Resources
Tools
The tools of the DevSecOps stack, sorted by use: system administration, development, infrastructure as code, containers, CI/CD, security, observability. Each card leads to the guide that explains it on this site, or to its official project, with a command to get started. Tool summaries and guides are in French for now.
- 921 tools each with a command to get started
- 17 categories sorted by use
- 92 facets filters to narrow the catalogue
Filter Level, system, 17 categories, 92 facets
Featured tools 4
NetBird
NetBird is an open source, fully self-hostable WireGuard mesh platform. Unlike Headscale (which reuses the Tailscale clients), NetBird ships its own complete stack: agents, control plane, management web interface and relay infrastructure (Management, Signal, Relay). It offers graphically managed identity-based ACLs, built-in SSO/MFA and a reverse proxy to expose internal services. It is the most complete sovereign alternative to Tailscale when you want to keep everything in-house with a UI, without depending on a third-party control plane.
docker compose up -d
Orca
Orca (Varnish) is a "virtual container registry" that consolidates and speeds up registries for build and runtime artifacts. By caching Docker images, NPM packages, Helm charts, Go modules and much more, Orca accelerates continuous integration.
docker pull varnish/orca --platform linux/amd64
Plumber
Plumber is a security scanner for GitLab CI/CD and GitHub Actions. It detects unpinned images, third-party actions not pinned by SHA, untrusted sources, unprotected branches and Docker-in-Docker. It returns a Plumber Score from A to E, exports a PBOM and integrates natively as a GitLab component.
plumber analyze
SysWarden
SysWarden is a Linux host firewall orchestrator written in Go: an authoritative nftables policy, blocklists, GeoIP, ASN, CIS L2 hardening and out-of-band log analysis.
wget https://github.com/duggytuxy/syswarden/releases/download/v<version>/syswarden_<version>_amd64.deb && sudo apt-get install -y ./syswarden_<version>_amd64.deb
Neovim
Neovim is a modern fork of Vim focused on extensibility and usability. Native Lua support, an RPC API, an integrated terminal, Tree-sitter, LSP and modern GUIs. Compatible with most Vim plugins.
nvim fichier.txt
fzf
fzf is a command-line fuzzy finder, portable (single binary) and ultra-fast, with shell integration (Bash/Zsh/Fish), a Vim/Neovim plugin, a preview window and versatile event-action binding.
fzf
Ventoy
Ventoy turns a USB stick into a multi-ISO boot medium: just copy the images, with no reformatting at each change.
Alacritty
Alacritty is an ultra-fast, GPU-accelerated terminal emulator. Written in Rust, it delivers outstanding performance for intensive workflows while staying minimal and configurable in YAML.
alacritty
TlDR
TLDR pages are collaborative cheatsheets that simplify man pages with practical examples. They cover Linux, macOS and Windows and are translated into 60+ languages, with clients in Python, Rust and Node.js. A community project with 2900+ contributors.
tldr tar
ripgrep
ripgrep (rg) is a command-line recursive search tool, 10 to 100x faster than grep. Written in Rust, it automatically honours .gitignore, supports PCRE2 regex, searches compressed files and filters by file type.
rg 'pattern' .
Ghostty
Ghostty is a modern terminal emulator developed by Mitchell Hashimoto. GPU-accelerated with native rendering, it combines performance with a polished user experience for demanding developers.
ghostty
bat
Bat is a cat clone with wings: syntax highlighting for many languages, Git integration (diff in the margin), automatic paging and customisable themes.
bat fichier.txt
Go
Go is an open source programming language created by Google, designed to be simple, reliable and efficient, with native concurrency support and compilation to static binaries.
go run main.go
Rust
Rust is a systems programming language that guarantees memory safety and thread safety without a garbage collector, thanks to its ownership system. It offers performance close to C/C++, a package manager (Cargo), a formatter (rustfmt), a linter (Clippy) and rust-analyzer for IDEs.
cargo run
UV
uv (Astral) is an ultra-fast Python package manager written in Rust, 10-100x faster than pip. It replaces pip, pip-tools, pipx, poetry, pyenv and virtualenv, and supports a universal lockfile, workspaces, inline scripts and Python version management.
uv pip install -r requirements.txt
lazygit
lazygit is an interactive Git TUI client for staging, commits, rebases and visual conflict resolution.
lazygit
Hoppscotch
Hoppscotch is an open source API client (MIT licence) that replaces Postman without sending your collections to the cloud. It handles REST, GraphQL, WebSocket and SSE, can be self-hosted with Docker, and replays your API tests in CI with the hopp CLI.
hopp test -e env.json collection.json
Git
Git is a fast, scalable distributed version control system with a rich command set for both high-level operations and access to internals, created by Linus Torvalds.
git statusRuff
Ruff is a Python linter and formatter written in Rust, 10 to 100x faster than Flake8/Black. It offers 800+ built-in rules, replaces Flake8, isort and Black, and is configured through pyproject.toml. Developed by Astral (the makers of uv).
ruff check . --fix
Homebrew
Homebrew is the missing package manager for macOS and Linux. It installs CLI tools, software and dependencies through formulae and casks from the terminal.
brew install htop && brew info htop
Firecracker
Firecracker (AWS) launches microVMs in milliseconds. Secure VM-level isolation with a minimal footprint (<5MB). The basis of Lambda and Fargate. Ideal for serverless.
firecracker --api-sock /tmp/firecracker.socket
Proxmox VE Helper Scripts
Proxmox VE Helper Scripts is a collection of community scripts to automate Proxmox VE: quick creation of LXC containers (Docker, Home Assistant, AdGuard and more), VMs, network configuration and backups. 200+ ready-to-use templates with a simple copy and paste. Essential for Proxmox administrators who want to save time provisioning and running their homelab.
bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/docker.sh)"
Vagrant
Vagrant (HashiCorp) creates and manages reproducible virtualised development environments, configured through a Vagrantfile. It supports VirtualBox, VMware, Docker, AWS and OpenStack, is portable across Windows, macOS and Linux, and provisions with Shell, Ansible, Chef and Puppet.
vagrant up
Lima
Lima launches lightweight Linux virtual machines from the CLI, designed to run containers on macOS and Linux.
Quickemu
Quickemu creates and launches optimised QEMU VMs for Windows, macOS or Linux in a single command, with no manual configuration.
QEMU
QEMU is the machine emulator and virtualiser that provides the devices and user space of VMs, accelerated by KVM on Linux.
qemu-system-x86_64 -enable-kvm -m 2048 -cdrom debian.iso
Netboot.xyz
Netboot.xyz is a network-bootable OS installer based on iPXE, for multi-OS bare-metal deployment over PXE/HTTP.
Multipass
Multipass launches disposable Ubuntu VMs in a single command, with cloud-init, for reproducible local prototyping.
Syncthing
Syncthing synchronises your files between devices over encrypted peer-to-peer connections, with no central server and no third-party cloud.
syncthing
Rclone
Rclone ("rsync for cloud storage") is a CLI tool to sync, copy and mount files to 70+ cloud providers: S3, Google Drive, Dropbox, OneDrive, Azure Blob, SFTP and WebDAV. Supports encryption, compression, chunking and FUSE mounts. 55k+ GitHub stars.
rclone sync /local/path remote:bucket
Restic
Restic is a fast, secure backup program with AES-256 encryption by default and data deduplication. It supports many backends: local, SFTP, S3, B2, Azure Blob and Google Cloud Storage, with snapshot-based management and granular restore.
restic backup ~/Documents
SeaweedFS
SeaweedFS is a high-performance distributed storage system, compatible with S3 and POSIX. An alternative to MinIO and Ceph, optimised for billions of files. Features: cloud tiering, cross-datacenter replication, erasure coding, encryption, WebDAV, FUSE mount and Kubernetes and Hadoop integration. Perfect for object storage, data lakes and artifact registries.
docker run -p 9333:9333 -p 8080:8080 chrislusf/seaweedfs server -master.port=9333 -volume.port=8080
RustFS
RustFS is a high-performance S3 object storage written in Rust. A masterless peer-to-peer architecture, built-in Reed-Solomon erasure coding and an admin web console. Single binary, Apache 2.0 licence. A fast alternative to MinIO (2.3x faster on small objects). Stable release 1.0.1, a young project.
rustfs --address :9000 --console-enable /data/rustfs0
Ceph
Ceph is an open source distributed storage system offering object storage (S3-compatible), block (RBD) and file (CephFS) storage on the same infrastructure. Designed to be self-healing, scalable and free of single points of failure, Ceph is the de facto standard for cloud-native and Kubernetes storage (through Rook). Used by Red Hat, SUSE and DigitalOcean, and built into OpenStack.
ceph status
Duplicati
Duplicati makes encrypted, incremental backups to the cloud (S3, Backblaze, Azure, Google Drive).
duplicati-server
Kopia
Kopia is an incremental backup tool with deduplication, encryption and cloud support (S3, B2, GCS).
kopia repository create filesystem --path /backup && kopia snapshot create ~/Documents
Coolify
Coolify is a self-hosted open source PaaS, an alternative to Heroku, Vercel and Netlify. Deploy applications, databases and services on your own servers through an intuitive interface. Supports Docker, Docker Compose, Git push deployment, automatic SSL (Let's Encrypt) and 280+ one-click templates. Multi-server management, automatic backups and built-in monitoring. Perfect for taking back control of your infrastructure.
Portainer
Portainer is a web management interface for Docker, Swarm and Kubernetes. View and manage containers, images, volumes and networks from an intuitive dashboard. Features: RBAC, application templates, private registries, logs, an exec console and stack deployment. A free Community edition and a Business edition for companies. Essential for teams that want to run their containers without the CLI.
docker run -d -p 9000:9000 --name portainer -v /var/run/docker.sock:/var/run/docker.sock portainer/portainer-ce
Docker Compose
Docker Compose defines and runs multi-container applications from a declarative compose.yaml file compliant with the Compose Spec, simplifying the build/run cycle with docker compose up.
docker compose up -d
Dokploy
Dokploy is a lightweight open source PaaS, an alternative to Vercel, Netlify and Heroku. Deploy applications (Node.js, Python, Go, PHP) and databases (MySQL, PostgreSQL, MongoDB, Redis) on your VPS. Features: native Docker Compose, built-in Traefik, automatic SSL, backups, real-time monitoring and notifications (Slack, Discord). Simpler than Coolify, perfect for getting started with self-hosting.
LazyDocker
LazyDocker is a terminal interface (TUI) to manage Docker and Docker Compose. A real-time view of containers, images, volumes and networks, showing logs, CPU/memory metrics and states. One-keypress actions: restart, remove, prune. Written in Go with the gocui library.
lazydocker
1Panel
1Panel is a modern web administration panel for Linux servers. An intuitive interface to manage Docker (containers, images, compose), websites (Nginx, SSL certificates), databases (MySQL, PostgreSQL, Redis), files and backups. Includes an app store with 100+ one-click applications. A lightweight alternative to cPanel and Plesk, well suited to self-hosting and server administration.
Podman
Podman (POD MANager) manages OCI containers and pods without a daemon. Daemonless for stronger security and fewer resources at rest. Native rootless support, a Docker-compatible CLI, image and volume management, pods (groups of containers) and a REST API. Runs on Linux, Mac and Windows through podman machine.
podman run -it --rm alpine sh
Dokku
Dokku is a minimalist open source PaaS that turns a Linux server into a Heroku-like platform. With a simple git push, it detects the language, builds and deploys the application with Docker. It supports buildpacks, Dockerfile, plugins (PostgreSQL, Redis, Let's Encrypt) and horizontal scaling. Perfect for side projects, startups and self-hosting without the complexity of Kubernetes.
dokku apps:create myapp && git push dokku main
Kubernetes
Kubernetes (K8s) is the de facto standard for container orchestration, automating the deployment, scaling and management of containerised applications. The control plane distributes pods across the cluster's nodes to optimise resource usage and guarantee high availability. Kubernetes offers auto-scaling, self-healing, persistent volume management and native load balancing. Available as managed services (EKS, AKS, GKE) or on-premises with Rancher and OpenShift, it fits into any cloud-native and DevOps ecosystem.
kubectl get pods -A
Traefik
Traefik is a cloud-native reverse proxy and load balancer. Automatic discovery through Docker, Kubernetes, Consul and etcd, automatic Let's Encrypt certificates and support for HTTP/2, WebSocket and gRPC. A built-in web UI and Prometheus metrics.
docker run -p 8080:8080 traefik:latest --api.insecure=true
Istio
Istio is an open source CNCF service mesh that layers onto distributed applications. It provides traffic management, service-to-service authentication, policies and telemetry through Envoy sidecar proxies and the Ambient mode (ztunnel).
istioctl install --set profile=demo
K9s
K9s is a TUI for Kubernetes for fast navigation, resource management and cluster troubleshooting in the terminal.
K3s
K3s is a lightweight Kubernetes distribution packaged as a single binary, bundling Containerd, Flannel, CoreDNS and Traefik, designed for the Edge, IoT and resource-constrained environments.
Minikube
Minikube runs a local Kubernetes cluster on macOS, Linux and Windows. Ideal for development and learning. Supports LoadBalancer, multi-cluster, Persistent Volumes and the Dashboard. Drivers: Docker, VirtualBox, Podman, KVM. Many addons: NVIDIA GPU, monitoring, Ingress.
minikube start
Helm
Helm is the package manager for Kubernetes (a CNCF project), deploying applications through Charts that contain templates and manifests, comparable to apt/yum/homebrew for K8s.
helm repo add bitnami https://charts.bitnami.com/bitnami
Dapr
Dapr provides built-in APIs for microservices: pub/sub, state management, secrets, workflow and actors through a portable sidecar. A CNCF Graduated project, multi-cloud and edge.
dapr init
ArgoCD
ArgoCD (Argo CD) is an open source GitOps tool for Kubernetes (a CNCF Graduated project). It syncs the cluster state from Git as the single source of truth, with Helm, Kustomize and Jsonnet support, one-click rollback and a web interface.
kubectl create namespace argocd
kubectl apply -n argocd --server-side --force-conflicts -f https://raw.githubusercontent.com/argoproj/argo-cd/v3.4.5/manifests/install.yaml
Bytebase
Bytebase is a DevSecOps platform for databases with GitOps, data masking, access control and schema migration for PostgreSQL, MySQL and Oracle.
Flux CD
Flux CD is an open source GitOps toolkit for Kubernetes (CNCF Graduated). It syncs clusters from Git or OCI through modular controllers: Source, Kustomize, Helm, Notification and Image Automation.
flux bootstrap github --owner=<user> --repository=<repo> --path=clusters/my-cluster
Helmfile
Helmfile deploys Helm releases declaratively per environment and generates manifests ready for ArgoCD.
Kargo
Kargo orchestrates the promotion of artifacts from one environment to the next, GitOps-style. A companion to Argo CD on Kubernetes.
Argo Rollouts
Argo Rollouts is a Kubernetes controller for progressive delivery. It offers blue-green and canary with traffic shaping (Istio, NGINX, ALB), and analyses Prometheus metrics for automatic rollback.
kubectl argo rollouts get rollout my-rollout --watchFlagger
Flagger is a Kubernetes progressive delivery operator (CNCF Graduated, Flux family) that automates Canary, A/B testing and Blue/Green releases with metrics analysis for Istio, Linkerd, Nginx, Contour and Gateway API.
kubectl get canaries --all-namespaces
Fleet
Fleet (Rancher) deploys GitOps applications across thousands of clusters: centralised management, Helm/Kustomize bundles and edge computing at scale.
helm install fleet-crd https://github.com/rancher/fleet/releases/download/v0.10.0/fleet-crd-0.10.0.tgz
ACT
Act runs your GitHub Actions workflows locally with Docker, without pushing every change to the remote repository. Ideal for debugging and quick tests, it reads the .github/workflows/ files and runs the jobs in containers that reproduce the GitHub environment. You get instant feedback on your CI/CD pipelines, cut round trips to the remote server and speed up your development cycle. Available on Linux, macOS and Windows, act also integrates with VS Code through a dedicated extension.
act -l
Gitea
Gitea is a lightweight self-hosted Git service written in Go, with repository hosting, CI/CD, project management and packages.
gitea web
Huginn
Huginn is a system of autonomous agents that watch the web, trigger actions and automate workflows.
docker run -d -p 3000:3000 huginn/huginn
Apache Airflow
Airflow orchestrates complex workflows as Python DAGs: scheduling, monitoring, retries and cloud integrations. The standard for data engineering and MLOps pipelines.
Gogs
Gogs is an ultra-lightweight self-hosted Git service written in Go. With a minimal memory footprint (~30 MB RAM), it installs in minutes and runs on a Raspberry Pi. Gogs covers the essentials: repositories, issues, pull requests, webhooks and wiki. Perfect for small teams or personal projects looking for a simple, sovereign alternative to GitHub without GitLab's complexity.
gogs web
Drone
Drone is a cloud-native CI/CD platform that uses Docker containers for every pipeline step. With its simple YAML configuration, multi-platform support (amd64, arm) and scalable architecture, Drone suits teams looking for a lightweight, fast CI. Native integration with GitHub, GitLab, Bitbucket and Gitea. A modern alternative to Jenkins for containerised workflows.
drone execHarness
Harness is a complete open source CI/CD platform, the successor to Drone. It combines code hosting (Git), DevOps pipelines, development environments (Gitspaces) and artifact registries. A modern Go architecture with Docker and Kubernetes support and an intuitive web interface. A powerful alternative to GitLab CI and Jenkins for teams looking for an all-in-one, self-hosted solution.
docker run -d -p 3000:3000 -v /var/run/docker.sock:/var/run/docker.sock harness/harness
Kestra
Kestra is an open source event-driven orchestration platform to automate workflows and data pipelines. Declarative YAML configuration, a web interface with a visual editor and 500+ plugins (AWS, GCP, databases, APIs). Supports scheduling, real-time triggers, parallelism and retry. A modern alternative to Airflow and Prefect, more approachable thanks to its Infrastructure as Code approach.
docker run --pull=always --rm -it -p 8080:8080 kestra/kestra:latest server local
Ansible
Ansible is an open source configuration management and IT automation tool that works agentless. With declarative YAML playbooks and dynamic inventories, it provisions, configures and orchestrates infrastructure at scale. Ideal for application deployment, system configuration and multi-cloud orchestration, Ansible pairs well with Terraform for a complete IaC approach. Backed by Red Hat, it has a gentle learning curve and an active community with thousands of reusable collections and roles.
ansible-playbook playbook.ymlTerraform
Terraform from HashiCorp is the reference Infrastructure as Code (IaC) tool to provision and manage multi-cloud (AWS, Azure, GCP) and on-premises resources. With its declarative HCL language, you define the desired state of your infrastructure in version-controlled files. The state file tracks changes so that only the differences are applied. With thousands of providers on the Terraform Registry and CI/CD integration through Terraform Cloud, it guarantees reproducibility, collaboration and auditability of your deployments.
terraform init && terraform plan
OpenTofu
OpenTofu is an open source fork of Terraform under the MPL-2.0 licence. It provides declarative infrastructure provisioning, with execution plans, a resource graph and compatibility with existing Terraform providers.
tofu init && tofu plan
Pulumi
Pulumi brings Infrastructure as Code with real programming languages: TypeScript, Python, Go, C#, Java and YAML. It supports 120+ providers (AWS, Azure, GCP, Kubernetes) and offers an Automation API for programmatic orchestration. Apache 2.0 licence.
pulumi upNomad
Nomad is a simple, flexible workload orchestrator from HashiCorp. Unlike Kubernetes, it runs containers, VMs, binaries and batch jobs with a lightweight architecture (a single binary). Its native integration with Consul (service discovery) and Vault (secrets) makes it a pragmatic alternative for teams that want orchestration without the complexity of Kubernetes.
nomad job run example.nomadPacker
Packer (HashiCorp) creates identical machine images for multiple platforms from a single source configuration. Lightweight and fast, it builds images in parallel through plugins for AWS, Azure, Docker, VMware and more. Compatible with HCL2 and convertible into Vagrant boxes.
packer build template.pkr.hcl
Salt
Salt (SaltStack) is a large-scale configuration management and orchestration tool. With its master/minion architecture and ZeroMQ communication bus, Salt excels in environments with thousands of servers and ultra-fast execution. Its declarative states, event-driven automation and ability to run ad-hoc commands make it a powerful choice for IT automation and cloud management.
salt '*' test.pingAWX
AWX is the web interface, REST API and task engine that sit on top of Ansible. It brings what the command line lacks: encrypted credentials, RBAC, dynamic inventories, job templates, workflows and traceability. It is the free upstream project of Red Hat Ansible Automation Platform. Beware: no release has been published since July 2024 (24.6.1), pending a large-scale rewrite. Installing AWX today means deploying a frozen image whose dependencies keep accumulating vulnerabilities. For a maintained platform, see the Ascender fork.
kubectl apply -k github.com/ansible/awx-operator/config/default?ref=2.19.1
Strix
Strix deploys autonomous AI agents that find and prove an application's vulnerabilities with PoCs. Open source, but an LLM is required.
libFuzzer
libFuzzer is an in-process fuzzing engine built into LLVM/Clang, coverage-guided, for testing functions and parsers.
Metasploit Framework
Metasploit is the reference exploitation framework for pentesting: exploits, payloads and post-exploitation.
Trivy
Trivy is the most complete open source security scanner, developed by Aqua Security. It detects vulnerabilities, misconfigurations and exposed secrets in your Docker images, file systems, Git repositories and IaC configurations (Terraform, Kubernetes). Trivy is the default scanner of GitLab Container Scanning, Harbor and Artifact Hub. Its vulnerability database covers the main languages (Python, Node.js, Go, Java) and operating systems. Lightweight and agentless, it fits easily into your CI/CD pipelines for effective shift-left security. Trivy also generates SBOMs (Software Bills of Materials) that comply with the SPDX and CycloneDX standards.
trivy image nginx:latest
CyberChef
CyberChef is GCHQ's web Swiss army knife: encode, decode, analyse and defang data through recipes of operations, entirely in the browser.
docker run -d -p 8080:8080 ghcr.io/gchq/cyberchef:latest
Nuclei
Nuclei is a fast vulnerability scanner based on YAML templates. It detects CVEs, misconfigurations and subdomain takeovers, integrates with CI/CD and handles multiple protocols (HTTP, DNS, TCP, SSL, WHOIS).
nuclei -u https://example.com
TruffleHog
TruffleHog is a secret detector for Git, file systems, Docker images and S3, with active verification against 700+ services.
trufflehog git https://github.com/exemple/repo --only-verified
Gitleaks
Gitleaks detects secrets (passwords, API keys, tokens) in Git repositories, files and stdin, with a pre-commit hook, a GitHub Action, customisable regex rules and SARIF/JSON reports.
gitleaks detect --source . -v
Vaultwarden
Vaultwarden is a lightweight, self-hosted alternative Bitwarden server written in Rust. Compatible with all the official clients, it supports Personal Vault, Organizations, Send, Attachments and 2FA (TOTP, WebAuthn, YubiKey, Duo). Deployed with Docker or Podman.
docker run -d --name vaultwarden -v /vw-data/:/data/ -p 8000:80 vaultwarden/server:latest
Keycloak
Keycloak is an open source IAM solution (a CNCF project) offering SSO, OpenID Connect, SAML 2.0, user federation, strong authentication and fine-grained authorization to secure applications and services.
docker run -p 8080:8080 quay.io/keycloak/keycloak start-devHashiCorp Vault
HashiCorp Vault is the reference solution for centralised secrets management and encryption in cloud environments. It offers dynamic secrets with automatic credential rotation, a built-in PKI for certificate management and encryption as a service to protect your data at rest and in transit. Vault provides many authentication methods (tokens, LDAP, Kubernetes, AWS IAM) and fine-grained policies for access control. Its Secret Engines (KV, databases, AWS, Azure) cover every use case. It integrates with your CI/CD pipelines, works with Kubernetes and secures your whole infrastructure with a high availability architecture.
vault status
Certbot
Certbot is the EFF's official ACME client to obtain free Let's Encrypt certificates. It automates the generation, renewal and installation of TLS certificates for Apache, Nginx and others. With its plugins and standalone mode, Certbot makes setting up HTTPS simple and does away with expired certificates through automatic renewal via cron or a systemd timer.
certbot certonly --nginx -d example.com
Infisical
Infisical is the open source platform for managing secrets, certificates and privileged access. It offers a dashboard, automatic rotation, dynamic secrets, leak scanning, an internal PKI, a KMS and SDKs for Node, Python, Go, Java and .NET.
infisical run -- npm start
Authelia
Authelia is an OpenID Connect certified SSO and MFA portal offering 2FA through TOTP, WebAuthn and Duo, which integrates with nginx, Traefik and Caddy.
docker run -v ./config:/config authelia/authelia
Authentik
Authentik is an open source Identity Provider with a built-in proxy. It handles SSO, OAuth2, OIDC, SAML and LDAP for centralised authentication.
docker compose up -d
SOPS
SOPS (Secrets OPerationS) is an editor for encrypted files supporting YAML, JSON, ENV, INI and binaries. It encrypts with AWS KMS, GCP KMS, Azure Key Vault, HashiCorp Vault, age and PGP. Ideal for storing secrets in Git securely (GitOps).
sops --encrypt secrets.yaml
perf
perf is the Linux system profiling tool that analyses CPU, cache, branches and low-level kernel events.
perf stat ./myprogram && perf record -g ./myprogram && perf report
Uptime Kuma
Uptime Kuma is a self-hosted monitoring tool with a modern interface. It monitors HTTP(S), TCP, DNS, Docker, Steam and WebSocket, with notifications through Telegram, Discord, Slack, Email and 90+ services. Multiple status pages, 2FA and a 20-second interval.
docker run -d -p 3001:3001 -v uptime-kuma:/app/data --name uptime-kuma louislam/uptime-kuma:2
Netdata
Netdata is a real-time monitoring platform with per-second metrics, ML anomaly detection, auto-generated dashboards and alerting. A CNCF member supporting 800+ integrations, Kubernetes and a distributed Parent-Child architecture.
bash <(curl -Ss https://get.netdata.cloud/kickstart.sh)
Grafana
Grafana is an open source visualisation and observability platform for metrics, logs and traces from many sources.
docker run -d -p 3000:3000 grafana/grafana
Prometheus
Prometheus is the reference open source monitoring and alerting system, a member of the CNCF. It collects metrics through a pull model and stores them in an efficient time-series database. Its PromQL query language lets you analyse data precisely and build smart alerts through Alertmanager. Natively integrated with Kubernetes and often paired with Grafana for visualisation, Prometheus provides complete observability for cloud-native infrastructure. Ideal for monitoring the latency, throughput, errors and saturation of your services.
promtool check config prometheus.yml
ClickHouse
ClickHouse is an ultra-fast column-oriented OLAP database for real-time analytics. Built to process billions of rows with millisecond queries. Use cases: logs, metrics, product analytics, BI. Supports standard SQL, replication, sharding and advanced compression. Used by Cloudflare, Uber and eBay. A high-performance alternative to Elasticsearch for analytics.
Sentry
Sentry is a real-time error monitoring and APM platform with stack traces, release tracking and alerting.
sentry-cli releases new v1.0.0
Glance
Glance is a minimalist self-hosted dashboard that aggregates all your feeds on a single page. Widgets: RSS/Atom, weather, calendar, stocks, Twitch, GitHub releases, Reddit and monitoring (uptime, Docker). Simple YAML configuration, customisable themes, responsive. A lightweight alternative to Heimdall and Homer, perfect to centralise information for your homelab or DevOps team.
docker run -d -p 8080:8080 -v ./glance.yml:/app/glance.yml glanceapp/glance
frp
frp is a reverse proxy that exposes a service behind NAT or a firewall through TCP, UDP and HTTP tunnels.
Caddy
Caddy is a modern web server with automatic HTTPS by default through Let's Encrypt. Its Caddyfile offers an ultra-simple syntax for reverse proxying, load balancing and redirects. Written in Go (a single binary), Caddy supports HTTP/3 and wildcard TLS, and integrates smoothly with Docker and Kubernetes. A modern alternative to Nginx for teams seeking simplicity without sacrificing performance.
caddy run --config Caddyfile
Pi-hole
Pi-hole is a DNS sinkhole that blocks ads and trackers for the whole network, ideal on a Raspberry Pi.
pihole -up
mitmproxy
mitmproxy is an interactive HTTP(S) proxy to intercept, inspect and modify traffic in real time.
mitmproxy --mode regular@8080
Headscale
Headscale is an open source, self-hostable implementation of the Tailscale coordination server. You keep the official Tailscale clients but point their control plane at your own server (--login-server), which removes any dependency on Tailscale Inc: ideal for sovereignty (control plane in an EU region, GDPR). It supports MagicDNS, ACLs/grants, subnet routers, exit nodes and Tailscale SSH. Docker deployment and a policy you can version in Git. A complete alternative: NetBird.
docker compose up -d
Kong
Kong is a cloud-native API Gateway built on Nginx with service mesh, plugins, rate limiting and authentication.
kong start -c /etc/kong/kong.conf
Tailscale
Tailscale is a zero-configuration mesh VPN based on WireGuard. Each machine gets a stable IP in an end-to-end encrypted private network; a coordination server handles key exchange and NAT traversal through DERP relays, without opening a single firewall port. It provides MagicDNS, ACLs (tailnet policy), subnet routers, exit nodes and Tailscale SSH for Zero Trust access. To keep sovereignty over the control plane, the open source Headscale project reimplements the coordination server as self-hosted software; NetBird is a complete self-hostable alternative.
tailscale up
AdGuard Home
AdGuard Home is a filtering DNS server that blocks ads and trackers across the whole network, with DoH/DoT encryption.
AdGuardHome -s install
Excalidraw
Excalidraw is a whiteboard to draw sketch-style schemas and diagrams, with real-time collaboration.
Hugo
Hugo is the world's fastest framework for building static sites. Written in Go, it offers asset pipelines (images, JavaScript, Sass, Tailwind CSS), multilingual support and Hugo Modules to share content and themes.
hugo new site my-docs && hugo server -D
Reveal.js
Reveal.js creates interactive HTML presentations: Markdown, code highlighting, speaker notes and PDF export. The standard for technical talks and conferences.
Docusaurus
Docusaurus is a React framework from Meta for building open source documentation sites, with versioning, localisation (i18n), MDX support and a quick start through npm init docusaurus.
npx create-docusaurus@latest my-docs classic
Draw.io
Draw.io (diagrams.net) creates technical diagrams: architecture, flowcharts, infrastructure. Desktop and web versions, PNG/SVG export, Confluence/GitHub integration.
Typst
Typst is a modern typesetting system, an alternative to LaTeX with a simple syntax and fast compilation.
typst compile document.typ
Jekyll
Jekyll generates static sites from Markdown/Liquid, native to GitHub Pages, ideal for blogs and documentation.
gem install jekyll bundler && jekyll new my-site && cd my-site && bundle exec jekyll serve
Slidev
Slidev generates presentations from Markdown with Vue.js: live code, LaTeX, animations and themes. Modern and developer-oriented, with PDF/SPA export.
npx slidev
Ollama
Ollama runs LLMs locally (Llama, Mistral, Gemma) with an OpenAI-compatible API. Simple installation, optimised GGUF models and GPU support.
ollama run llama3
LangChain
LangChain is a Python and JS framework for building LLM applications with chains, agents and RAG pipelines.
pip install langchain
llama.cpp
llama.cpp is a C/C++ LLM inference engine that runs GGUF models locally, on CPU as well as GPU.
llama-cli -m model.gguf -p "Bonjour"
vLLM
vLLM is a high-performance LLM inference engine with PagedAttention for 24x higher throughput. It supports the OpenAI API, LoRA and quantization.
Docling
Docling parses PDF, DOCX and HTML and converts them to Markdown or JSON, ready for RAG.
docling document.pdf
LiteLLM
LiteLLM unifies 100+ LLMs (OpenAI, Anthropic, Ollama, Azure) behind a single API. A proxy with load balancing, rate limiting, budgets and logging for production.
litellm --model ollama/llama3
Goose
Goose is a command-line AI agent extensible through MCP, able to automate development and operations tasks.
whisper.cpp
whisper.cpp transcribes audio to text through a C/C++ port of the Whisper model, with CPU or GPU inference.
whisper-cli -m models/ggml-base.bin -f audio.wav
Redis
Redis is an ultra-fast in-memory database used as a cache, message broker and data structure server. It supports strings, hashes, lists, sets, sorted sets, streams, JSON, time series and vector search (RAG). Sub-millisecond latency, 72k+ GitHub stars.
redis-cli
etcd
etcd is a reliable, highly available distributed key-value store used as the source of truth for distributed systems. It is the brain of Kubernetes: it stores the whole cluster state (pods, services, secrets, ConfigMaps). Based on the Raft consensus algorithm, etcd guarantees strong consistency and fault tolerance. Essential to understand Kubernetes and build resilient cloud-native systems.
etcd --listen-client-urls http://localhost:2379
DuckDB
DuckDB is an embedded analytical database that queries CSV, Parquet and remote databases in SQL, with no server.
Valkey
Valkey is an open source in-memory key-value store, a fork of Redis, for caching, sessions and message queues.
valkey-server
Typesense
Typesense is a fast, typo-tolerant open source search engine, with built-in vector and hybrid search.
TimescaleDB
TimescaleDB is a PostgreSQL extension for time series with hypertables, compression and continuous aggregates.
docker run -d --name timescaledb -p 5432:5432 -e POSTGRES_PASSWORD=password timescale/timescaledb:latest-pg15
PostgreSQL
PostgreSQL is the market-leading open source object-relational DBMS. It supports ACID transactions, JSON/JSONB, replication and extensions (PostGIS, TimescaleDB), with standard SQL and an extensible architecture.
psql -U postgres
Vitess
Vitess is a MySQL sharding layer for Kubernetes, designed for horizontal scalability of massive databases.
Plane
Plane is an open source (AGPL-3.0) project management platform, an alternative to Jira and Linear: work items, cycles, modules, pages and triage. Self-hostable with Docker and AI-native (Plane AI, MCP connectors).
Rocket.Chat
Rocket.Chat is an open source team communication platform, an alternative to Slack. With its channels, direct messages, threads, video conferencing, bots and integrations (webhooks, Zapier), it offers a complete self-hosted solution. Its Federation support (Matrix), apps and robust API make it a solid choice for organisations looking for data sovereignty and customisable ChatOps.
docker run -d rocketchat/rocket.chat
Mattermost
Mattermost is an open source team messaging platform designed for enterprise and DevOps environments. With its integrations (Jira, GitLab, Jenkins), Playbooks (incident response), Boards (Kanban) and plugin ecosystem, Mattermost goes beyond chat. A self-hosted edition with high availability, SSO, audit logs and HIPAA/SOC2 compliance for organisations with strong security and sovereignty requirements.
docker run -d mattermost/mattermost-team-edition
Zulip
Zulip is a team chat tool with a unique topic model (threads by subject). Unlike Slack's chronological channels, each conversation has a topic, so you can follow several discussions in parallel without confusion. With its streams, powerful search, natural threading and integrations, Zulip improves the productivity of distributed teams and makes technical discussions easier to follow.
docker run -d zulip/docker-zulip
AWS CLI
AWS CLI is Amazon's official command line interface to manage more than 200 AWS services: S3, EC2, IAM, Lambda, with profile and credential management.
aws s3 ls
Hubot
Hubot is a bot framework created by GitHub to automate operations through chat (ChatOps). Written in CoffeeScript/JavaScript, it integrates with Slack, Mattermost and Discord and can run custom scripts to deploy, monitor and handle incidents. Although less maintained since the Microsoft acquisition, Hubot remains the historical reference for ChatOps and inspired many successors (Errbot, Lita).
npx hubot --create mybot && cd mybot && npm start
GLPI
GLPI is an ITSM and asset inventory platform: tickets, assets, contracts and licences, with an automatic inventory agent. It is the de facto standard in many French IT departments. The GLPI Carbon plugin adds tracking of the energy footprint of assets. GPL-3.0 licence.
Soft Serve
Soft Serve is a self-hosted Git server driven entirely over SSH, with a TUI, on-the-fly repository creation and access control by public keys. Much lighter than Gitea or Forgejo, with no web interface and no database. Part of the Charm ecosystem. MIT licence.
ssh git.example.comAll facets
Les facettes sont des usages transverses. Sélectionner plusieurs = OU (au moins une).
Comment fonctionne le filtrage ?
🔍 Recherche
La recherche filtre instantanément sur : nom, résumé, tags, catégorie et facettes.
🧩 Règle générale
Les filtres sont organisés en groupes :
- Dans un même groupe (Niveau, OS, Catégories, Facettes) : logique OU
→ si vous sélectionnez plusieurs valeurs, l'outil est gardé s'il correspond à au moins une. - Entre les groupes (Recherche + Niveau + OS + Catégorie + Facettes) : logique ET
→ l'outil doit passer tous les groupes actifs.
📊 Niveau
Si vous sélectionnez plusieurs niveaux, on garde les outils débutant OU intermédiaire (etc.).
💻 Système d'exploitation
Si vous sélectionnez Linux + Windows, on garde les outils compatibles Linux OU Windows.
📁 Catégories
Un outil a une seule catégorie, mais vous pouvez filtrer sur plusieurs catégories :
→ on garde les outils dans au moins une des catégories cochées.
🏷️ Facettes
Une facette = un usage transversal (ex : GitOps, Secrets, Logs…).
Sélectionner plusieurs facettes = OU (au moins une facette).
✅ Exemples
- Niveau Débutant + Facette GitOps
→ outils débutants ET GitOps - OS Linux + Windows + Catégorie Kubernetes
→ outils Kubernetes compatibles Linux OU Windows - Facettes Logs + SIEM
→ outils Logs OU SIEM
No tool found
Try another term or reset the filters