Skip to content
GantryCD

What is GantryCD?

GantryCD is a CI/CD platform for OpenTofu. It turns a repository of OpenTofu configuration into a reviewable, auditable delivery pipeline: changes are planned automatically, a human approves, and GantryCD applies them on compute you control.

If you have ever wired together terraform plan in CI, a place to store state, a way to inject cloud credentials, and a Slack message asking someone to approve the apply — GantryCD is that, as one product you run yourself.

What it does for you

  • Plans on every change. Push to a tracked branch and GantryCD produces a plan. Open a pull request and GantryCD produces a preview plan against it.
  • Keeps a human in the loop. Plan and apply are separate steps. A plan with changes waits for an explicit confirmation before anything is applied.
  • Runs the work where you want. Execution happens on runner groups you operate — a local process, Docker, Kubernetes, or your existing GitHub Actions runners. GantryCD never needs its own fleet.
  • Hands out credentials that expire. State access, log uploads, and cloud provider access are all short-lived credentials minted when a run starts and invalid when it ends. No static cloud keys are stored on or shipped to a runner.
  • Controls who can do what. Single sign-on (GitHub, Google, or any OIDC provider) plus role-based access control, scoped per organization.

Who it’s for

  • Platform teams who want self-service infrastructure delivery without handing out admin credentials or maintaining a snowflake pipeline.
  • Developers who just want to push a change, read a plan, and click apply.
  • Operators who need an auditable, self-hosted system with no SaaS in the path to their cloud accounts.

How it compares

GantryCD occupies the same space as Terraform Cloud, Spacelift, or Atlantis, with three opinions that shape everything else:

OpinionWhat it means for you
Self-hosted, single binaryThe backend ships with the web UI embedded. You need PostgreSQL and an S3-compatible bucket — nothing else.
Bring your own runnersCompute is yours. The same job can run on a laptop, in a cluster, or on GitHub-hosted runners, selected by labels.
Ephemeral by defaultEach run is a fresh worker with its own short-lived credentials. There is no long-running agent holding standing access to your cloud.