cross-rs/cross is a CLI tool that enables zero-setup cross-compilation for Rust projects by wrapping Cargo and executing builds inside container engines (Docker/Podman). It manages a comprehensive registry of pre-built Docker images for dozens of target triples (Linux, musl, Android, FreeBSD, NetBSD, Solaris, Windows, bare-metal, etc.), automatically selects the appropriate image based on the --target flag, mounts the project source and toolchain, and runs cargo build/test inside the container. The tool also supports remote Docker execution, custom Dockerfiles, and advanced configuration via Cross.toml and environment variables. The codebase is structured as a Rust CLI with two binaries (cross and cross-util), a library of container orchestration modules, and a developer xtask workspace for CI, codegen, and changelog management. It demonstrates strong engineering practices with extensive CI, testing, and reusable patterns for command execution, container abstraction, and configuration merging. The repository includes a large collection of Dockerfiles and shell scripts for building target-specific toolchain images, as well as CI workflows that test across many platforms and container engines.
MCSManager is a distributed game server management platform with a panel-daemon architecture. The Panel provides a web-based UI (Vue 3 + Ant Design Vue) and a Koa.js backend for user management, authentication (including SSO/OIDC/OAuth2, 2FA, API keys), and orchestration. The Daemon agents run on server machines and manage game server instances (Minecraft, Steam, etc.) as processes or Docker containers, providing file management, terminal access (WebSocket + PTY), mod/plugin management, scheduled tasks, and resource limiting. Communication between Panel and Daemon uses HTTP REST and Socket.IO for real-time instance I/O. The system supports auto-update, i18n (12 languages), and a drag-and-drop dashboard layout. The monorepo includes shared libraries (common), backend services (panel, daemon), and a Vue 3 frontend, with extensive integration tests that boot real processes.
This repository provides a comprehensive shell script (`install-php-extensions`) that automates the installation of PHP extensions in official Docker PHP images (both Alpine and Debian variants). The script handles dependency resolution, version pinning, source-based compilation, and cleanup of build artifacts. It supports over 160 extensions, including those bundled with PHP source, PECL packages, and proprietary agents (New Relic, Blackfire, Datadog). The repo also includes a structured compatibility database (`data/supported-extensions`, `data/dependencies.json`) that tracks extension-to-PHP-version mappings, library version pins, and detection mechanisms. CI workflows automatically test extension installation across a large matrix of PHP versions and distros, and a daily update checker monitors new releases and runs tests, notifying maintainers via Telegram if issues arise. The project is a developer utility, not a service or library, and is distributed as a Docker image and standalone script.
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
docker-gen is a Go CLI tool that generates configuration files from Docker container metadata using Go templates. It connects to the Docker daemon, lists containers based on configurable filters (exposed ports, labels, etc.), and renders templates with container data (IPs, ports, environment variables, labels, networks). The generated output can be written to files or stdout, and docker-gen can notify services by running commands or sending signals to containers when the output changes. It supports watching Docker events for automatic regeneration with configurable debouncing. The architecture is a single binary with well-separated internal packages: config parsing, Docker client abstraction, container context extraction, template engine with custom functions (filtering, grouping, sorting, nginx-specific quoting/HSTS validation), and a generator that orchestrates event listening, signal handling, and file generation. The codebase is mature, extensively tested, and demonstrates high craftsmanship in its generic template helper functions (deepGet, where, groupBy, sortBy) which are reusable beyond this project. It is primarily used as part of the nginx-proxy ecosystem to auto-generate reverse proxy configurations, but can be adapted for any file generation from Docker metadata.
Docker Buildx is a Docker CLI plugin that extends the native `docker build` command with advanced BuildKit capabilities. It provides a rich command surface for multi-platform builds, declarative bake files (HCL/JSON/Compose), cache management, image attestations and provenance, policy-based source verification (OPA/Rego), and interactive debugging via a Debug Adapter Protocol (DAP) server. The architecture is driver-based, supporting local Docker, Docker containers, Kubernetes, remote TCP/Unix sockets, and a cloud driver. The codebase is written in Go and follows a modular structure with clear separation between CLI commands, build orchestration, driver implementations, policy evaluation, and utility packages. It includes an extensive integration test suite and CI pipelines that test across multiple BuildKit and Docker versions.
Mediary Scout is a self-hosted media acquisition system that automates the discovery, transfer, and organization of media files from various cloud storage providers (such as 115, Quark, Tianyi, etc.) into the user's own storage. It features an agent-driven workflow powered by LLMs to decide acquisition steps, a web interface (Next.js) and desktop client (Electron) for management, and background workers for processing tasks. The system includes remote access via Cloudflare Tunnels (through the scout-connect service) with subscription management (Alipay payments), and supports both single-user and multi-user modes with a demo option for demonstration.
Comet is a production-grade Stremio add-on (and Kodi plugin) that functions as a high-performance torrent and debrid streaming proxy. It aggregates torrent metadata from 15+ indexers (Torrentio, Jackett, Prowlarr, Nyaa, DMM, etc.), caches results intelligently, and optionally shares discovered metadata across a custom P2P network (CometNet). The architecture is a FastAPI web server with multiple background workers for proactive scraping, metadata enrichment (TMDB, Kitsu, Cinemeta), debrid account syncing, and automated DMM hashlist ingestion. It provides a built-in streaming proxy with per-IP bandwidth controls, an admin dashboard for monitoring and control, and integrates with Prowlarr/Radarr/Sonarr via Torznab. The codebase is well-structured with comprehensive test coverage, Pydantic validation throughout, async-first patterns, and a clean scraper abstraction layer. It is actively maintained with frequent commits and a mature feature set, though the CometNet P2P component remains experimental and some external scrapers may be fragile due to Cloudflare protections.
Traefik is a cloud-native reverse proxy and API gateway that dynamically configures itself from various service discovery backends (Docker, Kubernetes, Consul, etc.). It provides HTTP, TCP, and UDP routing, load balancing, TLS termination, ACME certificate management, a rich middleware chain (auth, rate limiting, compression, headers, etc.), observability (metrics, tracing, access logs), and a plugin system (Yaegi and Wasm). The project is written in Go with a React-based web UI. It supports Kubernetes CRDs (IngressRoute, Middleware, etc.) and the Gateway API. It has extensive integration tests and is actively maintained. The architecture is modular with clear provider interfaces, a configuration watcher that merges dynamic configs from multiple sources, and a hot-swappable handler for live updates.
Dokku is a production-grade, self-hosted Platform as a Service (PaaS) that manages the full lifecycle of containerized applications. Its architecture is a plugin-based monolith orchestrated by a core Go binary, where every feature (builders, schedulers, proxies, storage, config) is a self-contained plugin that hooks into lifecycle triggers (plugn system). It supports deployment via git push, archives, or Docker images, and can schedule containers locally via Docker or on Kubernetes clusters via its k3s scheduler. The codebase demonstrates high craftsmanship in its plugin architecture and state management. The `common` plugin provides a robust property store, parallel execution engine, and safe command execution utilities that are used across all plugins. The `scheduler-k3s` plugin is a standout, featuring a custom Helm diff engine for previewing infrastructure changes and complex Helm chart generation for Kubernetes resources. The `storage` and `docker-options` plugins contain well-structured parsers for their respective domain-specific languages. While the core Go code is well-structured and heavily tested (Go unit tests, BATS integration tests), the codebase has medium technical drift. The extensive use of shell scripts for plugin triggers introduces fragility, and the Kubernetes scheduler hardcodes specific versions of external tools (cert-manager, KEDA, Traefik) that require manual updates. Despite this, the project is actively maintained with frequent releases, comprehensive migration guides, and a clear deprecation policy, making it a strong example of a long-lived open-source PaaS.
OpenEBS is a CNCF sandbox project providing container-native persistent storage for Kubernetes. This repository is the project's coordination hub: it contains the umbrella Helm chart for deploying OpenEBS (LocalPV hostpath/LVM/ZFS and Mayastor replicated engines), the kubectl-openebs plugin binary for inspecting and managing volumes and nodes, and the openebs-upgrade job for Helm-based upgrades and Mayastor data-plane rolling restarts. It also houses the OpenEBS Enhancement Proposals (OEPs), CI/CD workflows, and release automation. The repo is primarily an application repository rather than a data/research repository; its many markdown design documents are engineering proposals, not analysis artifacts. The main entry points are plugin/src/main.rs, openebs-upgrade/src/bin/upgrade-job/main.rs, and charts/Chart.yaml. The upgrade path uses trait-based Helm upgraders and Kubernetes pre-upgrade hooks, while the plugin dispatches engine-specific operations through a common Operations enum. Externally, it depends on the Kubernetes API, Helm, and several engine submodules/repositories (Mayastor, localpv-lvm, localpv-zfs). Maintenance is active: the last commit is recent, Dependabot is configured, and the CI pipeline includes linting, image building, Trivy scanning, and release workflows. Technical drift is low overall, though the project's reliance on git submodules and Nix-pinned dependencies creates coordination risk across the broader OpenEBS ecosystem.
Buildah is a command-line tool for building OCI-compliant container images without requiring a daemon. It focuses on image creation tasks such as building from Dockerfiles/Containerfiles, managing working containers, committing images, and pushing/pulling to registries. The architecture is modular, separating CLI command handling (using Cobra), core build logic, storage abstraction, and utility packages. Key features include rootless operation, multi-platform support (Linux/FreeBSD), SBOM generation, and confidential workload encryption via SEV/SNP. The tool is designed for integration with container ecosystems like Podman and Kubernetes, emphasizing security and flexibility in image building workflows.
Tandoor is a self-hosted, multi-tenant recipe management web application. The system is a monolithic Django application (cookbook app) exposing a Django REST Framework API, paired with a Vue 3 + Vuetify single-page frontend that consumes an auto-generated TypeScript OpenAPI client. Core production domains, verified in code, are: structured recipes (steps, ingredients, scaling), a tree-based hierarchical food database with nutritional properties and USDA FDC IDs, meal planning with iCal export, shopping lists with supermarket categories and offline sync queues, inventory/pantry booking, cookbooks, share links, and view/cook logging. Tenancy is enforced through Space/Household/UserSpace models with django-scopes middleware and granular guest/user/admin permission classes rather than through database row-level security. The largest subsystem is recipe import/export: an abstract Integration base class with 20+ adapters for other recipe managers (Paprika, Mealie, Cooklang, Gourmet, ChefTap, etc.), URL scraping via recipe-scrapers/microdata/pytubefix, cloud storage sync providers (Dropbox, Nextcloud, WebDAV, local), a bulk open-data importer for USDA-derived reference foods/units/conversions, and an embedded PDF.js viewer for external recipe files. A connector/event layer dispatches async updates to external services such as Home Assistant, a Telegram bot webhook writes shopping list entries, and recent AI features (litellm-based, per-space credit tracked) handle image/PDF recipe import, step sorting, and nutrition extraction. Background work is done via threads rather than a task queue. Craftsmanship is above average: clean abstract patterns (Integration, Provider, Connector ABCs), chainable queryset managers, mixin-based permission/merge/tree logic, a strong permission-matrix test suite, and genuinely reusable helper algorithms (BFS unit conversion, ingredient parsing, Cooklang parsing). However, the codebase carries notable debt: 240+ migrations with heavy schema churn, a ~3000-line monolithic api.py view file, committed auto-generated OpenAPI client code that can drift, vendored PDF.js binaries, some tests that suppress tenant scoping via scopes_disabled, and copy-paste duplication inside the open-data importer. Overall it is a well-maintained, actively developed application with solid architecture for its scale.
AutoBangumi is a fully automated anime download and organization tool. It subscribes to RSS feeds (Mikanani, etc.), downloads torrents via qBittorrent or Aria2, parses release titles to extract episode/metadata, renames and organizes files for media libraries (Plex, Jellyfin), and provides a web UI for management. The backend is a FastAPI application with async SQLite storage, background schedulers, and a multi-provider notification system. The frontend is a Vue 3 + TypeScript single-page app with a custom component library. The architecture employs clean abstraction layers for downloaders, notification providers, and LLM-based title parsing, with a state machine for durable rename operations and a secure online update mechanism. It is a well-engineered application with extensive test coverage (unit, integration, E2E with Playwright) and active development reflected in frequent releases and a robust CI pipeline.
This repository implements a Caddy plugin that dynamically generates Caddy reverse proxy configurations from Docker container and Swarm service labels. It runs as a Caddy module, monitoring Docker events and polling Docker APIs to produce an in-memory Caddyfile, then loading it into Caddy with zero-downtime reloads. The system supports three operational modes: standalone (controller and server in one process), controller (generates config and pushes to remote Caddy servers via admin API), and server (receives config remotely). The core architecture comprises a Docker client abstraction, a Caddyfile generator that translates Docker labels into Caddyfile blocks, and a loader that manages event-driven updates. The codebase is well-structured with clear separation of concerns, extensive unit tests, and integration test suites using Docker Compose stacks. It demonstrates solid engineering practices with modular packages, concurrent-safe state management, and thorough error handling.
EasyNode is a full-stack server management panel that provides a unified web and native interface for remote Linux server administration. The system offers SSH terminal access, SFTP file management, Docker container control, RDP remote desktop, batch script execution, and an AI agent powered by large language models. The AI agent can execute commands, read/write files, and manage hosts with configurable safety and approval workflows, including context compression and MCP tool discovery. The backend is a Node.js (Koa) monolith with an embedded NeDB database, serving a Vue 3 single-page application and a Flutter cross-platform native app (Android, iOS, macOS, Linux, Windows, HarmonyOS). The architecture is a monorepo with three main packages: server, web, and native. The server handles REST API and WebSocket connections for real-time terminal, SFTP, Docker, server monitoring, and AI agent interactions. The web frontend uses Element Plus, xterm.js, and Monaco editor, while the native app uses Riverpod, dartssh2, and re_editor. Both clients share a common feature set including authentication (RSA-encrypted passwords, MFA), proxy/jump host support, IP access control, notification integrations, and a Plus subscription model for premium capabilities. The codebase demonstrates high engineering craftsmanship with well-separated concerns, reusable utility modules (command safety classification, shell lexer, terminal highlighter, rate limiter, database wrapper), and comprehensive test coverage for both server and client components. The AI agent subsystem is particularly notable for its pluggable safety rules, context compaction, and MCP client architecture. While the monorepo is large and some duplication exists between web and native implementations, the overall design is modular and maintainable, with active CI/CD pipelines and regular releases.
Authorizer is a self-hosted, production-grade authentication and authorization server written in Go. It implements OAuth 2.0 / OIDC, SAML IdP/SP, SCIM 2.0, WebAuthn/passkeys, TOTP, email/SMS OTP, and fine-grained authorization via an embedded OpenFGA engine. The architecture is transport-agnostic: a shared service layer (internal/service) is called by GraphQL resolvers, gRPC handlers, and HTTP handlers (Gin). It supports multiple storage backends (SQL, MongoDB, Cassandra, DynamoDB, Couchbase, ArangoDB) via a unified storage.Provider interface, plus Redis and in-memory stores for sessions and caching. The system includes a React admin dashboard, an end-user login SPA, and an MCP (Model Context Protocol) server for AI tool exposure. Security is a primary focus, with extensive regression tests for CVEs, SSRF protection, constant-time comparisons, and audit logging.
Podsync is a Go-based service that converts video/audio content from YouTube, Vimeo, SoundCloud, and Twitch into podcast RSS feeds. It downloads media via yt-dlp, stores metadata in BadgerDB, and serves feeds via an HTTP server. The architecture is modular: platform-specific builders (pkg/builder/) query APIs to discover episodes, a downloader (pkg/ytdl/) handles media retrieval, and a feed generator (pkg/feed/) produces iTunes-compatible RSS and OPML. The system supports cron-based scheduling, episode filtering by regex/duration/age, cleanup policies, API key rotation, and hooks for custom workflows. It runs as a standalone binary or Docker container with local or S3 storage.
tsbridge is a production-grade reverse proxy that exposes multiple backend services on a Tailscale tailnet using isolated tsnet nodes per service. It supports static TOML configuration and dynamic Docker label discovery, with hot-reload, graceful shutdown, Prometheus metrics, and a composable middleware chain (access log, whois identity lookup, request ID, body size limits, header sanitization). The architecture is a single Go binary that manages per-service tsnet.Server instances, each with its own state directory and listener. External dependencies are Tailscale (tsnet), Docker (optional), and Prometheus. The codebase demonstrates strong engineering practices: interface-based abstractions (TSNetServer, config.Provider), typed error hierarchy, secret resolution with redaction, debounced event handling with exponential backoff, and comprehensive unit and integration tests. It is actively maintained with CI/CD, dependabot, and regular dependency updates.
Harness Gitness is an open-source DevOps platform that provides Git hosting, CI/CD pipelines, artifact registries, and cloud development environments (Gitspaces). The system is built as a monolithic Go backend with a React/TypeScript frontend, using Google Wire for dependency injection and supporting both PostgreSQL and SQLite databases. Key entry points include the main server binary (`cmd/gitness`), REST API handlers organized by resource (repos, pull requests, spaces, pipelines, gitspaces, registries), and a CLI for administrative tasks. The architecture follows a layered pattern: HTTP handlers → controllers → services → stores, with an event-driven subsystem for asynchronous processing (pull requests, checks, gitspace lifecycle, merge queues). External dependencies include Drone runner libraries for pipeline execution, Docker API for container orchestration, and cloud provider SDKs (AWS, GCP) for infrastructure provisioning. The artifact registry is based on a fork of Harbor and supports OCI, Maven, npm, NuGet, Python, Helm, RPM, and other package formats. The frontend is modular, with separate codebases for the core Git UI, artifact registry (AR), and CDE (Gitspaces), using Harness UI components and custom factories for extensible package-type rendering.