Deploy, and always know what runs where.

EJO runs your build, test, scan and deploy pipelines on agents inside your own network. See at a glance which commit is in which environment.

Kubernetes · Docker · GitHub · GitLab · Azure DevOps

9fceb02fix: hide the checkout button when the cart is emptyacme/shop · main · Ayşe
Build
Test
Scan and sign
Staging
Production
imageshop:9fceb02
sha256:4e1a…c09d
test report412 passed · 1 flaky
coverage 81%
trivy · cosign0 critical, 2 high
signed · SBOM attached
staging2/2 pods ready
error rate 0.2% · p95 180ms
approvalWaiting for Mehmet's approval
ApproveReject

Start with ready-made pipelines

Docker, Maven, Helm or a preview per PR. Pick a template and bind it to your repo; parallel steps run at the same time, and the pipeline waits where an approval is needed.

checkoutgit
unit testshell
lintshell
image builddocker
trivy scanscan
SBOMsbom
cosignsign
stagingdeploy
prod approvalapproval
productiondeploy
RunningFinishedAwaiting approvalNot started

The service catalog builds itself

You add a small .ejo file to each repo. EJO reads it, combines it with real deployments and fills in the service card itself.

acme/shop / .ejo
name: shopdescription: Acme store and cartowner: group:team-checkoutenvironment: stagingpipeline: { file: ci/ejo.yaml }consumes: [{ api: payments }]oncall: { pagerduty_service: PSHOP01 }# last deploy and health come from deployments

shop healthy

Description—
Owned by—
Environment—
Pipeline—
APIs it uses—
On-call—
Last deploy9fceb02 · production · 4 min ago

The agent runs in your network, no ports to open

The agent pulls jobs from the master itself; the agent always starts the connection. Secrets and source code never leave your network.

Your networkno open inbound portsk8s clustershop, paymentsejo-agentk8s-prod-5b2f · onlinevault://shop/db-password → only the agent reads itEJO masteracme.ejocloud.comjob queue · logs · approvalsoutbound HTTPS (443)
No firewall rulesThe agent only connects outward, on port 443.
One-command installThe kubectl apply or docker run command the console gives you.
No static keysSteps get cloud and vault access with a short-lived OIDC token.

Which version runs in which environment, on one screen

For every service you see the image running in each environment. When you promote, the same image moves to the next environment; nothing is rebuilt.

devdocker · 1 agent
shop9fceb02
paymentsc41e7aa
stock77c2d10
stagingk8s · 2 agents
shop9fceb02
paymentsc41e7aa
stock77c2d10
productionk8s · approval required
shop1f0aa3e
paymentsc41e7aa
stock77c2d10

In production, shop is 3 commits behind staging

Common questions

Do I have to give up my current CI tool?

No. You can run builds and tests in EJO too, or keep your existing CI and leave only deploy and the catalog to EJO.

Will I have to learn a new template language?

No. You build pipelines with a form, and variables like {{.ShortSHA}} show an example value next to them.

Where does my code actually run?

On agents in your own network. EJO Cloud only keeps the job queue, logs and approvals.

Can I install it on my own servers?

Yes. Install the master on your own infrastructure with the Helm chart or the offline install bundle.

Make your first deployment today

Start for free Quickstart