werf
werf is a free, open-source tool for delivering applications to Kubernetes, covering image builds, tests, release artifacts, and deployment.
What werf is
werf is a free, open-source tool for delivering applications to Kubernetes, covering image builds, tests, release artifacts, and deployment. It uses Giterminism to keep delivery configuration in Git as the source of truth. Builds can be defined with Dockerfiles or Stapel; incremental builds reuse registry layers and rebuild changed components. Content-based tagging and immutable images are intended to keep builds consistent for the same commit. The converge command builds images and deploys an application, and deployment tracking waits for resources to become ready by default. CI integrations are available for GitLab CI/CD and GitHub Actions, with registry documentation for services including ECR, ACR, Docker Hub, GitHub, GitLab, Harbor, and Quay. werf supports Docker and an embedded Buildah backend; Buildah supports daemonless rootless builds on Linux and Windows with WSL2, while macOS users are advised to use a virtual machine. Helm secret parameter files can be encrypted for storage in Git, but decryption requires the secret key. Linux, macOS, and Windows workflows are documented.
Good
- Free and open-source.
- Supports Dockerfiles and Stapel image builds.
- Deployment tracking waits for resources to become ready.
- Encrypted Helm secret files can be stored in Git.
Watch out
- Buildah on macOS requires a virtual machine.
- Windows setup lists PowerShell, Git, GPG, and Docker Engine requirements.
- Anonymous usage telemetry is collected unless disabled.
Who it suits
werf suits teams deploying to Kubernetes that want image builds, tests, artifacts, and deployment in one delivery workflow. It supports GitOps and progressive delivery and offers integrations for GitLab CI/CD and GitHub Actions.
Verdict
werf combines build and deployment tasks for Kubernetes with Git-based configuration and a choice of build backends. Review platform requirements and the secret-key handling needed for encrypted files before adopting it.
The facts
Each one read from werf's own pages, with the date it was checked.
What it does
- All-in-one workflow
- werf builds images, runs tests, distributes release artifacts, and deploys applications to Kubernetes in one tool.checked 30 Sep 2026
- Build backends
- werf supports Docker and the embedded Buildah backend, which supports secure daemonless rootless builds.checked 30 Sep 2026
- Build reproducibility
- werf uses content-based tagging, shared registry caching, and immutable images that are not rebuilt for the same commit.checked 30 Sep 2026
- Builds
- werf supports Dockerfiles and Stapel, an alternative assembly syntax, for defining image builds.checked 30 Sep 2026
- Caching
- werf supports incremental builds that rebuild modified components and reuse existing layers from a container registry.checked 30 Sep 2026
- CI integrations
- werf provides ready-made integrations for GitLab CI/CD and GitHub Actions.checked 30 Sep 2026
- Community
- The homepage says developers are in contact with the community and lists Telegram, Bluesky, and GitHub Discussions.checked 30 Sep 2026
- Community and governance
- werf developers engage through Telegram, Bluesky, GitHub Discussions, and the project is a CNCF sandbox project.checked 30 Sep 2026
- Container registries
- Documented registry implementations include ECR, ACR, Docker Hub, GCR, GitHub, GitLab, Harbor, and Quay.checked 30 Sep 2026
- Deployment
- The werf converge command builds images and deploys an application, and deployment tracking waits for resources to become ready by default.checked 30 Sep 2026
- Encrypted secrets
- werf supports encrypted secret parameter files stored in a Git repository and decrypted during use.checked 30 Sep 2026
- Giterminism
- werf uses Giterminism to encourage keeping delivery configuration in Git as the source of truth.checked 30 Sep 2026
- Local requirements
- The Linux-and-Docker setup requires Bash, Git 2.18 or newer, Docker Engine, a Kubernetes cluster, and a public container registry.checked 30 Sep 2026
- Operating systems
- The Getting Started guide includes Linux, macOS, and Windows workflows.checked 30 Sep 2026
- Product
- werf is an open-source tool for building images, running tests, distributing release artifacts, and deploying applications to Kubernetes.checked 30 Sep 2026
- Project origin
- The homepage says werf was originally created by Flant and identifies werf as a CNCF sandbox project.checked 30 Sep 2026
- Project start
- The maker's publication says werf's first commit was on January 22, 2016.checked 30 Sep 2026
- Purpose
- werf is a solution for efficient and consistent software delivery to Kubernetes covering the CI/CD lifecycle and related artifacts.checked 30 Sep 2026
- Secret handling
- werf can encrypt Helm secret parameter files for storage in Git; decrypting them requires the secret key.checked 30 Sep 2026
- Signed downloads
- werf publishes Linux, macOS, and Windows binaries with PGP signatures that can be verified.checked 30 Sep 2026
- Technology integrations
- werf relies on Git, Buildah, Helm, Kubernetes, and the user’s CI system.checked 30 Sep 2026
- Telemetry
- werf collects anonymous usage data, and telemetry can be disabled by setting WERF_TELEMETRY=0.checked 30 Sep 2026
Where it runs
- Buildah platform limit
- Buildah is available on Linux and Windows with WSL2, while macOS users are advised to use a virtual machine.checked 30 Sep 2026
- Windows constraint
- The Windows and Docker guide lists PowerShell, Git 2.18.0 or above, GPG, and Docker Engine as requirements.checked 30 Sep 2026
Alternatives to werf
- 1
Garden
Free planOpen sourceWebAPILinuxmacOS8.3From $50 a month - 2
AWS CodeBuild
Free planWebAPILinuxmacOS7.9From $0.01 a month - 3
Amazon EC2
Free planAndroidiOSWebAPI7.6Free plan - 4
Source-to-Image
Free planOpen sourceLinuxmacOSSelf-hostedWindows7.2Free plan - 5
Dagger
Free planWebLinuxmacOSSelf-hosted7.1From $50 a month - 6
BuildKit
Free planAPILinuxmacOSSelf-hosted6.8Free plan