Stack index

295 technologies, one paragraph each

This is not a logo wall. Each entry says what the technology is used for and — where it matters — what goes wrong with it. If you see a tool here you use, we have run it in production or repaired someone else's attempt at it.

295 entries

Provisioning & OS

PXE: Network boot. The beginning of every repeatable bare-metal build.
iPXE: Extended PXE with HTTP boot and scripting; we use it for heterogeneous hardware.
Debian Preseed: Unattended Debian installs. Our default OS layer for customer-owned hardware.
Kickstart: Unattended installs for RHEL-family distributions.
MAAS: Canonical's machine-as-a-service. Keeps the inventory of what hardware exists and what state it is in.
Foreman: Lifecycle management for fleets: provisioning, config, and reporting in one place.
Katello: Content and patch management on top of Foreman.
Tinkerbell: Microservice-based bare-metal provisioning, workflow driven.
Warewulf: Stateless cluster provisioning, common in HPC builds.
Packer: Builds OS images as code so a node is an artifact, not a snowflake.
cloud-init: First-boot configuration. Where image and runtime configuration meet.
Redfish: Modern BMC API. Firmware updates and out-of-band control without vendor tools.
IPMI: Older out-of-band management. Still everywhere, still needed for fencing.
Talos Linux: Immutable, API-managed Kubernetes OS. No SSH, no drift, no config files.
Flatcar Container Linux: Immutable OS with automatic updates; a good fit for edge fleets.
Bottlerocket: AWS-built minimal container OS; useful in hybrid estates.
Ubuntu LTS: Common baseline where the customer already standardised on it.
AlmaLinux: RHEL-compatible rebuild for teams leaving CentOS.
Rocky Linux: Another RHEL-compatible path; choice usually follows existing tooling.
OpenSCAP: Automated compliance scanning against CIS and STIG profiles.
unattended-upgrades: Automatic security patching on Debian and Ubuntu, with a controlled reboot policy.

Network Infrastructure

EVPN-VXLAN: The modern data-centre overlay. L2 reachability across racks without stretching a broadcast domain by hand.
Spine-leaf: Two-tier Clos topology. Predictable latency and predictable oversubscription as you grow.
MLAG: Multi-chassis link aggregation — a switch pair presenting one logical device so servers can be dual-homed without STP.
MC-LAG: Vendor-neutral term for the same idea across platforms; the devil is in the failure behaviour, not the name.
vPC: Cisco Nexus virtual PortChannel — MLAG by another name, with its own peer-link and orphan-port rules.
StackWise / VSS: Cisco stacking and virtual switching. Convenient, and a single control plane you must plan a reboot around.
Arista EOS: Data-centre switching with a clean CLI and strong automation APIs. Common in spine-leaf builds.
Cumulus Linux: Debian-based network OS. Real Linux tooling on switch silicon — it fits how we work.
SONiC: Open-source switch OS with a containerised architecture; increasingly viable on merchant silicon.
Cisco NX-OS: The incumbent in a huge number of data centres. We design, audit and automate it rather than replace it.
Juniper Junos: Commit-based configuration with genuine rollback. Well suited to disciplined change management.
BIRD: Lightweight routing daemon for hosts and edge nodes where a full suite is overkill.
OSPF / IS-IS: Interior routing protocols for the underlay. Timers and areas decide your convergence time.
BFD: Bidirectional Forwarding Detection. Sub-second failure detection — the thing that makes fast convergence real.
VRRP: First-hop redundancy for a floating gateway. Simple, and only as reliable as its health checks.
CARP + pfsync: Failover for pfSense and OPNsense firewalls, with state synchronisation between the pair.
Route reflector: Scales iBGP from a mesh into a hub-and-spoke design without breaking path visibility.
RPKI: Route origin validation. Filters the accidental and malicious BGP announcements that leak across the internet.
VRF / route leaking: Multiple independent routing tables on shared hardware — how tenancy and segmentation are actually done.
Fortinet FGCP: FortiGate clustering protocol. Session pickup and failover timers need tuning, not just enabling.
Palo Alto HA3: PAN-OS high availability over a dedicated HA3 link; active/active demands session-owner awareness.
Check Point ClusterXL: Legacy and current Check Point clusters. We audit, tune and migrate them.
pfSense / OPNsense: FreeBSD-based firewalls. Cost-effective and genuinely capable, if the hardware and HA design are right.
VyOS: Linux routing and firewalling platform with a Junos-like CLI, scriptable end to end.
IPsec / DMVPN: Encrypted site-to-site connectivity, from simple tunnels to large hub-and-spoke estates.
NetBox: Source of truth for IPAM and DCIM. Configuration generated from it cannot drift silently.
NAPALM: Vendor-neutral abstraction for device configuration. One automation path across mixed vendors.
Nornir / Netmiko / Scrapli: Python automation frameworks for pushing configuration and collecting state at scale.
Ansible network modules: Declarative device configuration without agents, with per-vendor resource modules.
Jinja2 config templating: Turns NetBox data into device configuration, so the same intent produces the same config everywhere.
gNMI / OpenConfig: Model-driven, streaming device telemetry instead of polling SNMP counters every five minutes.
Oxidized: Automated configuration backup for network devices, with diffs committed to Git.
containerlab: Runs real network operating systems as containers. Change your routing design in a lab, not in production.
Batfish: Static analysis of device configurations — finds the blackhole and the accidental permit before you deploy.
iPerf3: Throughput and jitter testing. The honest number behind "the network feels slow".
Ostinato / tcpreplay: Packet generation and replay for reproducing the failure you cannot reproduce with traffic.
RFC 2544 / Y.1564: Standardised throughput, latency and frame-loss test methodology. Removes opinion from network commissioning.
sFlow / NetFlow / IPFIX: Flow telemetry that answers "what is actually using this link" without a packet capture.
gNMIc: Collector for streaming telemetry into Prometheus and Grafana.
LibreNMS: Network monitoring with topology discovery, alerts and per-port utilisation history.
snmp_exporter: Bridges SNMP from switches and PDUs into Prometheus without a separate monitoring system.
PTP: Sub-microsecond time distribution where NTP is not accurate enough — trading, media, and telemetry.
Zero-touch provisioning: A switch arrives, boots, finds its template, and configures itself. Removes the console cable and the typo.
Jumbo frames: MTU 9000 end to end. A performance win for storage, and an outage if one device in the path disagrees.
LACP: Link aggregation with the hashing deliberately chosen for your traffic, not left on the default.
Storm control: Bounds broadcast and multicast floods so one misconfigured NIC cannot take a VLAN down.
Out-of-band management: A separate management path and network. The difference between fixing a mistake remotely and driving to the site.

Kubernetes

kubeadm: Upstream cluster bootstrap. Predictable and boring, which is the point.
Kubespray: Ansible-based cluster deployment with useful defaults for on-prem.
RKE2: Rancher's hardened distribution; CIS-aligned out of the box.
K3s: Lightweight Kubernetes for edge and constrained environments.
k0s: Single-binary distribution; simple to reason about in small fleets.
OKD: Upstream OpenShift. Heavier, but strong for multi-tenant platform teams.
Cluster API: Declarative cluster lifecycle. Makes clusters themselves versioned objects.
Metal3: Bare-metal provider for Cluster API — machines provisioned as Kubernetes resources.
Cilium: eBPF datapath, kube-proxy-free, with network policy and Hubble observability.
Calico: Mature CNI with strong policy support; common in existing estates.
Multus: Multiple network interfaces per pod; needed for SR-IOV and storage fabrics.
Gateway API: Successor to Ingress. Role-oriented and finally expressive enough for real routing.
MetalLB: Gives LoadBalancer services real IPs on bare metal.
Rook-Ceph: Ceph inside Kubernetes, managed by an operator. Block, file and object from one cluster.
Longhorn: Simpler distributed block storage for Kubernetes; good fit for smaller clusters.
Argo CD: GitOps controller. Git is the deployment mechanism, not a documentation exercise.
Flux: GitOps toolkit. Composable, and a good fit for multi-tenant platforms.
Helm: Packaging for Kubernetes manifests. Used carefully, it is a versioning tool.
Kustomize: Overlay-based manifest management without templating logic.
Kyverno: Policy as Kubernetes resources. Admission control that reads like configuration.
OPA Gatekeeper: Rego-based admission policy. Powerful, with a real learning curve.
Pod Security Admission: Built-in baseline and restricted profiles. The minimum bar we enforce.
External Secrets Operator: Syncs secrets from Vault or cloud secret managers into the cluster.
cert-manager: Automated certificate issuance and renewal, ACME and internal PKI.
KEDA: Event-driven autoscaling — scale on queue depth, not just CPU.
Kueue: Job queueing with quotas and borrowing between teams.
Volcano: Batch scheduler for AI and HPC workloads on Kubernetes.
DRA: Dynamic Resource Allocation. GA in 1.34 and the proper way to schedule GPUs now.
vCluster: Virtual clusters for tenant isolation without a real control plane each.
Karmada: Multi-cluster orchestration with policy-driven placement.
Node Feature Discovery: Labels nodes by hardware capability so scheduling can be precise.

Networking & Edge

HAProxy: The reliable L7 load balancer. Config is explicit, behaviour is predictable.
Nginx: Reverse proxy, TLS termination, and the web server this very site runs on.
OpenResty: Nginx plus Lua, for logic that belongs at the edge.
Envoy: Modern proxy with dynamic configuration; the data plane underneath a lot of service mesh.
Traefik: Service discovery integrated proxy; convenient in container-heavy environments.
APISIX: API gateway with plugin ecosystem and dynamic routing.
Kong: API gateway with a strong plugin model and enterprise options.
LVS: Linux Virtual Server. Kernel-level L4 load balancing that has aged extremely well.
IPVS: The kernel module behind LVS; DR mode gives near-linear scaling.
DPVS: Userspace LVS built on DPDK, for very high packet rates.
Katran: eBPF/XDP L4 load balancer, originally from Facebook.
Keepalived: VRRP-based VIP failover. Simple and effective when health checks are honest.
Gateway API Inference Extension: Model-aware routing and token rate limiting for LLM endpoints.
Istio: Service mesh with mTLS and traffic policy; ambient mode removes most sidecars.
Linkerd: Lightweight service mesh; less to operate than the alternatives.
Cilium Service Mesh: Mesh capabilities without sidecars, using the same eBPF datapath.
ModSecurity: WAF engine; paired with OWASP CRS for real protection.
Coraza: Modern WAF engine, drop-in for ModSecurity rules.
FRR: Routing suite. We use it for BGP anycast and host-level peering.
VXLAN: Overlay networking for stretching L2 across racks without stretching broadcast domains carelessly.
WireGuard: Modern VPN. Our default for site-to-site and management-plane access.

Storage

Ceph: Unified distributed storage: block, file and object from one cluster.
Cephadm: Container-based Ceph deployment and orchestration; the modern default.
Ceph RGW: S3-compatible object gateway on top of RADOS.
CephFS: POSIX distributed filesystem for shared workloads.
CRUSH map: The placement rules that decide durability and rebalance behaviour. Most storage incidents trace here.
BlueStore: Ceph's default OSD backend. Tuning it is where throughput comes from.
BeeGFS: Parallel filesystem that is dramatically easier to operate than Lustre.
Lustre: HPC parallel filesystem. Excellent at scale, unforgiving of sloppy operations.
WekaFS: Commercial parallel filesystem with strong NVMe performance.
JuiceFS: POSIX layer over object storage with metadata in Redis or TiKV.
MinIO: High-performance S3-compatible object storage for on-prem workloads.
Garage: Lightweight geo-distributed object store; good for small geographic replication needs.
SeaweedFS: Object and file storage that scales out without a heavy operational footprint.
Longhorn: Distributed block storage for Kubernetes with built-in backup targets.
OpenEBS Mayastor: NVMe-based container-attached storage for latency-sensitive workloads.
DRBD: Kernel-level block replication. The foundation of many classic HA pairs.
LINSTOR: Manages DRBD volumes across a cluster without hand-editing configs.
ZFS: Checksummed filesystem with snapshots and reliable send/receive replication.
NVMe-oF: Block storage over a fabric. Remote disks at near-local latency.
dm-multipath: Redundant paths to shared storage. Frequently misconfigured, frequently the cause of stalls.
NFS-Ganesha: Userspace NFS server, often in front of CephFS.

Storage Fabric

Fibre Channel: Dedicated lossless storage network. Still the default where predictable latency matters more than cost per port.
FC zoning: The access-control layer of a SAN. Single-initiator, single-target zoning is the baseline we hold ourselves to.
Dual fabric: Two physically independent SANs with no shared switch, no shared power and no shared failure domain.
F_Port trunking: Aggregates ISLs into one logical link, so a single ISL failure does not trigger a fabric rebuild.
VSAN: Logical fabric partitioning on Cisco MDS — isolation and separate zone databases on shared hardware.
ISL / IFL: Inter-switch links. Their sizing decides oversubscription, and oversubscription decides your peak performance.
NPIV: N_Port ID Virtualisation — many virtual WWNs on one physical HBA port, essential for virtualised hosts.
FC-NVMe: NVMe commands carried over the existing FC fabric. Lower latency without replacing the SAN.
iSCSI: Block storage over Ethernet. Cheap, flexible, and unforgiving of a congested link or an inconsistent MTU.
CHAP: Authentication for iSCSI targets. Weak if it is the only control, so it is paired with network isolation.
ALUA: Asymmetric Logical Unit Access — how a host knows which array controller is optimised, and when that changes.
NVMe/TCP: NVMe over plain TCP at 25/100G. No lossless configuration required, which makes it far easier to operate than RoCE.
PFC: Priority Flow Control. Makes an Ethernet segment lossless for RDMA — and misconfigured, it causes head-of-line stalls and deadlocks.
ECN + DCQCN: Congestion notification and rate control. The other half of a functional RoCE deployment.
SPDK: Userspace, polled-mode NVMe. How software targets reach wire speed without kernel overhead.
ConnectX: NVIDIA/Mellanox RDMA adapters. Driver and firmware pairing is the difference between working and mysterious packet loss.
HBA: Host bus adapter. Firmware, driver and queue depth all matter more than the brand on the bracket.
Cisco MDS: The FC director and switch line we most often find in existing enterprise SANs.
Brocade FOS: Brocade/Broadcom fabric OS. Clean zoning model, and FOS version discipline matters as much as firmware anywhere else.
fcping / fctraceroute: FC diagnostics. Answers whether a path exists and where it breaks, without guessing.
vdbench: Workload generator for storage validation across many hosts and LUNs at once.
Optics DDM / DOM: Transceiver diagnostics. Receive power drifting is an outage you can schedule instead of one you get surprised by.

Databases

PostgreSQL: Default choice for serious relational workloads. We operate it heavily.
Patroni: PostgreSQL HA via a distributed consensus store. Our standard for automatic failover.
pgBackRest: Backup and point-in-time recovery with verifiable restore.
WAL-G: WAL archiving to object storage; lighter than pgBackRest, very effective.
PgBouncer: Connection pooling. Usually the single cheapest performance win available.
pgpool-II: Older but feature-rich pooling and failover layer.
Citus: PostgreSQL sharding extension for horizontal scale-out.
TimescaleDB: Time-series on PostgreSQL; good when you want one engine, not two.
pgvector: Vector similarity inside PostgreSQL. Often enough for RAG without another datastore.
MySQL: Still the default for a huge amount of application code.
Galera Cluster: Synchronous multi-master MySQL. Fast failover, with real write-conflict trade-offs.
Group Replication: MySQL's native synchronous replication with automatic membership.
InnoDB Cluster: Group Replication plus MySQL Router and MySQL Shell, as one coherent stack.
ProxySQL: Query routing and read/write splitting with real query rules.
gh-ost: Online schema change on MySQL without locking the table.
pt-online-schema-change: Percona's alternative; the right pick in some replication topologies.
TiDB: Distributed SQL with MySQL compatibility and horizontal scale.
TiKV: The distributed transactional key-value store under TiDB.
CockroachDB: Distributed SQL with strong survivability guarantees across regions.
YugabyteDB: PostgreSQL-compatible distributed SQL for geo-distributed deployments.
Vitess: Sharding layer for MySQL; battle-tested at very large scale.
MongoDB: Replica sets for HA, sharded clusters for scale. Fine when the data is genuinely document-shaped.
Cassandra: Wide-column store for write-heavy, multi-region workloads.
ScyllaDB: C++ Cassandra-compatible engine with substantially better tail latency.
ClickHouse: Columnar analytics that answers real questions in sub-second time.
ClickHouse Keeper: Replaces ZooKeeper for ClickHouse replication coordination.
StarRocks: Analytical engine with good join performance on real-time data.
Apache Doris: MPP analytics database; simple to operate at moderate scale.
Elasticsearch: Search and log analytics; shard planning determines whether it stays fast.
OpenSearch: Apache-licensed fork; often the practical choice for on-prem search.
Milvus: Purpose-built vector database for large embedding collections.
Qdrant: Vector search with filtering; approachable to operate.
Weaviate: Vector database with a schema and hybrid search built in.
Redis: In-memory data structures. Cluster and Sentinel modes have very different failure behaviour.
Valkey: The Linux Foundation fork; increasingly the safe default for new Redis-compatible deployments.

Messaging & Cache

Kafka: The event backbone for most large systems. Partition design decides everything.
KRaft: Kafka without ZooKeeper. Simpler to operate and now the default path.
Strimzi: Kubernetes operator that runs Kafka with rack awareness and rolling upgrades.
MirrorMaker 2: Cross-cluster replication for Kafka, with topic and offset mapping.
Pulsar: Multi-tenant messaging with separated compute and storage.
NATS: Very low-latency messaging; JetStream adds persistence.
RabbitMQ: Classic broker with quorum queues for genuine HA.
Redpanda: Kafka-compatible engine without JVM overhead.
ZooKeeper: Coordination service still present in many legacy estates.
Schema Registry: Enforces event schema compatibility so consumers do not break silently.
Debezium: Change data capture from databases into Kafka with consistent ordering.

Data & Analytics

Spark: Batch and micro-batch processing. On Kubernetes, it scales with the workload.
Flink: True stream processing with event-time semantics and exactly-once state.
Trino: Federated SQL across object storage, databases and message streams.
Iceberg: Open table format with snapshots and schema evolution. Makes object storage a warehouse.
Hudi: Table format with strong upsert and incremental-read support.
Delta Lake: Table format with ACID guarantees; common where Spark is already central.
Project Nessie: Git-like branching for data lakes. Useful for reproducible pipelines.
HDFS: Legacy distributed filesystem. We maintain and migrate these estates.
YARN: Hadoop resource manager; still the scheduler in many installed bases.
Hive Metastore: The catalogue most lakehouses quietly depend on — and quietly fail over.
Airflow: Workflow orchestration with a huge operator ecosystem.
Argo Workflows: Kubernetes-native pipeline orchestration; good fit for containerised jobs.
DataHub: Metadata platform with search and lineage across the estate.
OpenMetadata: Open-source catalogue with governance features built in.
dbt: SQL transformation with tests and documentation as part of the model.

HPC & AI

Slurm: The HPC scheduler. Everything about a research cluster flows through it.
Slinky: Runs Slurm-managed jobs inside Kubernetes — the bridge between the two worlds.
OpenHPC: Curated stack of HPC packages that fit together properly.
InfiniBand: Low-latency, high-bandwidth fabric. Still the gold standard for training clusters.
RoCE v2: RDMA over Converged Ethernet. Cheaper than InfiniBand, and far less forgiving.
NCCL: Collective communication for GPUs. All-reduce bandwidth is the number that decides training speed.
NVLink: Direct GPU-to-GPU interconnect within and between nodes.
GPUDirect RDMA: Moves data straight between GPU memory and the network, bypassing the CPU.
NVIDIA GPU Operator: Automates driver, container runtime and device plugin lifecycle on Kubernetes.
MIG: Multi-Instance GPU. Splits one card into isolated slices for multiple tenants.
MPS: Multi-Process Service for sharing a GPU among cooperative processes.
KAI Scheduler: Gang scheduling and fair-share for large AI workloads on Kubernetes.
KubeRay: Runs Ray clusters on Kubernetes for distributed Python workloads.
Kubeflow: ML platform on Kubernetes — pipelines, notebooks, training operators.
vLLM: High-throughput LLM inference with paged attention. Our usual serving default.
Triton Inference Server: Multi-framework model serving with dynamic batching.
KServe: Model serving on Kubernetes with autoscaling and canary rollout.
DCGM: GPU telemetry: utilisation, memory, ECC errors, thermal and power.
Spack: Package manager for HPC software stacks where dependencies are brutal.
Apptainer: Containers on HPC systems without requiring root.
DeepSpeed: Training optimisation library; ZeRO stages decide how a model fits across GPUs.

Observability

Prometheus: Pull-based metrics. The default monitoring layer for infrastructure.
Thanos: Long-term, globally queryable Prometheus storage on object storage.
Grafana Mimir: Horizontally scalable metrics backend when Prometheus alone is not enough.
VictoriaMetrics: Efficient metrics store with a smaller operational surface.
Loki: Log aggregation indexed by labels rather than full text — cheap and effective.
Grafana Alloy: Unified collector replacing Promtail and the Grafana agent.
OpenTelemetry: Vendor-neutral traces, metrics and logs from one instrumentation pipeline.
Tempo: Trace storage that pairs with Loki and Prometheus for correlation.
Alertmanager: Routing, grouping and silencing. Where alert fatigue is either created or cured.
OpenCost: Kubernetes cost attribution per namespace and team. The FinOps answer.
Cilium Hubble: Network flow visibility from the eBPF layer — invaluable during mystery outages.
Pixie: eBPF-based application observability with no code changes.
bpftrace: Kernel tracing on demand. How you find the problem nobody logged.
SLO: A user-facing reliability promise with an error budget attached.

Virtualization

Proxmox VE: Open-source virtualisation platform. The most common VMware replacement we deliver.
Harvester: Kubernetes-native hyperconverged infrastructure for mixed VM and container estates.
KubeVirt: Runs virtual machines as Kubernetes objects, beside containers.
OpenStack: Full private cloud API; heavy, but the right answer when you need a real cloud surface.
Kolla-Ansible: Containerised OpenStack deployment, the maintainable way to run it.
XCP-ng: Xen-based platform; a fit for some XenApp/XenServer estates.
oVirt: Red Hat-lineage virtualisation management, now upstream of OLVM.
virt-v2v: The migration tool that converts VMware and Hyper-V guests to KVM.
Nutanix: Often the incumbent in HCI estates we extend or exit from.
SR-IOV: Hardware-level device virtualisation for network and GPU passthrough.

Security & Identity

HashiCorp Vault: Secrets management, dynamic credentials and internal PKI.
Keycloak: OIDC and SAML identity provider you can self-host.
SPIFFE/SPIRE: Workload identity so mTLS does not depend on long-lived secrets.
Cosign: Container image signing and verification.
Sigstore: Keyless signing infrastructure underpinning supply-chain verification.
Syft: Generates SBOMs from images and filesystems.
Grype: Vulnerability scanning against generated SBOMs.
Trivy: All-in-one scanner for images, filesystems and IaC misconfiguration.
Falco: Runtime threat detection from kernel events.
kube-bench: Checks a cluster against the CIS Kubernetes Benchmark.
step-ca: Small internal certificate authority for service TLS.
fail2ban: Bans hosts after repeated authentication failures. Baseline host hygiene.
nftables / ufw: Host firewall baseline. Deny inbound, allow what is named, log the rest.
AppArmor: Mandatory access control on Debian and Ubuntu hosts and containers.

Automation & IaC

Terraform: Infrastructure as code for anything with an API, including on-prem platforms.
OpenTofu: The open-source Terraform fork; a legitimate option for new work.
Ansible: Configuration management without agents. The workhorse of on-prem automation.
AWX: Web UI, scheduling and RBAC for Ansible.
Semaphore: Lighter Ansible UI when AWX is more than you need.
Pulumi: Infrastructure as code in real programming languages.
GitLab CI: Self-hostable pipelines; common in regulated environments.
Jenkins: Still present in many estates; we stabilise and migrate rather than mock it.
Chaos Mesh: Controlled fault injection on Kubernetes — the safe way to rehearse failure.
LitmusChaos: Chaos engineering framework with reusable experiment libraries.
Velero: Backup and restore for Kubernetes resources and persistent volumes.
Gatus: Declarative uptime monitoring; the data source behind a real status page.

Looking for something not on this list?

Good — that's usually where the interesting problems are. Tell us the tool and the constraint; if we haven't run it, we'll say so instead of bluffing.

Book a 30-min review See pricing

botonwa@gmail.com · +86 130 5181 3099