Concepts

Coming from Octopus Deploy? The mapping is noted per concept.

Project

One app you build and deploy. Owns its environments, targets, process, releases, variables, triggers, and runbooks. (Octopus: project.)

Environment

A place you deploy to — Dev, Staging, Prod — in promotion order. Production environments get stricter defaults: env-scoped deploy permission, success-email defaults, freeze/window enforcement (coming). Deploys to one environment run one at a time, queued FIFO. (Octopus: environment.)

Target

A machine or endpoint a step runs against: ssh, kubernetes, cloud, file, local. Tagged with roles (app, db) that steps select; a step with target roles runs once per matching target with $TARGET_* env vars. Connectivity is probe-verified with gathered facts. (Octopus: deployment target.)

Process & steps

The ordered steps a deploy executes. Each step = a recipe + config, optional target roles, environment pinning, run condition (always / on_success / on_failure), a stage number (same stage → parallel), approval gating, and allow-failure. (Octopus: deployment process.)

Release

An immutable snapshot of the process + variables, versioned YYYY.MM.DD.N, optionally on a named channel. Deploys always run exactly what was cut — editing the process never changes an existing release. (Octopus: release + channel.)

Deployment

One run of a release into an environment: queued → running → succeeded/failed/cancelled (or paused awaiting approval). Live logs stream as it runs; everything is audited (who deployed, approved, changed config — see /app/audit).

Runner

The agent that executes steps — on our managed runners or self-hosted on your machines (Linux, OpenBSD, FreeBSD, macOS, Windows). Untrusted build steps are isolated by default: docker on Linux, vmm/bhyve VMs on the BSDs, Tart VMs on macOS, Windows containers. Runners auto-update via signed releases. (Octopus: worker + Tentacle.)

Variables

Key/values scoped by environment, tenant, and channel — most-specific wins; sensitive values are encrypted at rest and masked in logs. Frozen into each release. A value may also be an external-secret reference (ref:vault:…, ref:aws-sm:…, ref:gcp-sm:…, ref:azure-kv:…, ref:sops:…) — fetched on the runner at deploy time and never stored here. (Octopus: variables + scopes.)

Runbook

A saved, parameterized ops task (restart a service, rotate a cert) run on demand against an environment — no release needed, same engine, live logs, RBAC'd (admin-only runbooks for the dangerous ones). (Octopus: runbook.)