What is DOTkit
DOTkit is an Ops Toolkit It is a catalog of verified infrastructure components and a command-line tool, dotkit, that scaffolds, provisions and wires them. You describe your application once in a Score file, pick the components it needs, and run dotkit up. Your machine needs Docker and Node; OpenTofu and every cloud tool run inside containers.
The problem it removes
Every team that ships an app needs the same twenty things: a container runtime, a bucket, a database, logs and traces, secrets that don't leak, a URL. Every team rebuilds them, slightly wrong, on every cloud. The work is not hard; it is guesswork, repeated.
Who it is for
Developers with nobody doing ops. You never learn what an ALB target group is. score.yaml says "my container, port 3000, I need openobserve"; DOTkit does the rest and injects the endpoint into your container.
Ops and platform people. Scaffold a working baseline in minutes, hand it over, and stop answering the same questions. Everything generated is plain OpenTofu you can read, own and extend through inputs.
AI agents. An agent can write cloud HCL, and it will look right. It cannot promise the result works on your cloud today, and you pay tokens every time it regenerates and debugs it. Pointing the agent at a verified catalog turns generation into consumption: zero guesswork, no apply-time surprises, and far fewer tokens.
What a component is
A versioned, digest-pinned unit with a conformance test. Three kinds:
| kind | what it is | portable? |
|---|---|---|
| primitive | an OpenTofu module per (cloud, target): network, runtime, bucket, secret, postgres | the interface is; the implementation is per cloud |
| composed service | a manifest only (containers + required primitives): openobserve, umami | yes, everywhere the primitives exist |
| chart service | a Helm chart wrapper for Kubernetes-only tools (SigNoz-class) | Kubernetes only |
A component's outputs are wired into your containers through Score placeholders (${resources.obs.otlp_endpoint}). Sensitive outputs travel as platform secret references, never plain environment variables.
What it is not
- Not a platform you host (Coolify, Dokploy). Nothing of DOTkit keeps running after
up. - Not a new configuration language. Score in, OpenTofu out.
- Not Kubernetes-first. Serverless containers first; Kubernetes for the services that need it.
Claims are tiers
A component x cloud x target cell exists only when its conformance test is green: emulator-tested (MiniStack, on every merge) or cloud-tested (real account, nightly). Nothing else is listed on this site.
Status (2026-09)
| piece | state |
|---|---|
| Contract: input files, components, primitives, provider profiles | v2.5 frozen |
| Node -> Dagger -> OpenTofu -> MiniStack -> real ECS container | proven by a spike |
| CLI experience | designed; implementation in stream B |
Example app (examples/hello): the §2 workload and §7 fixture | published image, multi-arch |
| CLI, generator, runner | being built |
network, runtime, bucket, secret (aws/serverless), openobserve | being built |
| Providers | aws (emulator); Scaleway, GCP, Azure planned |
| Targets | serverless; Kubernetes planned |
This page changes in the same merge request as the code it describes.