This is an accepted version of this page
DevOps is the integration and automation ofsoftware development andinformation technology operations.[a] DevOps encompasses necessary tasks ofsoftware development and can lead to shortening development time and improving thedevelopment life cycle.[1] According to Neal Ford, DevOps, particularly throughcontinuous delivery, employs the "Bring the pain forward" principle, tackling tough tasks early, fostering automation and swift issue detection.[2]Software programmers andarchitects should usefitness functions to keep their software in check.[3]
Although debated,[b][c][d][e] DevOps is characterized by key principles: shared ownership, workflow automation, and rapid feedback.From an academic perspective,Len Bass, Ingo Weber, and Liming Zhu—three computer science researchers from theCSIRO and theSoftware Engineering Institute—suggested defining DevOps as "a set of practices intended to reduce the time between committing a change to a system and the change being placed into normal production, while ensuring high quality".[7]However, the term is used in multiple contexts. At its most successful, DevOps is a combination of specific practices, culture change, and tools.[8]
Proposals to combine software development methodologies with deployment and operations concepts began to appear in the late 80s and early 90s.[9]
In 2009, the first conference named DevOps Days was held inGhent, Belgium. The conference was founded by Belgian consultant, project manager and agile practitioner Patrick Debois.[10][11] The conference has now spread to other countries.[12]
In 2012, a report called "State of DevOps" was first published by Alanna Brown atPuppet Labs.[13][14]
As of 2014, the annual State of DevOps report was published byNicole Forsgren, Gene Kim, Jez Humble and others. They stated that the adoption of DevOps was accelerating.[15][16] Also in 2014, Lisa Crispin and Janet Gregory wrote the book More Agile Testing, containing a chapter on testing and DevOps.[17][18]
In 2016, theDORA metrics for throughput (deployment frequency, lead time for changes), and stability (mean time to recover, change failure rate) were published in the State of DevOps report.[13] However, the research methodology and metrics were criticized by experts.[19][20][21][22] In response to these criticisms, the 2023 State of DevOps report[23] published changes that updated the stability metric "mean time to recover" to "failed deployment recovery time" acknowledging the confusion the former metric has caused.[24]
DevOps Research and Assessment (DORA) has developed a series of metrics which are intended to measure software development efficiency and reliability. These metrics include:[25][26]
Many of the ideas fundamental to DevOps practices are inspired by, or mirror, other well known practices such asLean andDeming'sPlan-Do-Check-Act cycle, through toThe Toyota Way and theAgile approach of breaking down components and batch sizes.[27] Contrary to the "top-down" prescriptive approach and rigid framework ofITIL in the 1990s, DevOps is "bottom-up" and flexible, having been created by software engineers for their own needs.[28]
Platform engineering is an emerging discipline within software engineering that supports DevOps by building and maintaining internal developer platforms (IDPs). These platforms provide standardized tools and reusable components—such as CI/CD pipelines, infrastructure provisioning, observability, and security controls—to streamline software delivery and reduce the cognitive load on developers. The goal is to enable self-service capabilities, improve productivity, and ensure consistency across development and operations teams.[29][30]
The motivations for what has become modern DevOps and several standard DevOps practices such as automated build and test,continuous integration, andcontinuous delivery originated in the Agile world, which dates (informally) to the 1990s, and formally to 2001. Agile development teams using methods such asextreme programming couldn't "satisfy the customer through early and continuous delivery of valuable software"[31] unless they took responsibility for operations and infrastructure for their applications, automating much of that work. BecauseScrum emerged as the dominant Agile framework in the early 2000s and it omitted the engineering practices that were part of many Agile teams, the movement to automate operations and infrastructure functions splintered from Agile and expanded into what has become modern DevOps. Today, DevOps focuses on the deployment of developed software, whether it is developed using Agile oriented methodologies or other methodologies.
ArchOps presents an extension for DevOps practice, starting fromsoftware architecture artifacts, instead of source code, for operation deployment.[32] ArchOps states that architectural models are first-class entities in software development, deployment, and operations.
Automation is a core principle for achieving DevOps success and CI/CD is a critical component.[33] Plus, improved collaboration and communication between and within teams helps achieve fastertime to market, with reduced risks.[34]
Database DevOps applies DevOps andCI/CD principles directly to database development and operations. Integrating schema changes, migrations, reference data, and other data-layer updates into the same version-controlled and automated pipelines used for application code enables more reliable deployments and better coordination between application and data changes.[35][36]
Typical practices documented in both research and industry benchmarks include placing database schema definitions under version control, applying automated tests (such as unit tests or migration validation) to database changes, and deploying those changes through CI/CD pipelines. These practices reduce "schema drift" between development and production systems and lower the risk of deployment failures.[37][38]
Mobile DevOps is a set of practices that applies the principles of DevOps specifically to the development of mobile applications. Traditional DevOps focuses on streamlining thesoftware development process in general, butmobile development has its own unique challenges that require a tailored approach.[39] Mobile DevOps is not simply as a branch of DevOps specific to mobile app development, instead an extension and reinterpretation of the DevOps philosophy due to very specific requirements of the mobile world.
In 2003,Google developedsite reliability engineering (SRE), an approach for releasing new features continuously into large-scale high-availability systems while maintaining high-quality end-user experience.[40] While SRE predates the development of DevOps, they are generally viewed as being related to each other. Some of the original authors of the discipline consider SRE as an implementation of DevOps.[41]
Toyota production system, also known under the acronym TPS, was the inspiration forlean thinking with its focus oncontinuous improvement,kaizen, flow and small batches. Theandon cord principle to create fast feedback, swarm and solve problems stems from TPS.[42][43]
DevSecOps is an augmentation of DevOps to allow for security practices to be integrated into the DevOps approach. Contrary to a traditional centralized security team model, each delivery team is empowered to factor in the correct security controls into their software delivery. Security practices and testing are performed earlier in the development lifecycle, hence the term "shift left". Security is tested in three main areas: static, software composition, and dynamic.
Checking software statically viastatic application security testing (SAST) iswhite-box testing with special focus on security. Depending on the programming language, different tools are needed to do such static code analysis. The software composition is analyzed, especially libraries, and the version of each component is checked against vulnerability lists published byCERT and other expert groups. When giving software to clients, library licenses and their match to the license of the software distributed are in focus, especiallycopyleft licenses.
In dynamic testing, also calledblack-box testing, software is tested without knowing its inner functions. In DevSecOps this practice may be referred to asdynamic application security testing (DAST) or penetration testing. The goal is early detection of defects includingcross-site scripting andSQL injection vulnerabilities.
Often, detected defects from static and dynamic testing are triaged and categorized under taxonomies like the Common Weakness Enumeration (CWE), maintained by theMitre Corporation. This facilitates the prioritization of security bug fixes and also allows frequently recurring weaknesses to be fixed with recommended mitigations. As of 2025, CWE maintained its own list of frequently-occurring weaknesses, the CWE Top 25.[44] In addition, organizations likeOpen Worldwide Application Security Project (OWASP) maintain lists of industry-wide frequently recurring software weaknesses.[45]
DevSecOps has also been described as a cultural shift involving a holistic approach to producing secure software by integrating security education, security by design, and security automation.[46]
DevOps initiatives can change how a company'soperations,developers, andtesters collaborate during the development and delivery processes.[47][48]
DevOps attempts to support consistency, reliability, and efficiency within an organization. This is usually enabled by a shared code repository or version control.[49] Many organizations useversion control to facilitate DevOps automation technologies likevirtual machines,containerization (orOS-level virtualization), andCI/CD,[50] with theGit version control system and theGitHub platform referenced as examples.
GitOps evolved from DevOps. The specific state of deployment configuration isversion-controlled. Because the most popular version-control is Git, the GitOps approach has been named after Git. Changes to configuration can be managed usingcode review practices, and can be rolled back using version-controlling. Essentially, all of the changes to a code are tracked, bookmarked, and making any updates to the history can be made easier. As explained byRed Hat, "visibility to change means the ability to trace and reproduce issues quickly, improving overall security."[51]
The following practices can enhance productivity of DevOpspipelines, especially in systems hosted in thecloud:[52][53][54]
{{cite book}}: CS1 maint: location missing publisher (link)
