DevOps & Infrastructure Recipes

The DevOps recipes are five pages of copy-paste prompts for Claude Code, Codex, and Cursor: Dockerfiles, Kubernetes manifests, CI/CD pipelines, infrastructure as code, and monitoring. Every recipe follows one rule: the agent writes the configuration, and a machine check proves it before a human approves the change.

This page is for developers who let an agent write delivery configuration, and for tech leads who own the pipeline it runs through. You know the failure: a 1.2 GB image, a rollout stuck in CrashLoopBackOff, or a pipeline that went green because the agent weakened a failing scan.

Which DevOps recipe fits your task?

The last column is the evidence the agent attaches instead of you reading the YAML.

Your task	Recipe	The gate that proves it
Write or shrink a Dockerfile, a Compose file, or image CI	Docker and container patterns	hadolint, a Trivy scan, and a smoke test of the built image
Deployments, Helm charts, autoscaling, GitOps	Kubernetes orchestration patterns	helm lint, then kubectl diff against the real cluster in CI
GitHub Actions, GitLab CI, or Jenkins pipelines	CI/CD pipeline patterns	actionlint, zizmor, and a throwaway pull request that must go red
Terraform, CloudFormation, or Pulumi changes	Infrastructure as code patterns	terraform plan with zero unexpected replaces or destroys
Instrumentation, alert rules, dashboards, log pipelines	Monitoring and logging patterns	promtool test rules and a query that returns real data

For the end-to-end delivery workflow, read review and ship; for running production afterwards, read DevOps with AI.

Give the agent your delivery rules before any recipe

Without rules, an agent writes what an average tutorial would: :latest tags, a root user, unpinned actions. Write the rules once, where each tool loads them automatically.

## Delivery rules
- Never read, print, or write secrets. Use the secret store; no credentials in ENV, ARG, YAML, or HCL.
- Pin every base image, action, chart, and provider to an explicit version.
- Never delete, skip, or soften a failing check (scanner severity, .trivyignore, `continue-on-error`,
  `|| true`, `-target`). Report the finding and stop.
- You do not run `terraform apply`, `kubectl apply`, `helm upgrade`, or any deploy. CI does that after approval.
- After any change, run the gates in scripts/verify-delivery.sh and paste the full output in your summary.

Claude Code

Keep the canonical block in AGENTS.md and make CLAUDE.md at the repository root the single line @AGENTS.md, which imports it. Claude Code loads it in every session, headless claude -p runs included.

Codex

Add the block to AGENTS.md at the repository root. Since Codex 0.150.0, an untrusted project does not supply its project-level AGENTS.md, so trust the repository: accept Trust this folder? on your first codex run there, or set trust_level = "trusted" under [projects."/absolute/path"] in ~/.codex/config.toml (see Codex configuration).

Cursor

Save the block as a project rule (Cursor Rules). Update this copy whenever the canonical block changes.

The deploy rule matters most: without production credentials, a bad recipe costs a failed pull request, not an incident. Permissions and sandboxing shows how to enforce it.

Copy-paste prompt: audit the delivery config before you change it

Read-only pass: do not edit files. Inventory every Dockerfile, Compose file,
Kubernetes manifest or Helm chart, CI workflow, and Terraform module in this
repository. For each, list: unpinned versions (images, actions, charts,
providers), containers running as root, checks that cannot fail (continue-on-error,
|| true, severity filters that exclude HIGH), and secrets referenced outside the
secret store. Output one table sorted by risk, with file:line for every finding,
and name the recipe fix you would apply first.

How do you verify agent-written DevOps changes without reading every line?

A recipe is done when its gate passes and the agent attaches the output, not when the YAML looks right.

• Static gates run in the agent’s session. They need no credentials.
• Reality gates run in CI. terraform plan and kubectl diff need cloud and cluster access, so a read-only CI job posts their output on the pull request for the agent to read.
• Prove a gate can fail. The CI/CD recipe opens a throwaway pull request that must go red.
• A human signs off on blast radius. The reviewer reads the plan summary (resources added, changed, destroyed) and the rollback command, not every line. Both go in the pull request’s evidence bundle, and production approval stays a human boundary.

Put the static gates in one script that every tool and every human runs. Delete the lines your repository does not need:

#!/usr/bin/env bash
# scripts/verify-delivery.sh: static gates only; no cloud or cluster credentials.
set -euo pipefail
for f in $(git ls-files '*Dockerfile*'); do docker run --rm -i hadolint/hadolint < "$f"; done
actionlint
uvx zizmor .github/workflows/
for c in charts/*/; do helm lint "$c"; done
terraform -chdir=infra init -backend=false -input=false >/dev/null
terraform -chdir=infra validate
promtool check rules monitoring/rules/*.yml
echo "PASS all static delivery gates"

Copy-paste prompt: fix until the gates pass, without weakening them

Run exactly: scripts/verify-delivery.sh. For each failing gate, fix the configuration,
not the gate: do not edit the script, scanner ignore files, severity lists, or
CI step conditions. Rerun after each fix. Stop after three rounds or when all
gates pass. Then give me: the full final script output, a list of files you
changed with one line each on why, and any finding you could not fix, with the
reason. Do not run apply, upgrade, or deploy commands.

Save it as prompts/devops-gates.txt and run it the same way in each tool:

Claude Code

# Terminal, on a trusted branch. Edits allowed; shell limited to the gate script.
claude -p "$(cat prompts/devops-gates.txt)" \
  --permission-mode dontAsk \
  --allowedTools "Read,Grep,Glob,Edit,Bash(scripts/verify-delivery.sh)" \
  --output-format json > gates.json

Bash(scripts/verify-delivery.sh) matches only that exact spelling, which is why the prompt says “Run exactly”. If the agent calls ./scripts/verify-delivery.sh or bash scripts/verify-delivery.sh, the call is denied (--permission-mode dontAsk denies whatever would prompt, and nobody could answer a prompt in -p mode anyway), so the summary may arrive without gate output. Reject any summary that lacks the final PASS line.

Codex

# Terminal. The sandbox limits writes to the workspace; -o saves the final summary.
codex exec --sandbox workspace-write -o gates.md "$(cat prompts/devops-gates.txt)"

The workspace-write sandbox has no network access by default (sandbox_workspace_write.network_access is false in codex-cli 0.157.1), so uvx zizmor, terraform init, and docker run hadolint fail inside it. Preinstall the tools in your dev image instead: a pinned zizmor, a provider cache through TF_PLUGIN_CACHE_DIR, and a hadolint binary.

Cursor

Paste the prompt into the agent. It runs the script in the integrated terminal, subject to your run-mode settings. Accept the diff only after the terminal shows the final PASS line.

What breaks when agents write DevOps configuration?

DevOps recipe failure modes and recovery

• A green pipeline because the agent weakened a gate. The diff adds || true, drops HIGH from a severity list, or edits .trivyignore. Recovery: revert those lines and require a code owner’s approval for changes to gate files.
• Invented or stale versions. Agents reuse tags from training data and guess commit SHAs. Recovery: resolve every pin against the registry, and let Renovate or Dependabot own digests.
• A plan that replaces a resource you meant to edit. A renamed Terraform resource or changed immutable field becomes destroy-and-create. Recovery: block the merge on any unexpected replace, and record a rename with a moved block instead of a new resource.
• Hardening advice from an older platform. PodSecurityPolicy was removed in Kubernetes 1.25, yet agents still generate it. Recovery: name the cluster version in the prompt and validate with kubectl diff against the real API server.
• The agent asks for credentials to “check it works”. Recovery: refuse, and move that check into the read-only CI job. Never answer with --dangerously-skip-permissions or a full-access sandbox outside a disposable, network-restricted environment.

Where to go next with DevOps recipes

Docker and container patterns

Kubernetes orchestration patterns

CI/CD pipeline patterns

Infrastructure as code patterns

Monitoring and logging patterns

Containerization workflow

CI/CD pipelines workflow

Infrastructure as code workflow

Infrastructure MCP servers Terraform, Kubernetes, and cloud servers that ground the agent in real provider data.

Headless agents in CI Run these recipes as CI jobs safely, on trusted refs only.