Infra & DevOps

istio/istio

Istio: a mature service mesh for securing and observing microservices — Istio is an established, CNCF-graduated service mesh that transparently adds traffic control, mTLS security, and observability to existing distributed apps without code changes. It's a solid choice for platform teams running Kubernetes microservices who need load balancing, policy enforcement, and fault injection at the infrastructure layer.

Connect, secure, control, and observe services.

prometheus/node_exporter

The standard Prometheus collector for *NIX hardware and OS metrics — A Go-based Prometheus exporter that surfaces hardware and OS metrics from *NIX kernels via pluggable collectors, listening on port 9100. The README points Windows users to windows_exporter and GPU metrics to NVIDIA's dcgm-exporter, positioning this project specifically for Linux/Unix host monitoring.

Exporter for machine metrics

prometheus/client_golang

The official Go toolkit for instrumenting apps with Prometheus — The standard Go library for Prometheus, offering instrumentation for application code plus a client for the Prometheus HTTP API. It supports the two most recent major Go releases, and an experimental V2 API is in progress for future breaking changes, making it relevant for Go developers adding metrics today.

Prometheus instrumentation library for Go applications

aws/amazon-ssm-agent

AWS's own agent for remote command execution and shell sessions — The SSM Agent runs on EC2 instances, on-premises servers, and VMs to execute Run Command documents and power Session Manager's browser or CLI shell access. Useful for teams managing fleets without opening SSH, since sessions run under an auto-created ssm-user with elevated privileges.

An agent to enable remote management of your EC2 instances, on-premises servers, or virtual machines (VMs).

p10node/k10s

A mouse-friendly, instant-opening alternative to k9s — k10s reimagines the k9s-style Kubernetes TUI with clickable panes, a unified ctrl+p search across kinds and objects, 7 themes, and lazy per-kind informer loading for instant startup. It bundles context-aware AI that already knows your cluster, namespace and selected object, shipped as a single Go binary.

Kubernetes TUI you can click. Instant search, logs/exec/port-forward, 7 themes, context-aware AI. Single Go binary.

stilicho2011/ubuntu_rep

Ready-made Docker Compose files for self-hosted home lab setups — This repo collects ready-to-use Docker Compose files, likely for home lab or self-hosted services. It's tied to the author's Russian-language YouTube channel and bilingual blog, so it may serve as companion material for tutorials rather than a standalone polished project.

nestrilabs/nesbox

Splitting one consumer GPU across many bare-metal-speed VMs — nesbox is a Rust microVM hypervisor for cloud gaming that gives every guest a virtio-gpu device sharing one consumer card at near-native speed, avoiding VFIO lock-in or datacenter-only vGPU/SR-IOV. Benchmarks show 12 guests on an RTX 3060 encoding 720p60 with no dropped frames, within 2% of bare-metal frame times.

Fast, lightweight microVM for cloud streaming that runs on a shared GPU at baremetal speed

coollabsio/coolify

Self-hosted PaaS that keeps your Heroku-like workflow on your own servers — Coolify deploys apps, databases, and 360+ one-click services over plain SSH to any VPS, bare-metal box, or even a Raspberry Pi. It mirrors Heroku/Vercel/Netlify convenience—Git push deploys, PR previews, automatic HTTPS—while your configs and running resources stay independent of the tool itself. Good fit for teams wanting cloud-platform ease without losing control of infrastructure.

An open-source, self-hostable PaaS alternative to Vercel, Heroku & Netlify that lets you easily deploy static sites, databases, full-stack applications and 360+ one-click services on your own servers.

grafana/loki

Loki: cost-efficient log aggregation that reuses your Prometheus labels — Loki skips full-text indexing and instead indexes only metadata labels, making it cheaper and simpler to run than traditional log systems. It reuses the same labels you already use with Prometheus, so switching between metrics and logs is seamless, and it works especially well for Kubernetes pod logs via Grafana.

Like Prometheus, but for logs.

docker-mailserver/docker-mailserver

A Full Mail Server Stack in a Single Container — This project packages Postfix, Dovecot, LDAP, fail2ban, Rspamd and antivirus into one container, configured entirely through plain files instead of a SQL database. Originally started by tomav, it's now volunteer-maintained, aimed at self-hosters who want an easy-to-deploy, versioned mail server without heavy infrastructure.

Production-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.) running inside a container.

bytecodealliance/wasmtime

Wasmtime: a standalone WebAssembly runtime from the Bytecode Alliance — Wasmtime is a standalone runtime for running WebAssembly modules outside the browser, built on the Cranelift JIT/AOT compiler and supporting WASI. It targets developers needing a fast, sandboxed, standards-compliant way to execute Wasm in servers, edge functions, or embedded Rust applications.

A lightweight WebAssembly runtime that is fast, secure, and standards-compliant

aws/aws-cli

The Official Unified CLI for Managing AWS Services — This is the official command line tool from AWS, covering all services through one consistent interface. It supports Python 3.9 through 3.14 and ships installers for macOS, Linux (x86-64/arm64), and Windows. Useful for anyone scripting or managing AWS infrastructure without separate per-service tools.

Universal Command Line Interface for Amazon Web Services

argoproj/argo-workflows

Container-native workflow engine, now with a Python-friendly path via Hera — Argo Workflows runs multi-step jobs as Kubernetes-native DAGs, with every step a container. It's a CNCF graduated project widely used for ML pipelines, data/batch processing, CI/CD, and infrastructure automation, and the Hera Python SDK makes it accessible to Python users too.

Workflow Engine for Kubernetes

encoredev/encore

Declare infrastructure in code, run it locally, deploy to AWS or GCP — Encore lets you declare databases, pub/sub topics, and object storage directly in your backend code via an SDK, then run the full stack locally with its CLI and auto-provision matching cloud resources on deploy. Built for developers and AI coding agents who want to skip manual infra setup while still being able to fall back to Terraform for production.

Infrastructure orchestration from local to your cloud

Zagitta/gpu-unlock

A Linux kernel module unlocks hidden BF16/FP16 speed on RTX 3000 GPUs — This kernel module combines the CMP unlocker's V67/PLM technique with UEFI-style pre-driver timing to double FP/BF16 FMA throughput on GA102/103/104/106 GeForce cards, without patching NVIDIA's driver each release. Benchmarks show BF16 GEMM gains of 25-80% depending on the card, useful for anyone running ML workloads on consumer RTX 3000 GPUs.

Your GeForce runs AI at half speed. This fixes it for 20/30/40 series cards. Up to 2× FP16 / BF16 / TF32 tensor throughput

actions/checkout

Checkout v7 blocks risky fork PR code by default — The latest major version of GitHub's checkout action now refuses to run fork pull request code when triggered by pull_request_target or workflow_run, closing a common pwn-request vulnerability path. It also moved to ESM and updated dependencies, with v6 improving how persisted credentials are stored.

Action for checking out a repo

Mailu/Mailu

A self-hosted mail server stack that skips proprietary extras — Mailu packages a full email server—IMAP/SMTP, webmail, admin UI, DKIM/DMARC, Let's Encrypt, antispam—as Docker images for self-hosting. It adds modern touches like passkey sign-in, WKD key publication, and full-text attachment search, while deliberately avoiding bundled groupware or tracking, making it suited for privacy-minded admins who want control over their own mail infrastructure.

Insular email distribution - mail server as Docker images

fleetdm/fleet

Open-source device management built for GitOps and APIs, not just dashboards — Fleet lets IT and security teams run MDM, patching, and software deployment across Linux, macOS, Windows, Chromebooks, iOS and Android from one open-source platform. It's built around APIs, YAML, webhooks and GitOps rather than manual clicking, and already scales to deployments of 400,000+ devices in production.

Open device management

CachyOS/linux-cachyos

Arch kernels built with multiple schedulers and CPU-tuned optimizations — CachyOS packages enhanced Arch Linux kernels based on Linux 7.1, offering several CPU scheduler variants (cacule, baby-sched, SCX schedulers, etc.) plus compiler and architecture-level tuning for x86-64-v3/v4 and znver4. It's aimed at users wanting better desktop responsiveness or throughput without building a custom kernel themselves.

Archlinux Kernel based on different schedulers and some other performance improvements.

JustAResearcher/gpu-unlock-ada

A Linux kernel module that roughly doubles RTX 4090 tensor throughput — This Linux kernel module overrides the SM speed-select register before NVIDIA's driver loads, unlocking FP16/BF16 tensor throughput on RTX 4090 (and experimental RTX 4070 Ti SUPER) GPUs. Reported measurements show ~2x gains (e.g. 165→331 TF/s) that survive FLR and driver reinit, with matched evidence and limits documented across multiple independent runs.

GPU tensor unlock source for RTX 4090 and experimental RTX 4070 Ti SUPER; firmware generated locally

ZSvirt/zsvirt

Open Source KVM-based IaaS Engine for Enterprise Virtualization — ZSvirt is a Java-built core IaaS engine for private cloud infrastructure, positioned as an open source, community-driven alternative to proprietary hypervisor platforms like VMware vSphere. It targets organizations running VMware workloads who want KVM-based virtualization with migration support, aiming for enterprise readiness without vendor lock-in.

Core IaaS engine and cloud infrastructure foundation of ZSvirt

boto/botocore

The low-level engine quietly powering boto3 and the AWS CLI — Botocore is the foundational, low-level interface to AWS services that underlies both boto3 and the AWS CLI. It's maintained directly by AWS, making it the base layer developers rely on indirectly whenever they use Python to talk to AWS. Recent notices track Python version support, including the end of Python 3.9 support in April 2026.

The low-level, core functionality of boto3 and the AWS CLI.

qitechgmbh/control

A Rust & React alternative to proprietary PLC software — QiTech Control replaces licensed, point-and-click PLC ecosystems with an open-source stack: a Rust backend driving EtherCAT terminals (WAGO, Beckhoff) via Ethercrab, paired with an Electron/React frontend and a realtime NixOS build. It targets developers and industrial automation teams who want modern tooling instead of rigid vendor workflows.

Next Generation Machine Interface

ovh/ovhcloud-cli

A Single Official CLI for the Whole OVHcloud Product Range — This Go-based CLI from OVH unifies management of OVHcloud products and account resources in one tool, with table, JSON, YAML, or gval-expression output for scripting and CI/CD. It also includes an interactive TUI browser, making it useful both for quick manual lookups and automated provisioning workflows.

☀ Official Command Line Interface to manage your OVHcloud services ☁

maharmstone/moxnox

A Self-Hosting Hobby OS Blending NT Design with POSIX Software — Moxnox is a hobby operating system whose syscalls and design mirror Windows NT, yet it runs recompiled Unix software via a full GNU base system and boots from btrfs. At version 1.0 (~130,000 lines of C++, amd64/aarch64), it's mature enough to build itself, making it interesting for OS tinkerers exploring NT-style kernels or btrfs on non-Linux systems.

NT-like POSIX-compatible operating system

juergenbarth/templates

Homelab setup files and scripts behind a YouTube channel — A personal collection of Docker templates, scripts and notes the author uses to run his homelab, tied to accompanying tutorials on his YouTube channel. Useful as a starting point for self-hosters, but the author warns the resources may not be kept regularly updated.

Templates for all kinds of projects, e.g. Docker

aws-samples/sample-aws-devops-agent-terraform

Terraform setup for AWS DevOps Agent, mirroring the CDK example — This repo provides a Terraform equivalent of AWS's CDK getting-started example for AWS DevOps Agent, an AI-powered AWS monitoring tool. It covers deploying an agent space, optional cross-account monitoring roles, and third-party integrations like Dynatrace, ServiceNow, and PagerDuty—useful for teams preferring Terraform over CDK for IaC.

Azure-Samples/app-service-dotnet-agent-tutorial

Simulate App Service Failures to Test Azure's SRE Agent — A small .NET sample app for Azure App Service that intentionally triggers HTTP 500 errors via an INJECT_ERROR setting, letting you safely test deployment slots and the Azure SRE Agent's AI-assisted troubleshooting without touching production. Useful for teams evaluating AI-driven incident response on App Service.

yuu551/agentcore-gateway-tls

Verifying private CA TLS support in Bedrock AgentCore Gateway — A hands-on verification of Amazon Bedrock AgentCore Gateway's private CA support via certificateConfigurations, connecting through VPC Lattice to servers using privately signed certs. Includes CDK stacks for an EC2 MCP server target and an API Gateway OpenAPI target, useful for anyone testing this new Gateway feature before CloudFormation fully supports it.

shuntaka9576/aws-tts-api

A small serverless API that turns Muse replies into Japanese speech — This project wraps Amazon Polly behind an API Gateway + Lambda (Node.js 24, ARM64) stack to convert text replies from 'Muse' into Japanese MP3 audio. It's built with Bun, TypeScript, and CDK v2, using neural voice 'Kazuha', and ships with usage-plan API keys, strict input limits, and no SSML for simplicity.