Containers & Deploys

Docker

Container fundamentals for pinning an environment as code — images, containers, Dockerfiles.

Docker Compose

Defining your app, database, and cache in one file and starting them with one command.

Podman

Running containers without a root daemon — and why an organisation might require it instead of Docker.

Local Kubernetes

A throwaway cluster on your laptop with kind, k3d, or minikube — and a fast inner loop with Tilt or Skaffold.

kubectl and k9s

The minimum you need to inspect and debug a Kubernetes cluster.

Radar

A 30 MB Go binary that gives a Kubernetes cluster a topology map, an event timeline, GitOps drift, a 36-check audit, and an MCP server — k9s …

Helm

Packaging a Kubernetes application as one versioned unit, and installing it with the values that differ per environment.

Kustomize

Environment differences as patches over plain manifests — no templating language, and it's already in kubectl.

cert-manager

TLS certificates issued and renewed automatically inside the cluster, so nobody has to remember an expiry date.

Istio

A service mesh: mutual TLS, retries, traffic splitting, and per-call telemetry without changing application code.

Policy as Code

Kyverno and OPA Gatekeeper — rules the cluster enforces itself, instead of a wiki page nobody reads.

GitHub Actions

Running tests, builds, and deploys automatically on every push.

Jenkins

The CI server that still runs the enterprise — self-hosted, plugin-driven, and happy inside an air-gapped network.

GitLab CI/CD

Repository, pipelines, registry, and releases in one system you can run inside your own network.

SonarQube

A quality gate in the pipeline — bugs, smells, coverage, and duplication measured on the code you just changed.

Nexus Repository

One place your builds pull dependencies from and push artifacts to — a caching proxy, a private registry, and a chokepoint you control.

Harbor

A container registry you run yourself — with scanning, signing, replication, and quotas built in rather than bolted on.

Argo CD

GitOps for Kubernetes — the cluster pulls its desired state from Git and puts back whatever drifts.

Flux

GitOps as a set of controllers with no dashboard — the other CNCF option, and when it fits better than Argo CD.

AWS CodePipeline

CI/CD assembled from AWS services — worth it when IAM, VPC, and the audit trail matter more than developer comfort.

Terraform

Declaring cloud resources as code and reviewing the plan before anything changes.

Pulumi

Infrastructure as code in a real programming language, with stacks, encrypted config, and a preview before every change.

Ansible

Bringing servers to a described state over SSH — no agent, no bootstrap problem, and safe to run twice.

Secrets Management

Getting credentials out of .env files and repositories — Vault, OpenBao, and the smaller options worth trying first.

Trivy

Scanning images, dependencies, and infrastructure code for known vulnerabilities and misconfigurations, in one command.

Falco

Runtime threat detection — watching what containers actually do, after every scan has passed.

Backstage

An internal developer portal — a catalogue of every service, who owns it, and the templates for making the next one.