Open-source alternatives to Datree

k8sgpt is a suite of Kubernetes-focused tools designed for AI-powered debugging, cluster diagnostics, and self-healing. It functions as an automated analyzer and debugger that uses large language models to explain cluster errors, suggest remediation steps, and identify resource failures. The project distinguishes itself through an extensible analysis framework that supports custom diagnostic plugins and a Model Context Protocol server, which exposes cluster diagnostics as tools for AI assistants. It includes a self-healing agent capable of automatically generating and applying fixes for detec

Gatekeeper is a Kubernetes admission control and policy enforcement engine used to ensure cluster resources comply with organizational security and configuration standards. It intercepts API requests to validate or reject non-compliant resources before they are persisted in the cluster. The project uses a parameterized policy library and custom resource definitions to create reusable templates and enforcement rules. It distinguishes itself through a hub-and-spoke management model, allowing a controller in a management cluster to enforce policies across separate target clusters. Beyond admiss

This project is a collection of curated and standardized Docker base images that serve as reliable starting points for building containerized applications. It functions as an OCI container image repository and a build template library, providing a central source of truth for images that adhere to Open Container Initiative standards for portability. The project utilizes an automated image lifecycle pipeline to build, tag, and push images, ensuring that dependencies remain current and security patches are applied. It specifically supports cross-platform distribution by providing a multi-archite

dockerlabs is a collection of educational labs and technical tutorials designed to teach the fundamentals of containerization and microservice architecture. It provides instructional material and hands-on exercises covering image optimization, security training, infrastructure setup, and cluster orchestration. The project features specific courses and guides focused on reducing image size through multi-stage builds, securing workloads via vulnerability scanning and encrypted networks, and deploying multi-node clusters with high availability using Swarm orchestration. The materials cover a br

LXC is an OS-level virtualization framework and Linux container manager used to run multiple isolated Linux systems on a single host. It functions as a kernel namespace orchestrator and unprivileged container runtime, allowing for the creation and management of system containers without the overhead of a hypervisor. The project provides unprivileged container execution by mapping container root users to unprivileged host users to prevent host system access. It ensures security through system call filtering and root user isolation, enabling containers to run without requiring host root privile

This project is a unified, cloud-native policy engine designed to decouple authorization and security logic from application codebases. It functions as a centralized authorization service that evaluates structured input data against declarative rules, enabling consistent policy enforcement across microservices, infrastructure, and continuous integration pipelines. The engine utilizes a specialized logic programming language to express complex constraints, which are compiled into an optimized intermediate representation for high-performance evaluation. By supporting both sidecar-based deployme

Terrascan is a static analysis tool designed to evaluate infrastructure-as-code configuration files for security vulnerabilities and compliance violations. By parsing these files into an intermediate representation, it identifies risks before cloud resources are provisioned, serving as a compliance auditor for cloud-native environments. The tool functions as a policy-as-code engine, allowing users to define and enforce custom security rules and industry benchmarks using a specialized query language. It distinguishes itself through its ability to integrate directly into development and deploym

Conftest is a suite of tools designed for validating structured configurations, testing policy logic, and generating policy documentation. It serves as a configuration file validator that checks YAML, JSON, and Helm charts for security violations and compliance issues using declarative rules. The project functions as an Open Policy Agent testing tool, allowing structured configuration files to be validated against custom policies written in Rego. It includes a policy-as-code testing framework to ensure policy logic is correct and a utility to extract metadata from Rego code to create static m

This project is a comprehensive collection of tutorials and guided laboratories designed to teach containerization, networking, and security using Docker. It serves as a learning path for building portable images and executing isolated processes. The materials provide specific guides for managing container clusters and scaling services through Docker Swarm and overlay networks. It includes a security handbook for implementing image scanning and secret management, as well as laboratories dedicated to modernizing legacy applications by wrapping older software installers into containers. The co

Cerbos is an open-source authorization service that provides a centralized, language-agnostic engine for managing access control. It functions as a policy-as-code platform, allowing teams to define, test, and distribute authorization rules using declarative YAML or JSON configurations. By decoupling access logic from application code, it enables consistent permission enforcement across diverse service stacks. The project distinguishes itself through its ability to translate high-level authorization policies into native database query filters. This capability allows applications to enforce sec

Nomad is a distributed workload orchestrator and infrastructure automation platform designed to manage the lifecycle of applications across large-scale, heterogeneous environments. It functions as a multi-cloud orchestration engine, providing a unified control plane to deploy, scale, and govern containers, virtual machines, and legacy applications. By utilizing declarative job specifications, the system ensures infrastructure convergence and maintains the desired state across distributed data centers and geographic regions. The platform distinguishes itself through a flexible, plugin-based ar

OpenShift Origin is a Kubernetes distribution platform that extends Kubernetes with integrated security, multi-tenancy, and application lifecycle management for enterprise container orchestration. It functions as a multi-tenant container orchestrator that enforces per-project security policies, resource quotas, and SELinux isolation for shared cluster environments. The platform includes a Source-to-Image builder that creates container images directly from application source code using Dockerfiles or buildpacks without external build servers, and an Operator Lifecycle Manager that installs and

This project is a service mesh platform designed to manage, secure, and observe service-to-service communication within Kubernetes clusters. It functions as a control plane that orchestrates transparent sidecar proxies, which intercept and manage network traffic to provide reliable connectivity for microservices. By automating the injection of these proxies, the platform ensures that infrastructure-level policies are applied consistently across all workloads without requiring manual configuration changes. The platform distinguishes itself through its focus on zero-trust security and cross-clu

Matrix is a suite of mobile application performance management and analysis tools. It provides a plugin-based monitoring system for capturing crashes, lags, and memory leaks, alongside a static binary auditor for reducing installation package size and a bytecode instrumentation tool for performance tracking. The project distinguishes itself through native memory debugging and a SQLite query linter that identifies inefficient database patterns. It employs native interception techniques to detect memory leaks and heap corruption without requiring source code recompilation, and uses a custom run

Yup is a JavaScript schema validation library used to define data shapes and validate runtime values. It functions as an object schema validator and a data coercion engine, allowing developers to transform raw input values into desired types before performing validation checks. The library is distinguished by its support for dynamic schema validation, where rules can be adjusted at runtime based on sibling field values or external context. It also enables recursive data structuring for polymorphic fields and provides a system for extracting static TypeScript interfaces from runtime schema def

This project is a collection of best practices and curated templates for building secure, stable, and production-ready Docker images. It provides standards for OCI image optimization and a guide for implementing industry-standard configurations in container environments. The repository offers specific patterns for security hardening, such as implementing non-root user execution with static IDs to prevent host privilege escalation. It also provides structural templates for multi-stage builds to separate build-time dependencies from the final runtime environment. Additional capabilities cover

Parsley.js is a JavaScript form validation library that provides a client-side data validator for verifying input correctness before submission. It functions as an HTML attribute-based validator, allowing constraints to be defined declaratively within HTML data attributes to enforce rules without requiring custom scripts. The framework distinguishes itself through a customizable validation system that supports user-defined rules and custom error message templates. It includes a remote validation interface to verify form values against server endpoints via asynchronous network requests and sup

GrowthBook is a feature flagging and experimentation platform that utilizes a warehouse-native approach to data analysis. It serves as a system for managing feature rollouts and conducting A/B tests by executing SQL queries directly against existing data warehouses to calculate experiment results. The platform is distinguished by its integration of a Model Context Protocol server, which allows AI coding assistants and IDEs to manage flags and query analytics using natural language. It also provides specialized capabilities for AI model optimization, enabling the testing of prompts and models

Kube-rs is a Rust client library and runtime for interacting with the Kubernetes API server. It provides a type-safe interface for managing cluster resources and state, including a toolkit for defining custom resource definitions and a framework for building admission webhooks to validate or mutate API requests. The project distinguishes itself through a dedicated controller runtime that implements event-driven reconciliation loops to align actual cluster state with desired configurations. It utilizes a streaming system to monitor resource changes and synchronize remote states into a local qu

Lychee is a command line link checker written in Rust that scans websites and local files to identify broken hyperlinks and invalid email addresses. It functions as an asynchronous link validator and static site auditor designed to ensure content accessibility and quality. The tool features disk-based response caching to accelerate subsequent scans and avoid redundant network requests. It supports token-based API authentication for services like GitHub to bypass rate limits when verifying links on remote repositories. The project covers a range of capabilities including multi-format content

crun is a low-level container runtime that implements the Open Container Initiative specification for managing the lifecycle of isolated processes. It provides the core mechanisms for container creation, execution, and deletion, ensuring compatibility across platforms through standardized lifecycle management. The project distinguishes itself by offering a shared C library that allows container runtime operations to be embedded directly into other compiled applications. It further extends execution capabilities through specialized handlers that enable the deployment of containers within isola

Guardrails is a Python SDK that wraps calls to large language models with configurable validation pipelines, corrective actions, and structured output generation. It provides a unified API layer that connects to over 100 language models, applying consistent validation, streaming, and error-handling across providers. The framework validates and corrects model responses against safety and quality rules, detecting and mitigating risks in both inputs and outputs using pre-built and custom validators. The project distinguishes itself through a validator-pipeline architecture that sequentially appl

This project is a business rules management system and rule engine designed to define, execute, and manage complex business logic decoupled from application source code. It provides a business logic compiler that transforms human-readable rule definitions into executable models for high-performance runtime evaluation. The system includes a complex event processing engine for analyzing real-time data streams to identify temporal patterns and a decision model and notation executor that processes structured logic based on industry standards for deterministic results. It utilizes an inference eng

ozzo-validation is a programmable data validation library for Go that verifies structs, maps, and primitive types using a declarative, rule-based approach. It functions as an interface-based validator, allowing for the recursive checking of nested data structures and custom types without the use of struct tags. The framework distinguishes itself as a context-aware validation engine, supporting the propagation of request-scoped data to rules that depend on external state. It provides extensive extensibility through custom rule definitions and the ability to override default failure text with l

This project is a security compliance tool and configuration auditor designed to evaluate Docker deployments against industry security benchmarks. It functions as a script-based scanner that identifies misconfigurations and vulnerabilities within both the host operating system and container settings. The tool specifically implements the Center for Internet Security standards for Docker to verify host and container configurations. It enables a hardening workflow by comparing system states against these standards to identify security gaps and document compliance status. The audit engine suppor

Terrascan is an infrastructure as code security scanner and cloud configuration auditor designed to detect security violations and compliance risks in cloud templates and Dockerfiles before provisioning. It utilizes the Open Policy Agent to evaluate infrastructure templates against both standard security policies and custom organizational rules. The project functions as a security guardrail within build pipelines, blocking risky deployments by integrating scanning logic directly into CI/CD workflows. It also includes a container registry vulnerability scanner that collects vulnerability data

Kiro is an AI-powered development tool and multi-agent workflow orchestrator. It functions as a context-aware code generator and coding assistant that transforms natural language requirements into structured implementation plans and production-grade code. The system distinguishes itself through multi-agent task decomposition, where complex requirements are broken into sequenced tasks and assigned to specialized agents. It features multi-model orchestration to select specific language models based on reasoning complexity, cost, and latency, and includes a headless command-line interface for id