The IT & Cloud Infrastructure Stack, Organized
Modern software runs on layers of infrastructure that did not exist a generation ago. Where companies once racked their own servers, today they assemble applications from public-cloud compute, container orchestrators, edge networks, distributed storage, and a deep observability stack — often spanning several vendors and multiple data centers at once. InfrastructureDirectory is a curated, vendor-neutral catalog of the platforms and tools that make up that stack, from the hyperscale clouds at the bottom to the GitOps and monitoring layers at the top. Every listing links directly to the official source so you can evaluate each option yourself.
At the foundation sit the public clouds. Amazon Web Services, Microsoft Azure, and Google Cloud Platform together account for the majority of the global cloud market, each offering hundreds of managed services for compute, storage, networking, and databases. Developer-focused providers such as DigitalOcean trade breadth for simplicity and predictable pricing, while colocation and interconnection giants like Equinix provide the physical data-center floor space and private cloud on-ramps that hybrid architectures depend on. Choosing among them is rarely about raw features alone — it comes down to geography, compliance, existing ecosystem investments, and how predictable your costs need to be.
Above the raw infrastructure lives the container and orchestration layer. Docker standardized how applications are packaged, and Kubernetes became the near-universal control plane for running those containers at scale, with simpler alternatives such as HashiCorp Nomad and security-focused engines like Podman serving teams whose needs differ. Deploying to those clusters is increasingly handled through infrastructure as code — Terraform and its open-source fork OpenTofu, Pulumi for those who prefer real programming languages, and the configuration-management veterans Ansible, Chef, and Puppet — together with GitOps tools like Argo CD that treat a Git repository as the single source of truth for cluster state.
Connecting and securing all of this is the job of the networking, CDN, and service-mesh categories. Cloudflare, Fastly, and Akamai push content and compute to the network edge across hundreds of locations, NGINX fronts a large share of the world's web traffic, and service meshes such as Istio, Cilium, and Consul handle encrypted service-to-service communication, traffic routing, and policy inside Kubernetes. Sensitive credentials are kept out of source code by secrets-management tools like HashiCorp Vault, while distributed stores such as etcd and S3-compatible object storage like MinIO hold the state that everything else relies on.
Finally, none of this can be operated blind, which is why monitoring and observability spans so many entries here. Prometheus and Grafana form the open-source backbone for metrics and dashboards, the Elastic stack powers log search, OpenTelemetry has emerged as the vendor-neutral standard for instrumentation, and SaaS platforms such as Datadog and New Relic unify metrics, logs, and traces for teams that prefer a managed approach. Use the category filters and search below to explore each layer of the stack, compare the leading options side by side, and shortlist the infrastructure that fits your architecture, budget, and scale. Listings are independently curated and link straight to the official source, so you can verify the details and pricing yourself before committing to any platform.
The de facto container orchestration platform — automate deployment, scaling, and management of containerized apps.
Originally built at Google from lessons learned running Borg, Kubernetes was open-sourced in 2014 and now sits at the center of the Cloud Native Computing Foundation as its flagship graduated project. It schedules containers across clusters of machines, handles self-healing through automatic restarts and rescheduling, performs rolling updates and rollbacks, and exposes a declarative API where you describe desired state in YAML. Every major cloud offers a managed distribution — EKS, GKE, and AKS — making Kubernetes the common substrate for modern platform engineering.
Orchestration
⭐ 122,542 stars
container-orchestration cncf open-source leader
Open-source observability platform — beautiful dashboards for metrics, logs, and traces from any data source.
Grafana, created by Torkel Ödegaard in 2014 and developed by Grafana Labs, is the most widely deployed open-source dashboarding and visualization tool in the observability space. It connects to dozens of data sources — Prometheus, Loki, Tempo, InfluxDB, Elasticsearch, PostgreSQL, and cloud monitoring APIs — and unifies metrics, logs, and traces in a single pane of glass. The broader Grafana stack adds Loki for logs, Tempo for distributed tracing, and Mimir for long-term metric storage, with a managed Grafana Cloud offering for teams that prefer not to self-host.
Monitoring
⭐ 74,045 stars
dashboards observability open-source visualization
Container platform that started the revolution — build, ship, and run containers with Docker Engine and Docker Compose.
Docker popularized Linux containers when it launched in 2013, giving developers a simple, repeatable way to package an application and its dependencies into a portable image. Docker Engine builds and runs those images, Docker Compose defines multi-container local environments in a single file, and Docker Hub hosts millions of public and private images. While Kubernetes dropped the Docker runtime in favor of containerd, the Docker image format — standardized through the Open Container Initiative — remains the universal currency of the container ecosystem and the default starting point for most engineering teams.
Orchestration
⭐ 71,603 stars
containers open-source developer compose
Agentless configuration management and orchestration — automate provisioning, deployment, and OS configuration with YAML playbooks.
Ansible, created by Michael DeHaan in 2012 and acquired by Red Hat in 2015, automates configuration management, application deployment, and orchestration without requiring any agent on managed hosts — it connects over SSH and runs idempotent tasks defined in human-readable YAML playbooks. Its low barrier to entry made it the most approachable tool in the configuration-management category, and Ansible Galaxy hosts thousands of reusable roles and collections. Red Hat's Ansible Automation Platform layers in a control plane, role-based access, and an execution environment for enterprise-scale automation.
IaC
⭐ 68,717 stars
configuration-management agentless yaml redhat
CNCF's open-source metrics monitoring system — time-series database with PromQL query language and Alertmanager.
Prometheus began at SoundCloud in 2012 and became the second project to graduate from the Cloud Native Computing Foundation after Kubernetes. It is a pull-based metrics system: it scrapes time-series data from instrumented targets over HTTP, stores it in an efficient local time-series database, and lets engineers slice that data with the powerful PromQL query language. Its bundled Alertmanager handles deduplication, grouping, and routing of alerts to PagerDuty, Slack, email, and other receivers. The Prometheus exposition format has effectively become the industry standard for application metrics.
Monitoring
⭐ 64,204 stars
metrics cncf open-source alerting
The most widely used IaC tool — declare infrastructure in HCL, provision and manage resources across all major clouds.
Terraform, released by HashiCorp in 2014, is the dominant infrastructure-as-code tool for provisioning cloud and on-premises resources. Engineers declare desired infrastructure in HashiCorp Configuration Language (HCL), and Terraform builds a dependency graph, computes an execution plan, and applies changes through provider plugins for AWS, Azure, Google Cloud, and thousands of other services in the Terraform Registry. Its state file tracks real-world resources so changes are incremental and predictable. After HashiCorp moved Terraform to the Business Source License in 2023, the community forked it as OpenTofu under the Linux Foundation.
IaC
⭐ 48,479 stars
iac hashicorp multi-cloud declarative
HashiCorp Vault — centralized secrets management, dynamic credentials, data encryption, and PKI as a service.
HashiCorp Vault, introduced in 2015, centralizes the storage, access control, and auditing of secrets — API keys, database passwords, certificates, and encryption keys. Beyond static secret storage, Vault generates dynamic, short-lived credentials on demand for databases and cloud providers, acts as a private certificate authority for PKI, and offers encryption-as-a-service so applications never hold their own keys. Authentication integrates with Kubernetes, LDAP, cloud IAM, and OIDC, and every access is logged for compliance. It remains the reference implementation for secrets management in zero-trust and dynamic infrastructure environments.
Secrets Management
⭐ 35,690 stars
secrets hashicorp encryption pki
Daemonless, rootless container engine — Docker-compatible CLI with enhanced security, from Red Hat.
Podman is Red Hat's daemonless alternative to Docker, designed around a security-first architecture. Because there is no long-running root daemon, containers can run fully rootless under an unprivileged user, shrinking the attack surface that has historically concerned security teams. Its command-line interface is intentionally Docker-compatible, so most workflows translate by simply aliasing docker to podman. Podman also introduced the concept of pods — groups of containers that share resources, mirroring the Kubernetes primitive — and its companion tools Buildah and Skopeo handle image building and registry operations without a daemon.
Orchestration
⭐ 31,841 stars
containers daemonless rootless redhat
IaC using real programming languages — write infrastructure in Python, TypeScript, or Go instead of DSL.
Pulumi, founded in 2017, takes a different approach to infrastructure as code: instead of a domain-specific language, you define cloud resources using general-purpose programming languages such as TypeScript, Python, Go, C#, and Java. That lets engineers use familiar loops, functions, classes, package managers, and testing frameworks to express infrastructure, which is especially appealing to developer-centric platform teams. Pulumi supports the same major clouds and Kubernetes as Terraform, manages state through a hosted or self-managed backend, and includes Pulumi ESC for centralized secrets and environment configuration.
IaC
⭐ 25,245 stars
iac python typescript go
eBPF-based networking and security for Kubernetes — high-performance network policy, service mesh, and observability.
Cilium, created by Isovalent and now a graduated CNCF project, brings eBPF — a technology that runs sandboxed programs directly in the Linux kernel — to Kubernetes networking, security, and observability. By operating in the kernel rather than relying on iptables, Cilium delivers high-performance load balancing, identity-aware network policy, and transparent encryption with minimal overhead. Its Hubble component provides deep, service-level visibility into network flows, and Cilium Service Mesh offers a sidecar-free alternative to traditional mesh architectures. Cisco acquired Isovalent in 2024, reinforcing eBPF's place in cloud-native networking.
Service Mesh
⭐ 24,421 stars
ebpf kubernetes networking cncf
HashiCorp's workload orchestrator — simpler than Kubernetes, supports containers, VMs, and standalone binaries.
Nomad is HashiCorp's workload orchestrator, positioned as a simpler, single-binary alternative to Kubernetes. Beyond Docker containers it can schedule virtual machines, standalone executables, Java applications, and batch jobs, making it attractive for organizations with mixed or legacy workloads that do not fit neatly into a container-only model. Nomad integrates tightly with Consul for service discovery and Vault for secrets, scales to thousands of nodes, and uses the same declarative HCL configuration as the rest of the HashiCorp suite. Its operational simplicity appeals to teams that find full Kubernetes overhead excessive.
Orchestration
⭐ 16,532 stars
orchestration hashicorp simple multi-workload
Configuration management platform — automate infrastructure and application deployment with Ruby-based cookbooks.
Chef, first released in 2009, is one of the original configuration-management platforms and helped define the infrastructure-as-code movement. It models system state as code through Ruby-based recipes and cookbooks, applying a desired-state convergence model so that managed nodes continuously reconcile toward the declared configuration. Chef Infra handles server configuration, Chef InSpec adds compliance-as-code auditing, and Chef Habitat packages applications for portable deployment. Now part of Progress Software, Chef remains common in large regulated enterprises that adopted it early and value its mature, agent-based approach to fleet management at scale.
IaC
configuration-management ruby enterprise
HashiCorp Consul — service discovery, health checking, and service mesh for multi-cloud and hybrid environments.
Consul, released by HashiCorp in 2014, provides service discovery, health checking, a distributed key-value store, and a full service mesh for connecting and securing services across clouds and runtime platforms. Services register with Consul and discover one another through DNS or HTTP, while built-in health checks route traffic away from failing instances. Consul Connect adds mutual-TLS service-to-service encryption and intention-based authorization, and its sidecar-based mesh works across Kubernetes, virtual machines, and bare metal alike. That platform-agnostic reach makes it a common choice for hybrid and multi-runtime environments where workloads are not all containerized.
Service Mesh
service-discovery hashicorp service-mesh open-source
Full-stack observability SaaS — metrics, logs, APM, synthetic monitoring, and security in one integrated platform.
Datadog, founded in 2010 and publicly traded on NASDAQ, is a leading SaaS observability platform that unifies infrastructure metrics, log management, application performance monitoring, real-user monitoring, synthetic tests, and cloud security in one product. A single lightweight agent installs across hosts, containers, and serverless functions, and the platform ships hundreds of turnkey integrations for popular databases, message queues, and cloud services. Its correlated dashboards and alerting let teams pivot from a metric spike to the underlying traces and logs in seconds, which has made it a default monitoring choice for cloud-native enterprises.
Monitoring
apm monitoring enterprise saas
Full-stack observability platform — instrument everything from browser to backend with one agent.
New Relic, founded in 2008, was an early pioneer of application performance monitoring and has since grown into a full-stack observability platform. All telemetry — metrics, events, logs, and traces — flows into a single unified database queryable with NRQL, its SQL-like query language. The platform spans APM, infrastructure monitoring, browser and mobile real-user monitoring, synthetics, and error tracking. In 2020 New Relic moved to a consumption-based pricing model with a generous free tier, lowering the barrier for smaller teams while continuing to serve large enterprises with high-volume, full-stack observability needs.
Monitoring
apm monitoring enterprise saas
Enterprise configuration management — enforce desired state on servers at scale with Puppet's declarative DSL.
Puppet, created by Luke Kanies in 2005, is one of the oldest and most established configuration-management tools and was instrumental in shaping infrastructure as code. It uses a declarative, model-driven language to describe the desired state of systems, and a Puppet agent on each node periodically pulls its catalog from a central server and converges the machine toward that state. Puppet excels at enforcing consistent configuration across large, long-lived server fleets and is widely used in regulated enterprises. Now part of Perforce, it remains a mature option for organizations standardizing thousands of nodes.
IaC
configuration-management enterprise ruby-dsl
The largest public cloud provider — compute, storage, networking, databases, and hundreds of managed infrastructure services.
Amazon Web Services launched in 2006 and is the largest public cloud provider by market share, offering more than two hundred services across compute, storage, networking, databases, analytics, and machine learning. Foundational services include EC2 for virtual machines, S3 for object storage, VPC for software-defined networking, and EKS for managed Kubernetes. AWS operates dozens of geographic regions, each with multiple isolated availability zones, giving customers global reach and fault isolation. Its pay-as-you-go model and deep service catalog made it the default infrastructure platform for startups and enterprises alike.
Cloud
public-cloud iaas ec2 s3
Microsoft's enterprise public cloud — IaaS and PaaS with deep integration into Windows, Active Directory, and Microsoft 365.
Microsoft Azure, launched in 2010, is the second-largest public cloud and the platform of choice for organizations invested in the Microsoft ecosystem. It offers virtual machines, Azure Kubernetes Service, Blob Storage, and a broad portfolio of managed databases and AI services, with especially strong hybrid-cloud capabilities through Azure Arc and Azure Stack. Tight integration with Active Directory, Windows Server, and Microsoft 365 lets enterprises extend existing identity and licensing investments into the cloud. Azure operates more announced regions than any other provider, supporting strict data-residency and government-compliance requirements worldwide.
Cloud
public-cloud microsoft iaas paas
Google's public cloud — compute, BigQuery analytics, and the origin of Kubernetes, with strong data and AI tooling.
Google Cloud Platform builds on the same global infrastructure that powers Search, Gmail, and YouTube, and is widely regarded as the third major public cloud. It offers Compute Engine virtual machines, Google Kubernetes Engine — notable because Google originated Kubernetes — Cloud Storage, and the serverless BigQuery data warehouse that helped define cloud analytics. GCP is particularly strong in data, machine learning through Vertex AI, and high-performance networking over Google's private global backbone. Its live-migration of VMs and per-second billing have long differentiated it from competitors in the infrastructure market.
Cloud
public-cloud google kubernetes bigquery
Global edge network — CDN, DDoS protection, DNS, and serverless Workers running across 300+ cities.
Cloudflare, founded in 2009, operates one of the world's largest edge networks, with data centers in over three hundred cities serving content close to end users. It began as a content delivery network and DDoS-mitigation service and has expanded into a broad infrastructure platform: authoritative and recursive DNS, a web application firewall, zero-trust access, and Cloudflare Workers — a serverless runtime that executes code at the edge in milliseconds. R2 object storage, D1 databases, and the Durable Objects coordination layer let developers build full applications entirely on Cloudflare's network without managing origin servers.
Networking & CDN
cdn edge ddos dns
Edge cloud platform — programmable CDN with instant cache purging and edge compute via WebAssembly.
Fastly, founded in 2011, is an edge cloud platform built for performance-sensitive applications that need real-time control over caching. Its key differentiators are instant, sub-second cache purging across the entire network and a highly configurable edge powered by the Varnish-derived VCL configuration language. Fastly Compute extends the edge with serverless functions compiled to WebAssembly for fast, secure execution close to users. The platform also offers a web application firewall, image optimization, and TLS management, and is relied on by major media, commerce, and streaming companies that demand low latency at global scale.
Networking & CDN
cdn edge compute wasm
Pioneer of the CDN — massive distributed edge network for content delivery, security, and cloud compute.
Akamai, founded in 1998 out of MIT research, effectively invented the commercial content delivery network and still operates one of the most geographically distributed edge platforms, with hundreds of thousands of servers across thousands of locations. It carries a large share of the world's web traffic and is trusted for high-stakes live events, software distribution, and large media catalogs. Beyond delivery, Akamai offers enterprise web application and API protection, bot management, and zero-trust security. Its 2022 acquisition of Linode added IaaS cloud computing, repositioning Akamai as a distributed cloud and edge infrastructure provider.
Networking & CDN
cdn edge security enterprise
Global colocation and interconnection leader — data centers and direct cloud on-ramps across 70+ metros.
Equinix is the world's largest data-center and interconnection company, operating International Business Exchange (IBX) facilities in more than seventy metropolitan markets. Enterprises and service providers colocate equipment in Equinix sites to sit physically close to networks, clouds, and partners, and Equinix Fabric provides software-defined private interconnection and direct on-ramps to AWS, Azure, Google Cloud, and Oracle. Equinix Metal offered automated bare-metal provisioning for infrastructure that needs dedicated hardware with cloud-like agility. As a neutral meeting point for thousands of networks, Equinix is core plumbing for hybrid and multi-cloud architectures.
Data Center
colocation data-center interconnection enterprise
Developer-friendly cloud — simple virtual servers (Droplets), managed Kubernetes, and predictable flat pricing.
DigitalOcean, founded in 2011 and publicly traded, built its reputation on simplicity and predictable pricing for developers and small-to-midsize businesses. Its core product, the Droplet, is a straightforward virtual machine that can be provisioned in seconds, and the platform has grown to include managed Kubernetes (DOKS), managed databases, Spaces object storage, and an App Platform for deploying code directly from a repository. Flat monthly pricing and extensive, beginner-friendly tutorials lowered the barrier to cloud infrastructure for independent developers. Its 2022 acquisition of Cloudways expanded its reach into managed application hosting.
Cloud
cloud developer droplets kubernetes
High-performance, S3-compatible object storage — self-hosted storage for private clouds and on-prem data lakes.
MinIO is a high-performance, S3-compatible object storage system designed to run anywhere — on bare metal, in containers, or on Kubernetes. Because it implements the Amazon S3 API faithfully, applications written for S3 can use MinIO without modification, making it a popular choice for private clouds, edge deployments, and AI/ML data lakes that need fast, local object storage. It supports erasure coding for data durability, bucket replication, encryption, and identity-based access control. MinIO's lightweight single-binary design and strong throughput have made it a default for self-hosted, cloud-portable storage.
Storage
⭐ 49,000 stars
object-storage s3-compatible open-source kubernetes
The most widely adopted service mesh — traffic management, mutual TLS, and observability for Kubernetes.
Istio, launched in 2017 by Google, IBM, and Lyft and now a graduated CNCF project, is the most widely adopted service mesh for Kubernetes. It deploys Envoy proxies alongside services to control traffic routing, enforce mutual-TLS encryption, apply fine-grained authorization policies, and generate detailed telemetry without changing application code. Istio enables progressive delivery patterns such as canary releases, traffic mirroring, and fault injection, and its newer ambient mode reduces overhead by removing per-pod sidecars. For organizations standardizing on Kubernetes, Istio provides the connectivity, security, and observability layer that ties microservices together.
Service Mesh
⭐ 36,500 stars
service-mesh kubernetes cncf envoy
Declarative GitOps continuous delivery for Kubernetes — sync cluster state directly from Git repositories.
Argo CD is a declarative, GitOps continuous-delivery tool for Kubernetes and a graduated CNCF project under the broader Argo umbrella. It treats a Git repository as the single source of truth for cluster state: Argo CD continuously compares the live state of a cluster against the manifests in Git and either reports drift or automatically reconciles it. Engineers get a clear web UI and CLI showing the sync status and health of every application, plus support for Helm, Kustomize, and plain YAML. Its audit-friendly, pull-based model made GitOps the dominant Kubernetes deployment pattern.
Orchestration
⭐ 18,900 stars
gitops kubernetes cncf continuous-delivery
Distributed, reliable key-value store — the consistent backing store for Kubernetes cluster state.
etcd is a strongly consistent, distributed key-value store and a graduated CNCF project best known as the backing data store for Kubernetes — it holds the entire cluster's configuration and state. Created by CoreOS, etcd uses the Raft consensus algorithm to replicate data across a cluster of nodes and guarantee consistency even when machines fail, making it suitable for storing the most critical coordination data in a distributed system. Beyond Kubernetes it is used for service discovery, distributed locking, and leader election. Its reliability under partition and failure is why so much cloud-native infrastructure depends on it.
Storage
⭐ 48,700 stars
key-value distributed cncf raft
Search and observability platform — Elasticsearch, Logstash, and Kibana for logs, metrics, and full-text search.
Elastic, the company behind Elasticsearch, builds the search and analytics engine at the heart of the popular ELK Stack — Elasticsearch for indexing and querying, Logstash for ingestion, and Kibana for visualization. First released in 2010, Elasticsearch is a distributed, document-oriented search engine that scales horizontally and is widely used for centralized log management, full-text search, and security analytics (SIEM). The Elastic Observability and Security solutions layer APM, infrastructure monitoring, and threat detection on top of the same data store. After a 2021 license change, the community fork OpenSearch emerged under the OpenSearch Software Foundation.
Monitoring
⭐ 71,200 stars
logs search elasticsearch kibana
Open-source, community-driven fork of Terraform — drop-in IaC under the Linux Foundation.
OpenTofu is an open-source infrastructure-as-code tool created in 2023 as a community fork of Terraform after HashiCorp relicensed Terraform under the Business Source License. Hosted by the Linux Foundation and backed by companies including Gruntwork, Spacelift, and Harness, OpenTofu aims to remain a truly open, MPL-licensed alternative. It is designed as a drop-in replacement that reads the same HCL configuration and uses the same provider and module ecosystem, so most existing Terraform projects migrate with minimal changes. OpenTofu has since added features such as state encryption that extend beyond its Terraform origins.
IaC
⭐ 25,800 stars
iac open-source terraform-fork linux-foundation
High-performance web server, reverse proxy, and load balancer powering a large share of the world's busiest sites.
NGINX, created by Igor Sysoev and first released in 2004, is a high-performance web server, reverse proxy, load balancer, and HTTP cache that powers a large share of the world's busiest websites. Its event-driven, asynchronous architecture handles tens of thousands of concurrent connections with low memory use, which made it the standard for serving static content and fronting application servers. In cloud-native environments the NGINX Ingress Controller is one of the most common ways to route external traffic into Kubernetes clusters. Now owned by F5, NGINX remains a foundational building block of modern web infrastructure.
Networking & CDN
⭐ 26,500 stars
web-server reverse-proxy load-balancer ingress
Vendor-neutral observability framework — open standard for collecting metrics, logs, and traces.
OpenTelemetry, formed in 2019 by merging the OpenTracing and OpenCensus projects, is a CNCF effort to provide a single, vendor-neutral standard for generating and collecting telemetry — traces, metrics, and logs. It defines consistent APIs, SDKs across major programming languages, and the OpenTelemetry Collector, a pipeline component that receives, processes, and exports telemetry to virtually any backend such as Prometheus, Jaeger, Grafana, or commercial platforms. By decoupling instrumentation from any specific vendor, OpenTelemetry lets organizations avoid lock-in and switch observability tools without re-instrumenting code. It has rapidly become the de facto standard for application instrumentation.
Monitoring
⭐ 5,100 stars
observability tracing cncf open-standard