(tongue in cheek — we don't hate devops. devops is just hard.)
A Claude Code skill that quietly injects 10 atomic DevOps best practices into every session. Ask for a Dockerfile, get secure Chainguard base images, a multi-stage build, and a non-root user — without asking. Ask for a CI pipeline, get SHA-pinned actions and least-privilege tokens.
Website: ihatedevops.com (source in site/)
curl -fsSL https://raw.githubusercontent.com/zenconnor/ihatedevops/main/install.sh | shThat copies one folder into ~/.claude/skills/ — nothing else, ever. Your next
Claude Code session picks it up automatically. Uninstall:
rm -rf ~/.claude/skills/devops-best-practices.
- Chainguard base images by default —
cgr.dev/chainguard/*: minimal, non-root, near-zero CVEs, free - Multi-stage builds, non-root user — build tools never reach the final image
- Pin everything — lockfiles, image digests, GitHub Actions by commit SHA
- Least-privilege CI tokens — explicit
permissions: contents: read - No secrets in code, images, or logs — OIDC over long-lived keys
- Health checks + rollback-ready deploys —
/healthz, one-step revert - Plan before apply — read the IaC diff; never hand-edit live infra
- Structured logs with levels — JSON events, not
print("here 2") - Fail fast, cache hard in CI — lint before build before test
- Small, frequent, reversible releases — boring deploys are the goal
Full rules with examples: skills/devops-best-practices/SKILL.md
tests/run_tests.sh # unit (skill + site) and integration (installer)
tests/run_tests.sh --e2e # + end-to-end: headless claude run must apply the practicesThe e2e test installs the skill into a scratch project, asks a headless
claude -p for a Dockerfile, and asserts the output uses Chainguard images and
multi-stage/non-root patterns (with a no-skill control run for comparison).
GPL-3.0 — © 2026 SentryStack Inc.
Works in OpenAI Codex too (open Agent Skills standard):
copy skills/devops-best-practices/ into ~/.agents/skills/.