27 ops tools this month across containers, IaC, observability, networking, backups, the homelab and cloud cost, about half of them the default pick and half of them recent arrivals. LocalStack's archive and MinIO's retirement shape two of the buckets.
📦 Containers & Orchestration
Harbor
The registry most teams end up running when they want access control on their images. Harbor adds project-level RBAC, replication between registries, vulnerability scanning and audit logs on top of the standard registry, and it installs from a Docker Compose bundle or a Helm chart. It is a multi-container service, not one binary, so budget an afternoon rather than a minute. Established pick; v2.16.0 is in release-candidate as of this week. Pricing: free, open source (Apache-2.0).
zot
Where Harbor is a service with a database and a job queue, zot is a registry you can start as a single Go binary with one config file. It speaks the OCI distribution spec natively and stores artifacts such as Helm charts and signatures next to images. Still shipping every few weeks (v2.1.23 on November 2), which makes it the lighter choice for edge sites and air-gapped labs. Pricing: free, open source (Apache-2.0).
Komodo
Docker hosts that nobody wants to turn into a Kubernetes cluster still need a way to build and deploy across them. Komodo gives you a web UI and API on a Core service, with a small Periphery agent on each server, and it has no cap on connected servers. Version 2 is the current line, with v2.3.4 out on October 23, and the repo now lives under the moghtech organisation. Pricing: free, open source (GPL-3.0).
Cozystack
A framework for people who want to run their own cloud on bare metal: it hands out Kubernetes clusters, VMs, databases and load balancers through an API. It sits on Kubernetes with the Talos and KubeVirt pieces in the repo topics, so this is a cluster project, not something you try on a laptop. A CNCF Sandbox project, and v1.7.0 landed on October 29. Pricing: free, open source (Apache-2.0).
🏗️ Infrastructure as Code
Terragrunt
A wrapper around OpenTofu and Terraform that keeps backend config and variables out of a hundred copy-pasted folders. One static binary, no agent, works with either engine. It reached 1.0 on March 30, 2026 with a written backwards-compatibility promise for the 1.x series, and v1.2.1 followed on October 23. Replaces nothing so much as a pile of shell scripts. Pricing: free, open source (MIT); Gruntwork sells a separate hosted product, Terragrunt Scale, with a free tier for GitHub and AWS users.
Atlantis
Run terraform plan by commenting on a pull request, and see the output in the same thread. Atlantis is one Go service that listens for webhooks from your Git host, so it needs somewhere to run (the repo ships a Dockerfile and Kustomize files) and credentials for your cloud. The long-standing answer to "who applied that?", with v0.49.0 out on October 26. Pricing: free, open source (Apache-2.0).
Argo CD
Argo CD watches a Git repo and makes a Kubernetes cluster match it, showing the drift in a web UI when it does not. It runs inside a cluster (there is a Helm chart) and is the default GitOps controller for a lot of teams, with Flux as the quieter alternative. The v3 line is current, v3.6.1 on November 4. Pricing: free, open source (Apache-2.0).
Semaphore UI
Ansible has no front end of its own, and Semaphore is the small one people pick before reaching for AWX. It runs Ansible, OpenTofu/Terraform and plain scripts from a web UI with run history and failure notifications, and you can install it from Docker, a package or a binary. Agentless in the Ansible sense: it shells out over SSH. A release goes out nearly every week. Pricing: free, open source (MIT); the repo also contains a paid Pro edition.
📈 Observability & Logging
Grafana
Dashboards and alert rules over Prometheus, Loki, Elasticsearch, Postgres and a long list of other data sources, mixed on one panel if you like. One server process with a bundled database, docker run grafana/grafana for a trial. Version 13.3 came out October 27. Established, and worth knowing that the licence has been AGPL since 2021. Pricing: free, open source (AGPL-3.0); Grafana Cloud is the paid hosted version.
Vector
A Rust pipeline that collects logs and metrics, reshapes them and sends them on, run either as an agent on each host or as a central aggregator. Written and maintained by Datadog but vendor-neutral in what it sends to. Metrics support is still marked beta in the README. Choose it when your log shipper config has become a pile of regexes. Pricing: free, open source (MPL-2.0).
Beszel
A hub-and-agent monitor for the small fleet: CPU, memory, disk I/O, temperatures, GPU, S.M.A.R.T. health and per-container Docker or Podman stats, with alerts. The hub is a PocketBase web app and an agent runs on each machine, both as Docker images. Much less to run than Prometheus plus Grafana, which is the point. v0.21.1 shipped October 22. Pricing: free, open source (MIT).
Perses
Dashboards as code from the start: you write them in CUE or Go, validate them in CI and, on Kubernetes, apply them as custom resources through the Perses Operator. It reads Prometheus, Tempo, Loki and Pyroscope. A CNCF Sandbox project, so expect change between releases (0.55.1 on November 2). One binary or the persesdev/perses image. Pricing: free, open source (Apache-2.0).
🌐 Networking & Access
Traefik
Point it at Docker, Kubernetes, ECS or a plain file and it builds its own routes, then fetches Let's Encrypt certificates without a restart. One binary or one container, no agent. Established for container hosts; v3.7.17 is the stable patch and v3.8 is in release-candidate. Pricing: free, open source (MIT); the company sells a paid gateway and hub on top.
Technitium DNS Server
An authoritative and recursive DNS server with a web console, which also blocks ads and runs DHCP if you want it. It speaks DNS over TLS, HTTPS and QUIC, can manage two or more instances from one console, and handles DNSSEC. It runs on .NET 10 as a portable app, an installer or a Docker image, one process and no agent. v15.6.2 came out October 17. Pricing: free, open source (GPL-3.0).
cloudflared
The tunnel client for Cloudflare Tunnel: a small daemon on your side opens the connection outward, so you do not forward a port or poke a firewall hole. Install by apt, Homebrew, a binary or a container. The catch is that it requires a domain on Cloudflare, so pair it with Pangolin or Headscale if you want to avoid that. Versioned by date, 2026.10.7 on October 30. Pricing: client is free, open source (Apache-2.0); tunnels run on Cloudflare's service, which has a free tier.
💾 Backups & Storage
BorgBackup
Deduplicating, client-side encrypted backups to a plain SSH target, shipped as a single-file binary for Linux, macOS and FreeBSD. Use the stable 1.x line for anything real: the README says in capitals not to use Borg 2, which is still in beta (2.0.0b25 on September 28) with no upgrade path between betas. Run a restore test, because dedup repositories hide corruption well. Pricing: free, open source (BSD-3-Clause).
Garage
An S3-compatible object store built to run across a few cheap machines in different places, replicating each chunk to three zones. One dependency-free binary per node, with a stated floor of 1 GB of RAM, so it suits a homelab or a small co-op. Garage 2.5.0 shipped October 24. A lighter pick than Ceph after MinIO's community edition was retired. Pricing: free, open source (AGPL-3.0).
SeaweedFS
Master, volume servers and a filer give you S3, WebDAV, SFTP and FUSE over the same blobs, and it is built for very large file counts. Starting is easy because weed mini runs all of it in one process; production splits the pieces across machines. Version 4.52 came out November 2. Pricing: free, open source (Apache-2.0).
RustFS
A Rust S3 server pitched as the MinIO replacement for people who liked how simple that was: docker run with a data directory and you have a console on port 9001. It reached 1.0 on September 16, 2026. Two warnings from its own README: change the default rustfsadmin credentials, and a single-drive node cannot be expanded in place. Iceberg tables and MinIO on-disk compatibility are still preview. Pricing: free, open source (Apache-2.0).
🏠 Self-Hosted & Homelab
Jellyfin
The media server with no account and no premium tier, forked from Emby 3.5.2 and now a .NET 10 app. Install from a package, Docker image or Windows installer; ffmpeg does the transcoding. This repo is the server only and the web client lives separately. Version 12.4 shipped October 26. Pricing: free, open source (GPL-2.0).
Paperless-ngx
Scan or email a letter in and it comes out as searchable text with tags, correspondents and a web interface. Docker Compose is the easy path and the repo's install script sets one up. The community-run successor to Paperless-ng, now on its v3 line (v3.4.2 on November 3). Back up its data directory and database, since the originals are probably in a shredder. Pricing: free, open source (GPL-3.0).
Coolify
Heroku-style deploys onto your own VPS, bare metal or Raspberry Pi: connect Git, and it builds with Nixpacks or Dockerfiles, handles HTTPS and offers 360+ one-click services. One curl | bash installs it, and target servers need only SSH. Read the script first. v4.6.0 landed November 2. Pricing: free self-hosted, open source (Apache-2.0); Coolify Cloud is the paid managed option.
Homepage
A start page for everything on your network, with 100+ integrations that show live numbers from Jellyfin, the *arr apps and others. Config is YAML or Docker labels, and the API keys stay on the server side. Put it behind a login if it is reachable from outside. One container, ghcr.io/gethomepage/homepage. Pricing: free, open source (GPL-3.0).
☁️ Cloud Platforms & Cost
Floci
LocalStack's community repository was archived on March 23, 2026, and its image now wants an auth token, so Floci is one of the free replacements. Run docker run floci/floci or a standalone binary, and point the AWS CLI, Terraform, OpenTofu or CDK at port 4566. Lambda, RDS and ECS use real containers through the Docker socket. v2.4.0 shipped October 31. Pricing: free, open source (MIT).
MiniStack
Another LocalStack successor, with 60+ services on port 4566 and a small footprint (about 30 MB of idle RAM by its own numbers). Start it with pip install ministack or one docker run. RDS and ElastiCache run real Postgres, MySQL and Redis containers. Younger than moto, so expect rough edges in less-travelled APIs. Pricing: free, open source (MIT).
Steampipe
Ask your cloud accounts questions in SQL: plugins turn AWS, GCP, GitHub and other services into more than 2,000 tables you query live, with no separate database to load. Install with Homebrew or the install script, and nothing runs on the targets. Good for inventory and one-off audits. The repo is AGPL but the packaged binaries come under Turbot's terms. Pricing: free, open source (AGPL-3.0).
Cloud Custodian
Write YAML policies to find and fix cloud resources, such as stopping untagged instances or deleting unattached volumes, across AWS, Azure and GCP. pip install c7n, always custodian run --dryrun first. Policies can run on a cron or deploy as a Lambda that reacts to events. A CNCF Incubating project with 0.9.53.0 out October 1. Pricing: free, open source (Apache-2.0).