DevOps & Deployment Skill
Comprehensive frameworks for CI/CD pipelines, containerization, deployment strategies, and infrastructure automation.
Note: If disableSkillShellExecution is enabled (CC 2.1.91), the Docker install check won't run. Verify Docker is available for container operations: docker --version.
Overview
- Setting up CI/CD pipelines
- Containerizing applications
- Deploying to Kubernetes or cloud platforms
- Implementing GitOps workflows
- Managing infrastructure as code
- Planning release strategies
Pipeline Architecture
โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ
โ Code โโโ>โ Build โโโ>โ Test โโโ>โ Deploy โ
โ Commit โ โ & Lint โ โ & Scan โ โ & Release โ
โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ โโโโโโโโโโโโโโโ
โ โ โ โ
v v v v
Triggers Artifacts Reports Monitoring
Key Concepts
CI/CD Pipeline Stages
- Lint & Type Check - Code quality gates
- Unit Tests - Test coverage with reporting
- Security Scan - npm audit + Trivy vulnerability scanner
- Build & Push - Docker image to container registry
- Deploy Staging - Environment-gated deployment
- Deploy Production - Manual approval or automated
Container Best Practices
Multi-stage builds minimize image size:
- Stage 1: Install production dependencies only
- Stage 2: Build application with dev dependencies
- Stage 3: Production runtime with minimal footprint
Security hardening:
- Non-root user (uid 1001)
- Read-only filesystem where possible
- Health checks for orchestrator integration
Kubernetes Deployment
Essential manifests:
- Deployment with rolling update strategy
- Service for internal routing
- Ingress for external access with TLS
- HorizontalPodAutoscaler for scaling
Security context:
runAsNonRoot: trueallowPrivilegeEscalation: falsereadOnlyRootFilesystem: true- Drop all capabilities
Deployment Strategies
| Strategy | Use Case | Risk |
|---|
| Rolling | Default, gradual replacement | Low - automatic rollback |
| Blue-Green | Instant switch, easy rollback | Medium - double resources |
| Canary | Progressive traffic shift | Low - gradual exposure |
Rolling Update (Kubernetes default):
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 25%
maxUnavailable: 0
Secrets Management
Use External Secrets Operator to sync from cloud providers:
- AWS Secrets Manager
- HashiCorp Vault
- Azure Key Vault
- GCP Secret Manager
References
Docker Patterns
Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/docker-patterns.md")
Key topics covered:
- Multi-stage build examples with 78% size reduction
- Layer caching optimization
- Security hardening (non-root, health checks)
- Trivy vulnerability scanning
- Docker Compose development setup
OrchestKit Delta (house rules)
Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/ork-delta.md")
Key topics covered:
- CI concurrency groups, the sub-5-minute feedback budget, path filtering
- Service-container health gating, SHA-pinned deploys, CDN invalidation order
- Kubernetes probe budget, request/limit baseline, PodDisruptionBudget floor
- External Secrets refresh interval, ArgoCD prune plus selfHeal, Terraform state locking
- Alert thresholds with dwell windows, request-id log binding, rollback rehearsal
Railway Deployment
Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/rules/railway-deployment.md")
Key topics covered:
- railway.json configuration, Nixpacks builds
- Environment variable management, database provisioning
- Multi-service setups, Railway CLI workflows
- References:
${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/railway-json-config.md, ${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/nixpacks-customization.md, ${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/multi-service-setup.md
Deployment Strategies
Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/deployment-strategies.md")
Key topics covered:
- Rolling deployment (
maxUnavailable / maxSurge)
- Blue-green deployment (service-selector switch and rollback)
- Canary releases (replica-ratio traffic split)
Upstream coverage (do not restate)
This skill wraps third-party products. Vendor mechanics are not restated here; fetch them from the
source below. Where a row says "house subset stays in X", that file keeps only OrchestKit's
threshold, config or ordering decision, not the vendor tutorial.
Deployment Checklist & Templates
Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/checklists-and-templates.md") for pre/during/post-deployment checklists, Helm chart structure, template reference table, and extended thinking triggers.
Related Skills
ork:security-patterns - Security scanning and hardening patterns for CI/CD pipelinesork:monitoring-observability - Prometheus, Grafana and alerting for deployed applicationsork:database-patterns - Python/Alembic migration workflow for backend deploymentsportless (upstream) - Named .localhost URLs for multi-service local dev (portless alias api 8080)
Key Decisions
| Decision | Choice | Rationale |
|---|
| Container user | Non-root (uid 1001) | Security best practice, required by many orchestrators |
| Deployment strategy | Rolling update (default) | Zero downtime, automatic rollback, resource efficient |
| Secrets management | External Secrets Operator | Syncs from cloud providers, GitOps compatible |
| Health checks | Separate startup/liveness/readiness | Prevents premature traffic, enables graceful shutdown |
Capability Details
Load: Read("${CLAUDE_PLUGIN_ROOT}/skills/devops-deployment/references/capability-details.md") for full keyword index and problem-solution mapping across all 6 capabilities (ci-cd, docker, kubernetes, infrastructure-as-code, deployment-strategies, observability).
