Every European DevOps & infrastructure as code tool reviewed
Distributed
Founded 2023
Free and open source
Free
Best for: Any team that wants infrastructure-as-code without single-vendor licence risk
OpenTofu exists because a licence changed under code that describes production, and it is the answer to that happening again. When HashiCorp moved Terraform to the Business Source Licence, the community forked it; OpenTofu is now a Linux Foundation project under MPL 2.0, governed by many companies rather than owned by one. That is the substantive difference — not the licence text but the fact that no single participant can change it, because no single participant owns it.
Practically, OpenTofu is a drop-in replacement for Terraform 1.5+ using the same HCL, so migrating is changing the binary rather than rewriting an estate.
It has also shipped capabilities HashiCorp has not: state encryption, which matters because Terraform state contains secrets in plain text by default, and for_each on providers.
There is no telemetry, and it runs wherever you run it with no vendor processing anything. Free and open source. The friction that remains is ecosystem gravity — the module and provider ecosystem still orbits the HashiCorp registry, and some commercial tooling has been slow to certify OpenTofu — and it is an engine rather than an execution platform, so orchestration is a separate choice.
What OpenTofu does well
- Drop-in replacement for Terraform 1.5+
- MPL 2.0 under Linux Foundation governance, cannot be relicensed by one vendor
- State encryption built in, which Terraform lacks
- No telemetry and no vendor in the path
- Free and open source
Where OpenTofu falls short
- Ecosystem still gravitates to the HashiCorp registry
- Some commercial tooling slower to certify it
- Engine only — no execution platform included
- Vendor-neutral rather than European per se
Standout feature. Governance nobody can revoke: OpenTofu is the only infrastructure-as-code engine here where the licence is held by a foundation rather than by a company that can change its mind.
Warsaw, Poland
Founded 2020
Free tier / Cloud from about $400/month / Self-Hosted on request
Free tier
Best for: Platform teams managing many stacks who need policy, approvals and drift detection
Spacelift is the most capable orchestration platform in this category, and policy as code is what separates it from a CI pipeline running terraform apply.
Open Policy Agent policies actually enforce: a plan that violates a rule is blocked rather than flagged, approval flows gate what reaches production, drift detection catches the changes someone made in the console at 2am, and stack dependencies mean applying in the right order is the platform's problem rather than a runbook. It orchestrates OpenTofu, Terraform, Pulumi, CloudFormation and Ansible, which matters in the many organisations that never standardised on one.
Spacelift's engineering and operations are in Warsaw with an EU region available, though Spacelift Inc. is a US-registered entity — a distinction worth knowing if the requirement is an EU contracting party rather than EU data residency.
The feature that answers the credential question is self-hosted worker pools: the control plane is SaaS while the workers run inside your own VPC, so cloud credentials never leave your infrastructure. A Self-Hosted edition goes further. Pricing starts free and reaches about $400 per month for Cloud, which is real money for a small team, and the policy and dependency model has a genuine learning curve.
What Spacelift does well
- Orchestrates OpenTofu, Terraform, Pulumi, CloudFormation and Ansible
- OPA policy as code that actually blocks non-compliant plans
- Self-hosted workers keep cloud credentials in your own VPC
- Stack dependencies and drift detection
- European engineering with an EU region available
Where Spacelift falls short
- From about $400/month, expensive for small teams
- Learning curve around policies and dependencies
- US-registered entity despite Polish engineering
- Not open source
Standout feature. Self-hosted workers under a managed control plane: Spacelift is the only platform here that gives you the policy engine without giving it your cloud credentials.
Utrecht, Netherlands
Founded 2003
Free and open source
Free
Best for: Teams needing reproducible environments and rollback that always works
NixOS makes rollback a guarantee instead of a hope, and the reason is architectural.
Conventional configuration management mutates a machine toward a desired state, so reverting means running the old configuration and trusting it undoes what the new one did — which is why a failed run so often leaves a system matching neither. NixOS builds each configuration as a new system generation alongside the previous one and switches atomically, so the old state was never overwritten and going back is certain.
The second property is reproducibility. Nix development shells give byte-identical dependencies on every machine, which removes the "works on my machine" class of problem at its root rather than containerising around it, and the package set exceeds 100,000. The whole system — services, users, firewall, packages — is declared in configuration files, so a machine is a document you can review.
NixOS is stewarded by the NixOS Foundation in Utrecht, MIT-licensed and free, with no commercial vendor involved. The costs are substantial and worth being blunt about: the learning curve is genuinely steep, the Nix language is unusual and documentation is uneven, and the non-standard filesystem layout breaks software that assumes ordinary paths. NixOS repays the investment at scale and rarely below it.
What NixOS does well
- Whole system declared in configuration files
- Atomic upgrades with rollback that is guaranteed, not hoped for
- Byte-identical reproducible development environments
- Over 100,000 packages
- Dutch foundation, MIT licence, no commercial vendor
Where NixOS falls short
- Genuinely steep learning curve
- Unusual language and uneven documentation
- Non-standard filesystem layout breaks some software
- Investment only pays back at scale
Standout feature. Generations instead of mutation: NixOS is the only tool here where undoing an upgrade is certain, because the previous system was never overwritten.
Poland
Founded 2015
Paid plans plus Bring Your Own Cloud
14-day free trial, no card
Best for: Teams wanting powerful CI/CD without deep DevOps expertise on staff
Buddy Works is CI/CD for teams that do not have a platform engineer, and the design decisions follow from that. Pipelines are cache-optimised so builds do not re-download the world on every run, execution is Docker-native, and more than 100 ready actions cover GitHub, GitLab, Bitbucket, AWS, Kubernetes and Docker — so a working pipeline is assembly rather than authorship. That is a different proposition from a YAML file someone has to become an expert in.
Buddy Works is built in Poland, with platform support across Linux, Windows and macOS including ARM, full CLI and MCP support for scripting and agent integration, and Bring Your Own Cloud so pipelines can run inside your own infrastructure rather than the vendor's.
A 14-day trial runs without a credit card. Beyond builds and tests it covers deployments and infrastructure tasks, which makes it a DevOps toolbox rather than only a build server. It is not open source, and pricing is by plan with BYOC on top.
What Buddy Works does well
- Cache-optimised pipelines that do not rebuild everything each run
- 100+ ready actions for the common platforms and clouds
- Linux, Windows and macOS including ARM
- Bring Your Own Cloud runs pipelines in your infrastructure
- Polish company; 14-day trial with no card required
Where Buddy Works falls short
- Not open source
- Smaller ecosystem than GitHub Actions
- Pricing by plan rather than usage
- Less suited to teams that want full pipeline-as-code control
Standout feature. Bring Your Own Cloud on a managed CI: Buddy Works is the option here where the pipeline runs on your infrastructure without you operating the CI system.
Berlin, Germany
Founded 2022
CLI free and open source / Cloud free tier, paid on request
Free CLI
Best for: Organisations with dozens or hundreds of Terraform or OpenTofu stacks
Terramate exists for the point at which infrastructure code becomes copy-paste. In a large estate the same provider block, backend configuration and tagging convention are repeated across every stack, and changing them means touching hundreds of files. Terramate generates that boilerplate from definitions instead — and crucially the output is plain, reviewable Terraform rather than an abstraction, so a reviewer reads what will actually run and nobody has to learn a new language to audit a change.
Change detection is the second half. Terramate works out which stacks a commit actually affects and runs only those, which is the difference between a CI pipeline that takes fifty minutes and one that takes five, plus stack dependencies for correct ordering and drift detection.
Terramate GmbH is based in Berlin, the CLI is open source under MPL 2.0 and runs inside your existing CI — so there are no new credentials to issue and Terramate Cloud is optional rather than required.
The CLI is free with a Cloud free tier and paid plans on request. The honest limits: it is unnecessary for small estates, it adds a generation step the team must learn, and the Cloud offering is less mature than its rivals.
What Terramate does well
- Eliminates boilerplate across many stacks
- Generated output is plain, reviewable Terraform
- Change detection makes large-estate CI dramatically faster
- Runs in your existing CI — no new credentials
- German company with an open-source CLI
Where Terramate falls short
- Unnecessary for small estates
- Adds a generation step the team must learn
- Cloud offering less mature than rivals
- Only useful alongside Terraform or OpenTofu
Standout feature. Generated Terraform you can still read: Terramate removes the copy-paste without hiding what will run behind an abstraction.
London, United Kingdom
Founded 2010
Free and open source; Ubuntu Pro support available
Free
Best for: Operating complex multi-component applications across mixed infrastructure
Juju addresses what happens after deployment, which is where most infrastructure tooling stops. Terraform creates the database; Juju knows how to upgrade it, back it up, scale it and recover it. Charmed operators encode that operational knowledge as software rather than as a runbook nobody reads, so day-2 operations become a capability of the system instead of institutional memory held by one person.
The other distinctive idea is relations. Relate an application to a database and Juju exchanges the credentials, connection strings and configuration automatically — the glue code that normally sits in a deployment script and rots. The same model runs across public cloud, Kubernetes and bare metal from one controller, which is genuinely useful for an organisation whose estate is mixed rather than uniform.
Juju comes from Canonical in London, AGPLv3-licensed and free, with commercial support available through Ubuntu Pro. The costs are honest: the concepts are unfamiliar and the learning curve is real, the charm ecosystem is far smaller than Helm's or Terraform's, and Juju is strongly tied to the Canonical stack. It is the right tool for a complex multi-component application and the wrong one for provisioning a VPC.
What Canonical Juju does well
- Encodes day-2 operations, not just deployment
- Relations wire applications together automatically
- One model across cloud, Kubernetes and bare metal
- AGPLv3 open source with commercial support available
- Backed by Canonical rather than a small team
Where Canonical Juju falls short
- Unfamiliar concepts with a steep learning curve
- Charm ecosystem far smaller than Helm or Terraform
- Strongly tied to the Canonical stack
- UK company, so adequacy rather than EU establishment
Standout feature. Operators that know how to run things: Juju is the only tool here where upgrading and backing up a deployed database is encoded in software rather than in a runbook.
London, United Kingdom
Founded 2022
Free and open source / Pro and Enterprise on request
Free
Best for: Teams wanting Terraform Cloud workflows without handing a vendor their credentials
Digger is built on one refusal, and it is the right one. An infrastructure-as-code platform needs credentials that can create and destroy anything in your cloud account — the most powerful access in the organisation — and Digger declines to hold them. Plans and applies run inside your own GitHub Actions or GitLab CI, so the credentials never leave infrastructure you already secure, audit and monitor, and no third party is added to the blast radius.
What you get in exchange is the workflow rather than a compromise: pull-request based plan and apply with the plan posted as a comment, OPA policies, drift detection and state locking — the Terraform Cloud experience, on your own runners.
Digger is Apache 2.0 open source with the orchestrator self-hostable, and there is no per-run platform pricing, so cost scales with your CI rather than with a vendor's meter. Digger is a small London company founded in 2022, which is worth weighing, and the practical limits are that the feature set is narrower than Spacelift's and it inherits your CI's concurrency limits.
What Digger does well
- Cloud credentials never leave your own CI
- Reuses CI infrastructure you already secure and audit
- Apache 2.0 open source, orchestrator self-hostable
- No per-run platform pricing
- Standard pull-request plan and apply workflow
Where Digger falls short
- Narrower feature set than Spacelift
- Inherits your CI's concurrency limits
- Small company founded in 2022
- UK jurisdiction, so adequacy rather than EU establishment
Standout feature. Nobody else gets the keys: Digger is the only tool here that delivers the Terraform Cloud workflow without a vendor ever holding credentials to your cloud account.
Distributed
Founded 2023
Free and open source
Free
Best for: Teams needing a secrets manager without licence risk
HashiCorp moved Vault to the Business Source Licence in the same announcement that moved Terraform, and the response was the same: a fork, governed by a foundation rather than a company.
OpenBao is that fork for secrets, maintained under the Linux Foundation's OpenSSF since late 2023, MPL 2.0 licensed. The logic is identical to OpenTofu's: a Vault estate holds every database credential and API key an organisation runs on, and no single participant in a foundation-governed project can relicense it the way HashiCorp did to its own product twice over.
Functionally it is Vault's feature set, inherited from the same codebase: encrypted key/value storage, dynamic secrets generated on demand for databases and Kubernetes rather than long-lived credentials sitting around waiting to leak, and policy-based access control down to the path level.
It runs wherever you run it, with no telemetry and no vendor anywhere in the path, which matches the self-hosted posture of every other open-source tool in this category rather than the billed-per-seat model of a hosted secrets manager sitting in front of your infrastructure.
The honest limits follow directly from being younger: OpenBao's plugin catalogue and third-party integrations lag Vault's after a decade of ecosystem growth on the original project, there is no managed SaaS offering so someone on the team operates and patches it, and there is no single commercial vendor to sign a support contract with — only the community and a handful of specialist consultancies.
Migrating an existing Vault estate onto it needs real testing against your own policies, not a find-and-replace on the binary name.
What OpenBao does well
- Same fork-under-a-foundation story as OpenTofu, now for secrets
- Linux Foundation OpenSSF governance, no single company owns it
- MPL 2.0, fully free and open source
- Dynamic secrets for databases, Kubernetes and more
- Runs wherever you run it, no vendor in the path
Where OpenBao falls short
- Younger project than Vault, smaller plugin ecosystem
- No managed SaaS offering — you operate it yourself
- No commercial vendor for paid support contracts
- Migrating from Vault needs real testing, not just a rename
Standout feature. OpenBao is Vault's OpenTofu: the same BSL-driven fork, the same Linux Foundation governance, now applied to secrets instead of infrastructure.
Hamburg, Germany
Founded 2016
Community Edition free and open source (open-core); Enterprise Edition consumption-based subscription, contact sales for pricing
Demo on request; no self-serve trial
Best for: Platform teams running Kubernetes fleets across clouds and on-prem
Kubermatic Kubernetes Platform exists for the moment an organisation stops managing one cluster and starts managing a fleet of them, scattered across clouds, on-premise racks and edge sites.
Kubermatic GmbH is based in Hamburg, building the platform since 2016 under the earlier name Loodse, and KKP gives that fleet a single control plane across more than 20 infrastructure providers, including AWS, Azure and Google Cloud alongside VMware vSphere, Nutanix, OpenStack and bare metal — without tying the cluster definitions permanently to any one of them.
The platform positions itself directly against the alternatives that lock you in: Red Hat OpenShift bundled tightly to the Red Hat ecosystem, SUSE Rancher, and VMware Tanzu, whose economics changed hard for many customers after Broadcom's acquisition.
KKP provisions a cluster on any supported infrastructure in a few minutes rather than hours, enforces policy consistently with OPA Gatekeeper across every cluster it manages regardless of where that cluster runs, and is open-core: the core platform is open source, with the Enterprise Edition adding features under a separate commercial licence.
What it is not is self-serve. There is no public price list and no free trial beyond a demo request, because KKP is sold as an enterprise consumption-based subscription and priced in a sales conversation rather than a checkout flow.
That is the right trade for a platform team already running dozens of clusters across several providers and the wrong one for a five-person team with a single Kubernetes cluster to worry about — the operational weight only pays for itself at scale.
What Kubermatic Kubernetes Platform does well
- Single control plane across 20+ clouds and on-prem infrastructure
- Community Edition core is free and open source
- OPA Gatekeeper policy enforcement across every managed cluster
- Clusters provision in minutes rather than hours
- German company, CNCF member and Kubernetes Certified Service Provider
Where Kubermatic Kubernetes Platform falls short
- No published pricing — enterprise sales process only
- No self-serve trial, demo request required
- Enterprise Edition parts are proprietary, not open source
- Built for fleets of clusters, overkill for just one or two
Standout feature. Kubermatic is the only tool here that manages the Kubernetes clusters themselves, across clouds and your own datacentre, rather than the infrastructure beneath them.
Paris, France
Founded 2020
Business $2,999/month billed yearly (save 20% vs monthly), 20 users included / Enterprise: custom pricing, annual billing only
14-day free trial, no credit card required
Best for: Teams wanting a turnkey BYOC deploy platform
Qovery is what a small platform team buys instead of building one.
BIRDSIGHT SAS, trading as Qovery, is a Paris company under French law, and the product is a Bring Your Own Cloud control plane: your applications and data stay inside your own AWS, GCP, Azure or Scaleway account while Qovery operates the deployment pipeline, environment management and day-2 operations on top of it.
That is a different trade from Terramate or Digger, which run inside CI you already operate — Qovery is a managed platform that happens to keep your workloads on your own infrastructure rather than its own.
In exchange for that management layer, Qovery gives a team without a dedicated DevOps function CI/CD built in rather than assembled from parts, automatic preview environments spun up and torn down per pull request, and compliance handled rather than bolted on afterwards: SOC 2 Type II and GDPR by default, with HIPAA, HDS, ISO 27001 and DORA available as an add-on package for regulated customers.
Kubernetes clusters, on the Business plan, are provisioned, maintained and upgraded for you rather than left as the customer's own operational problem to own.
The number that matters is the price: Business starts at $2,999 a month billed yearly for 20 included users, with no free tier any more, only a 14-day trial with no credit card required.
That puts Qovery well above the self-hosted, run-in-your-own-CI tools elsewhere in this category, and it is the right comparison to make before buying — Qovery earns its price specifically when a team wants the platform fully managed, not when the goal is avoiding a platform vendor's bill altogether.
What Qovery does well
- Bring Your Own Cloud keeps workloads and data in your own account
- Built-in CI/CD removes the need for separate pipeline tooling
- Automatic preview environments per pull request
- SOC 2 Type II and GDPR built in, HIPAA/ISO 27001 add-on
- French company, contracts under French law in Paris
Where Qovery falls short
- No free tier, 14-day trial only
- Business starts at $2,999/month — expensive for a small team
- Annual billing required to get the listed Business price
- Overlaps with cheaper self-hosted options if you already run CI
Standout feature. The only tool here that hands a small team a full managed BYOC platform — CI/CD, previews and compliance included — in one product.
Berlin, Germany
Teams from EUR 1,999/month (5 users) / Pro from EUR 4,999/month (50 users) / Enterprise and Self-Hosted: custom pricing
Free trial available, no credit card needed
Best for: Platform teams building a self-service golden path
Humanitec, the trading name of Berlin's Ternki GmbH, does not provision infrastructure itself — it decides which of your existing Terraform or Crossplane modules runs for a given application in a given environment, and keeps that decision consistent as the organisation scales past the point where a wiki page of tribal knowledge can.
The Platform Orchestrator reads a workload's requirements, expressed through the open Score specification, and resolves them against the modules a platform team has already registered, which is a materially different job from Qovery's turnkey BYOC platform or Kubermatic's cluster fleet management sitting elsewhere in this list.
The result is a live resource graph showing what is provisioned, who owns it and what depends on what across the whole estate, drift detection that catches when reality diverges from the declared state whether a human or an AI agent caused it, and rollback to a known-good configuration in seconds rather than a redeploy-and-hope.
It is built to replace the do-it-yourself stack of ArgoCD, Crossplane, Terraform and glue scripts that platform teams otherwise stitch together and maintain by hand, or a homegrown internal developer platform built in-house to do the same job less consistently.
Humanitec is SOC 2 Type II certified with GDPR compliance handled through Vanta, and pricing starts at €1,999 a month for just five users on the Teams plan, rising to €4,999 for 50 users on Pro, with Enterprise and a self-hosted option priced on request for regulated environments.
It only pays off once the Terraform and Crossplane modules it orchestrates already exist — Humanitec is a control plane for infrastructure code an organisation already has, not a source of that code from nothing.
What Humanitec does well
- Orchestrates your existing Terraform/Crossplane modules instead of replacing them
- Live resource graph shows ownership and dependencies across the estate
- Drift detection with one-command rollback to a known-good state
- Self-hosted option available for regulated environments
- German company, SOC 2 Type II certified
Where Humanitec falls short
- €1,999/month minimum for just five users
- Needs Terraform or Crossplane modules already in place to orchestrate
- Real conceptual overhead (Score, workloads, resources) for a small team
- Not itself open source
Standout feature. Humanitec does not run your infrastructure — it is the control plane that decides which of your own Terraform modules runs where.
Frankfurt am Main, Germany
Custom pricing, no published price list; book a demo
Demo on request
Best for: Enterprises governing several clouds and sovereign providers
meshcloud GmbH, based in Frankfurt am Main, solves a problem specific to organisations running several clouds at once rather than standardising on one: who is allowed to spin up what, in which account, under which cost centre, and how that gets governed consistently across AWS, Azure, Google Cloud and OpenStack.
Its meshStack platform automates landing-zone setup and puts a self-service marketplace in front of developers, which the company states cuts a typical resource request from roughly 45 minutes of platform-team handling down to under a minute of pure self-service for the requester.
What sets meshcloud apart within this category is its reach into sovereign European infrastructure specifically: STACKIT, IONOS and 3DS Outscale sit alongside the big three hyperscalers as first-class targets, which matters for the growing number of European organisations with a sovereignty requirement written into procurement policy rather than left as a vague preference.
A built-in FinOps module gives cost visibility across every connected cloud from one console rather than reconciling several separate billing dashboards by hand every month, which is where most multi-cloud governance effort quietly goes.
meshcloud is ISO 27001 and TISAX certified, and holds CNCF Silver and Linux Foundation membership, credentials aimed squarely at enterprise procurement rather than a self-serve individual buyer.
There is no published price list — meshcloud sells through a demo and a sales conversation rather than a signup form — and the product is landing-zone and account governance rather than a Terraform orchestration engine, so in practice it complements Spacelift or Terramate's IaC layer in an organisation rather than replacing either of them outright.
What meshcloud does well
- Governs AWS, Azure, GCP and OpenStack from one console
- Also covers sovereign European clouds: STACKIT, IONOS, 3DS Outscale
- Self-service marketplace cuts provisioning from ~45 minutes to under a minute
- ISO 27001 and TISAX certified
- German company built for European sovereignty requirements
Where meshcloud falls short
- No published pricing, sales conversation required
- No self-serve trial
- Landing-zone and governance focus, not a Terraform orchestration engine
- Best suited to organisations already running multiple clouds
Standout feature. The only tool here built around European cloud sovereignty first, governing STACKIT and IONOS alongside AWS and Azure from one console.
