Before DevOps, developers wrote code and handed it to a separate operations team to run. The handoff slowed releases and split responsibility: developers were measured on change, operations on stability. DevOps removes that wall. The same team, or teams working closely together, build, ship and run the software, with automation doing the repetitive work.
Core practices
- Continuous integration (CI): developers merge small changes often, and every change is built and tested automatically.
- Continuous delivery and deployment (CD): every change that passes the pipeline can be released, and in continuous deployment it is released automatically.
- Infrastructure as code: servers, networks and configuration are defined in version-controlled files with tools such as Terraform, CloudFormation or Ansible.
- Monitoring and observability: metrics, logs and traces from production show how each change behaves. See continuous monitoring.
- Incident management: clear on-call ownership and blameless postmortems. See incident management.
The DevOps lifecycle
The lifecycle is usually drawn as an infinity loop: plan, code, build, test, release, deploy, operate, monitor, and back to plan. The monitor stage is what makes it a loop. Without production feedback, teams ship faster but can't tell whether things got better.
Measuring DevOps: the DORA metrics
The DORA research program (DevOps Research and Assessment, now part of Google Cloud) found four measures that separate high-performing teams:
- Deployment frequency: how often you release to production.
- Lead time for changes: how long a commit takes to reach production.
- Change failure rate: the share of deployments that cause a failure in production.
- Time to restore service: how long it takes to recover when one does.
The first two measure speed and the last two measure stability. The research found that strong teams improve both together rather than trading one for the other.
DevOps, SRE and DevSecOps
Site reliability engineering (SRE), which started at Google, is one concrete way to practice DevOps: it uses service level objectives and error budgets to decide when to ship features and when to work on reliability. DevSecOps adds security checks, such as dependency scanning and policy checks, to the same pipeline instead of leaving them to a final review.
DevOps with Atatus
Atatus supports the operate and monitor stages. APM tracks each deployment and compares performance before and after it, alerting includes SLO burn-rate alerts and routes incidents to Slack, PagerDuty, Jira and other tools, and AI SRE helps find the cause when something breaks. Further reading: DevOps best practices and DevOps monitoring tools.