Automic VaultAutomic Vault

brew

Install werf with Homebrew, Nix, zypper

Consistent delivery tool for Kubernetes. Version 2.72.2 via Homebrew; verified 2026-07-02.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install werf

local Homebrew formula metadata

Linux

Nixverified · 92%
nix profile install nixpkgs#werf

nixpkgs package indexes · pkgs/by-name/we/werf/package.nix · source: api.github.com

openSUSE zypperverified · 92%
sudo zypper install werf

openSUSE Tumbleweed package metadata · werf · source: download.opensuse.org

overview

Package summary

Consistent delivery tool for Kubernetes

Commands and aliases

  • werf

history

Project history and usage

werf is a Kubernetes delivery CLI from the Flant ecosystem and a CNCF Sandbox project. The project describes itself as a full-cycle CI/CD tool that glues together Git, Dockerfile or Buildah image building, Helm-style deployment, Kubernetes, and a user's existing CI system.

Project history

The project began in January 2016 under the earlier `dapp` name, before Kubernetes deployment became central to its identity. The official tenth-anniversary history describes the starting point as an experiment in incremental Docker image building that later grew into an open source delivery ecosystem for Kubernetes applications.

In March 2017, dapp gained Kubernetes deployment via Helm charts, shifting the tool from image building toward end-to-end application delivery. The public GitHub repository dates to January 2016, and werf's own retrospective groups the pre-2019 period as the dapp and early werf era before the v1 line.

werf v1 covered the December 2018 through March 2020 transition, while the v1.1 and v1.2 eras added production-oriented behavior such as content-based tagging, distributed layer storage, bundles, and increasingly reproducible deployment artifacts. In May 2023, the project began moving away from its Helm fork toward Nelm, a Helm-compatible deployment engine developed as part of the broader werf ecosystem.

On December 13, 2022, CNCF accepted werf at Sandbox maturity. That gave the project formal cloud-native foundation status and framed it as a community project rather than only a vendor-maintained delivery tool.

Adoption history

werf's README says it has been used in production since 2017 and that thousands of projects rely on it. The 2026 anniversary post gives a more concrete ecosystem snapshot: 4600+ GitHub stars, 1300+ releases, 18,000+ active projects using werf, 15,000+ commits, 60+ contributors, and 6000+ merged pull requests.

Its adoption pattern is strongest among teams that want CI/CD behavior in Git but do not want to replace their existing CI service. werf is designed to run inside GitLab CI, GitHub Actions, or other CI systems while owning the build, publish, deploy, tracking, and cleanup parts of a Kubernetes release.

How it is used

A typical werf project keeps a `werf.yaml` file in the source tree and lets the CLI build container images, publish them to a registry, deploy Helm-compatible charts to Kubernetes, track rollout status, and clean old artifacts. This makes werf closer to an application delivery orchestrator than a single-purpose image builder.

In package terms, werf matters because it packages several common cloud-native primitives into one repeatable CLI workflow. That role also explains its related projects: Nelm for Helm-compatible deployment, trdl for update channels, kubedog for Kubernetes rollout tracking, and lockgate for synchronization.

Timeline

  • January 2016: project starts as dapp, focused on incremental Docker image building.
  • March 2017: Kubernetes deployment via Helm becomes part of the tool.
  • December 2018-March 2020: the v1 era establishes the werf identity.
  • March-April 2020: content-based tagging and distributed layer storage improve image handling in concurrent CI environments.
  • November 2020-April 2024: the v1.2 era adds bundle-oriented distribution and broader production delivery behavior.
  • December 13, 2022: werf joins CNCF as a Sandbox project.
  • May 2023: the deployment subsystem begins the move away from a Helm fork toward Nelm.
  • April 2024 onward: werf v2 begins, with ongoing ecosystem work around Nelm and delivery tooling.

security posture

Risk level: orange

infrastructure mutation or orchestration signal.

Risk classifier

orange risk · medium confidence · infrastructure

Why

  • infrastructure mutation or orchestration signal

Signals

  • text:kubernetes

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.
  • Build metadata lists 1 build dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Configuration files

Config paths the tool may read or write during local use.

Unix
werf.yaml

Credential files

Credential-bearing paths to review before unattended agent runs.

Unix
~/.werf/global_secret_key.werf_secret_key

executables

Installed executables

CommandKindExposureNote
werfcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version2.72.2
manager updated2026-07-02
local dataok
upstreamcurrent
latest detectedv2.72.2

https://github.com/werf/werf

  • okNo freshness warnings were generated.

install metadata

Package metadata

Package keybrew:werf
Version2.72.2
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/werf
Homepagehttps://werf.io/
Repositoryhttps://github.com/werf/werf
Upstream docshttps://werf.io/docs
LicenseApache-2.0
Source archivehttps://github.com/werf/werf/archive/refs/tags/v2.72.2.tar.gz
Last updated2026-07-02T12:13:46Z
Pulseupdated
Build dependenciesgo
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Namewerf
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyno
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

werf

nix profile install nixpkgs#werf
  • normalized package name match
  • Matched by: Werf
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/we/werf/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
zypper95%

werf 2.68.2-1.1

CLI for the Werf CI/CD system

https://github.com/werf/werf

sudo zypper install werf
  • License: Apache-2.0
  • Category: Unspecified
  • Architecture: x86_64
  • Source Package: werf
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

werf-bash-completion 2.68.2-1.1

Bash Completion for werf

https://github.com/werf/werf

sudo zypper install werf-bash-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: werf
  • 2 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf-bash-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

werf-fish-completion 2.68.2-1.1

Fish Completion for werf

https://github.com/werf/werf

sudo zypper install werf-fish-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: werf
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf-fish-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst
zypper95%

werf-zsh-completion 2.68.2-1.1

Zsh Completion for werf

https://github.com/werf/werf

sudo zypper install werf-zsh-completion
  • License: Apache-2.0
  • Category: System/Shells
  • Architecture: noarch
  • Source Package: werf
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Werf
openSUSE Tumbleweed package metadata · download.opensuse.org · openSUSE Tumbleweed package metadata: werf-zsh-completion from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • goBuild dependency declared by Homebrew.

Same workflow

  • helmShares av.db curated category or tags: cli, cloud-infrastructure, deployment, kubernetes.
  • helmfileShares av.db curated category or tags: cli, cloud-infrastructure, deployment, kubernetes.
  • helmsmanShares av.db curated category or tags: cli, cloud-infrastructure, deployment, kubernetes.
  • koShares av.db curated category or tags: cli, cloud-infrastructure, deployment, kubernetes.
  • kraneShares av.db curated category or tags: cli, cloud-infrastructure, deployment, kubernetes.
  • nelmShares av.db curated category or tags: cli, cloud-infrastructure, deployment, kubernetes.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated configuration and credential file locations
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment