploy — Apache-2.0 core self-hosted PaaS, open-core
• Kubetail — Apache-2.0 real-time log dashboard for Kubernetes workloads
• Bigcapital — AGPL-3.0 self-hosted accounting and inventory app
• Diun — MIT notifications when Docker images update
• Agent Zero — MIT general-purpose agent framework that runs in Docker and uses the OS as its tool
• kubernetes-mcp-server — Apache-2.0 MCP server that talks to the Kubernetes API directly
• Docker MCP Gateway — MIT docker mcp CLI plugin that runs MCP servers in isolated containers
• Harbor — Apache-2.0 CNCF container registry with RBAC, vulnerability scanning, signing and replication
• zot — Apache-2.0 single-binary OCI registry for container images and artifacts
• lazydocker — MIT terminal UI for Docker and Compose
• dive — MIT Docker/OCI image layer explorer