What is DevOps?

What is DevOps?

DevOps means development (“Dev”) and operations (“Ops”) working as one team across the software lifecycle. Patrick Debois coined the term while organizing the first DevOpsDays conference in Ghent, Belgium, in October 2009. Months earlier, John Allspaw and Paul Hammond’s Velocity talk “10+ Deploys Per Day: Dev and Ops Cooperation at Flickr” showed what dev-ops cooperation could achieve.

Before DevOps, development and operations sat in separate teams with separate responsibilities for the same software. Organizations remove that split by making one cross-functional team responsible for both. DevOps describes a culture and a set of practices. Many organizations use “DevOps engineer” as a role label for engineers who build the automation that supports it.

The Core Principles of DevOps

Culture comes first. When teams apply automation to silos, they only automate the silos.

• Collaboration and shared ownership: Developers and operations engineers own a service together, from design to production incidents.
• Automation: Builds, tests, deployments, and infrastructure changes run through pipelines, which cuts manual error and makes releases repeatable.
• Continuous improvement: Teams measure delivery performance and run blameless postmortems. They treat failures as chances to improve the system.
• Psychological safety: Amy Edmondson defined psychological safety as “a shared belief held by members of a team that the team is safe for interpersonal risk-taking.” DORA research consistently finds that generative, high-trust cultures predict higher software delivery and organizational performance.

The DevOps Lifecycle: Phases Explained

The DevOps lifecycle consists of eight phases that run as a continuous loop:

• Plan: Teams set scope and acceptance criteria, then establish priorities.
• Code: Developers write and review changes in version control.
• Build: The CI pipeline compiles source and dependencies into artifacts.
• Test: Automated suites verify every build.
• Release: Release teams version and stage approved builds.
• Deploy: Teams use the deployment pipeline to move the release to production environments.
• Operate: The team runs and scales the live service.
• Monitor: Telemetry records errors and performance. It also records usage.

They feed production monitoring data into planning, then prioritize fixes for problems they observed in the previous iteration.

Key DevOps Practices Every Team Should Know

Four practices carry most of the automation load: CI/CD, infrastructure as code, version control, and monitoring.

CI/CD pipelines

Continuous integration (CI) means every team member merges changes into a shared codebase at least daily, with an automated build and test verifying each integration. Continuous delivery (CD) extends CI so software can ship at any time, and continuous deployment pushes every passing change automatically. The only difference is whether a human triggers the final step.

Infrastructure as code (IaC)

IaC is the practice of provisioning computing infrastructure using code instead of manual processes and settings. Because these definitions live in version control, teams can review and reproduce environments the way they handle application code.

Version control

Version control tracks every change to code and configuration and anchors the rest of the toolchain. CI triggers on commits, while IaC definitions live in repositories. Rollbacks depend on version history. Git is the de facto standard.

Monitoring and logging

Teams use monitoring to close the feedback loop. Teams read production telemetry to see whether a deployment degraded performance, and that same data is how they calculate failed deployment recovery time.

Benefits of Adopting DevOps

In the 2024 DORA Report, researchers quantified the gap between elite and low performers. Frequent, small releases drive those numbers, and they lower the cost of each failure because a small change is easier to recover from. Elite teams also have an 8 times lower change failure rate: fewer releases turn into production incidents, so less engineering capacity goes to rework.

• 182 times more frequent deployments: Elite teams get finished work in front of customers in days instead of quarters.
• 2,293 times faster recovery from failed deployments: Teams spend less time on unplanned incident work.

Where DevOps Adoption Gets Stuck

Most organizations adopt DevOps practices incrementally, which means structural constraints from earlier delivery models often persist beneath new tooling. Researchers reported in the 2024 DORA Report that throughput and stability can move independently. Without shared metrics across the full pipeline, teams may not detect that pattern.

• Automation layered over existing silos: Handoffs between teams are scripted rather than eliminated, so the organizational boundary survives the tooling change.
• Manual promotion and artifact handoffs: Hand-managed scripts between build and deploy stages introduce inconsistency and slow release cadence.
• Fragmented tooling by package format: Maintaining a separate registry or pipeline per package ecosystem — plus the glue and integration work required to keep 10+ disparate open-source tools connected — creates parallel maintenance burdens and visibility gaps that only a single system of record can eliminate.
• Security as a late-stage gate: Placing security review at the end of the pipeline turns it into a release blocker rather than a continuous feedback signal.
• No shared delivery metrics: Without tracking throughput and stability together, teams can improve deployment frequency while change failure rate quietly rises.

DevOps vs. Agile

Agile methodologies optimize the software creation process, while DevOps extends those feedback loops through production and infrastructure.

Atlassian connects DevOps and Agile, describing DevOps as “agile applied beyond the software team,” and Forrester found organizations running Agile and DevOps together delivered frequently at a higher rate (83%) than those running Agile alone (75%).

DevOps vs. Waterfall

Waterfall relies on rigid, sequential phases that break when requirements shift, whereas DevOps assumes and builds for continuous change.

Waterfall’s principal process drawback, per Ian Sommerville, is “the difficulty of accommodating change after the process is underway.”

Essential DevOps Tools by Lifecycle Stage

No single tool covers the loop. Teams assemble a toolchain by stage:

• Plan and code: Teams keep code in Git and usually host their repositories on a platform such as GitHub.
• Build and integrate: Jenkins, GitHub Actions, GitLab CI, and CircleCI run CI pipelines.
• Package and store: An artifact repository like JFrog Artifactory versions and stores build outputs between build and deploy.
• Deploy and operate: Teams run Docker for containers and Kubernetes for orchestration.
• Provision and configure: Teams provision with Terraform, or its fork OpenTofu, and manage configuration with Puppet and Chef.

Working in DevOps requires a layered skill set — Linux and networking fundamentals, Git, a scripting language such as Bash or Python, containers and orchestration with Docker and Kubernetes, and infrastructure as code with Terraform or OpenTofu. But assembling those capabilities from separate tools creates a structural problem: distinct CI systems, artifact registries, IaC pipelines, and monitoring stacks per package format leave teams without one authoritative record of every build output. The result is parallel maintenance across disconnected stores and visibility gaps between what was built, what was tested, and what reached production. A single system of record for artifacts resolves those gaps by routing every build output through one place — from commit to deployment — so teams can trace any artifact’s origin, test results, and promotion history without reconstructing that picture from multiple sources.

DevSecOps: Integrating Security Into the Pipeline

DevSecOps moves security checks into the pipeline instead of bolting them on before release. This approach is known as shift-left: teams spend less when they catch bugs early. NIST SP 800-218 states that teams addressing security earlier in the lifecycle spend less effort and money to reach the same level of security. That means running static application security testing (SAST) in CI and software composition analysis (SCA) on dependencies before a build. Pipeline and deployment systems then enforce those policies as artifacts move into runtime.

Running those checks automatically inside the CI pipeline reduces friction rather than adding it: instead of a point-in-time security review that blocks a release at the end of a cycle, developers receive feedback continuously and incrementally while a change is still small and cheap to fix. NIST SP 800-218 makes the cost case explicit — the earlier in the SDLC that security is addressed, the less effort and cost is ultimately required to reach the same level of security — so automated gates in CI are not a slowdown but a front-loaded investment that prevents the far larger delays of a late-stage remediation sprint.

How to Measure DevOps Success With DORA Metrics

Current DORA guidance defines five software delivery performance metrics. The 2024 report’s elite tier sets the benchmark:

• Deployment frequency: Elite teams deploy on demand.
• Lead time for changes: They move a commit to production in less than a day.
• Change failure rate: They hold failures to 5% of changes.
• Failed deployment recovery time: They restore service in under an hour.
• Deployment rework rate: They minimize the share of deployments that are unplanned and triggered by a production incident — a direct measure of release stability.

Track the complete metric set together. Optimizing throughput alone hides stability problems.

Common Questions About DevOps

DevOps defines shared lifecycle ownership, while DevSecOps and SRE apply that model to security and reliability. Cloud infrastructure supports the model through programmable, on-demand resources, and Agile governs the iterative development work that DevOps carries into operations.

What does the term DevOps mean?

DevOps functionally combines “development” and “operations”: one team owns the software from development through production. The name describes a working arrangement and a set of practices.

Is DevOps a job title?

DevOps describes an operating model. A DevOps engineer is an organizational role label.

What does a DevOps engineer do day to day?

A DevOps engineer maintains and debugs CI pipeline jobs while reviewing and merging infrastructure-as-code changes. The role configures build and deploy automation for application teams, manages promotion and release steps across environments, responds to on-call alerts, and drives postmortems after incidents. Monitoring work includes tuning rules and dashboards to keep signal-to-noise ratios useful. Most of the work is hands-on with live systems, including their pipelines and configuration.

How does DevOps differ from Agile?

Agile governs how software gets built, iteratively and in small increments. DevOps adds the operations team that ships and runs it.

What is DevSecOps?

DevSecOps integrates security into the DevOps pipeline from the start rather than gating releases with a late-stage review. Automated SAST and SCA run alongside IaC scans and functional tests, so vulnerabilities surface while they are cheap to fix.

Is DevOps a coding job?

DevOps work requires programming, but the focus is automation code rather than application features. Engineers write shell and Python scripts, pipeline definitions in YAML, infrastructure-as-code configuration such as Terraform HCL, Dockerfiles, and Kubernetes manifests, with occasional Go or Python for internal tooling. Beyond writing, DevOps engineers read and review application code to debug builds and deployments, even when they are not responsible for shipping the product itself.

How do SRE and DevOps relate?

DevOps is a broad philosophy of whole-lifecycle collaboration; site reliability engineering (SRE) is a job role that implements much of it. Google’s SRE guidance caps operational work at 50% of time so the rest goes to engineering and automation.

How does cloud computing support DevOps?

Cloud infrastructure gives teams on-demand provisioning and elastic scale, which makes IaC and disposable test environments practical.

How JFrog Helps With DevOps

DevOps works when every artifact moves from commit to production without manual handoffs. Development and security teams use the JFrog Software Supply Chain Platform as one system of record for those artifacts. Operations uses the same system instead of a patchwork of registries and scripts. Teams evaluating the full workflow can schedule a guided demo.

• JFrog Artifactory is a universal binary repository supporting package formats including Docker, npm, Maven, PyPI, and Helm, plus AI model formats such as Hugging Face, GGUF, ONNX, and Safetensors. You can also start a free trial.
• JFrog Xray runs deep recursive scans across binaries and their transitive dependencies at any depth, matching findings against a database of 4M+ open-source packages.
• JFrog Curation blocks risky open-source packages at the point of consumption.
• JFrog Advanced Security adds SAST, secrets detection, IaC scanning, and contextual analysis.

See how the JFrog Platform replaces separate artifact registries and security scripts with one artifact-management and scanning workflow. Take an online tour.