Tag: ci-cd

Self-hosted GitHub Actions, Forgejo, and GitLab runners can hand a forked pull request root on your box. Here is the isolation ladder that actually stops it.

Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.

regctl, regbot, and regsync give you tag retention policies, registry replication, and manifest surgery, no Docker daemon required.

ArgoCD ApplicationSets let one template generate dozens of GitOps Applications across clusters. Covers List, Cluster, Git, Matrix, and PR generators with real patterns.

Build Docker images that run on amd64 and arm64 from one command. QEMU emulation, native multi-node builders, CI caching, and manifest lists explained.

OPA and Rego aren't just Kubernetes gatekeepers. Block :latest tags in CI, enforce Terraform resource tags, and filter HTTP APIs.

Run GitHub Actions-style CI on your own Forgejo server with Forgejo Runner. Same YAML, your hardware, zero GitHub dependency.

Skopeo lets you copy, inspect, and sync container images between any registry without Docker. No daemon, no bloat, just clean image ops.

Two years after HashiCorp's BUSL switch and IBM's acquisition, OpenTofu is the mature open-source Terraform fork. Here's the honest state of play.

Keyless signed git commits with Sigstore and Gitsign, no GPG key rot, no passphrase prompts. OIDC-backed ephemeral certs that just work.

Renovate vs Dependabot for self-hosted teams: config depth, ecosystem coverage, self-host paths, and which bot wins for Forgejo/GitLab shops.

Gitea Actions vs Woodpecker CI: two solid self-hosted CI options, one clear winner for your setup. Compare syntax, runners, footprint, and secrets handling.