# Indra

> Cloud infrastructure, Docker, environments, and deployment standards. Use when setting up infrastructure, writing Dockerfiles, configuring deployments or environments, or writing any IaC (Terraform, etc.).

- Skill: `arjuncrevathi/indra` (Agent Skill)
- Install (CLI): `npx skillmds@latest add arjuncrevathi/indra`
- Raw SKILL.md: https://api.skillmd.com/api/skills/arjuncrevathi/indra/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: arjuncrevathi (https://skillmd.com/u/arjuncrevathi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/arjuncrevathi/indra

---


# Indra — King of the Devas (Cloud Infrastructure & Deployment)

Indra rules the heavens where services run: infrastructure declared in code, deployed without fear, rolled back in one command.

## Everything in code

- All prod infrastructure is IaC (Terraform or equivalent). No console clicking for prod — a manual change is an outage waiting to be un-reproducible.
- IaC lives in the repo, reviewed via PR, applied via CI with plan output visible before apply.
- State is remote and locked (e.g. S3 + lock table). Never local tfstate.
- Tag every resource: `owner`, `purpose`, `environment`. Untagged resources get deleted in cost reviews.

## Docker

- Slim base images: `python:3.12-slim`, `node:22-alpine` (or distroless for prod). No `latest` tags.
- Multi-stage builds: build deps in one stage, copy only artifacts into the runtime stage.
- Run as non-root: create a user and `USER app` before `CMD`.
- `.dockerignore` always: `.git`, `.env`, `node_modules`, `__pycache__`, tests, docs.
- One process per container; pin dependency versions inside the image (lockfiles copied first for layer caching).

## Environments

- Three environments minimum: dev, staging, prod — staging mirrors prod (same IaC modules, smaller sizes).
- All config via environment variables (12-factor). No environment-specific code branches (`if env == "prod"`), no config files baked into images.
- Secrets from a secrets manager, injected at runtime — never in images, IaC, or env files in git (see `kubera`).

## Deploys

- Immutable artifacts: build once, tag with git SHA, promote the same image dev → staging → prod. Never rebuild per environment.
- Blue-green or rolling deploys with health-check gating; no big-bang restarts.
- Rollback is one command and rehearsed — redeploy the previous SHA, done in < 5 minutes.
- Deploys run from CI only, from `main` or tags, after tests pass (see `brahma`).

## Access & IAM

- Least privilege everywhere: services get scoped roles, not admin. Humans get SSO + short-lived credentials, never long-lived keys.
- Separate cloud accounts/projects per environment where practical — blast radius containment.

## AI-native specifics

- Default to model APIs. Stand up GPU/inference infra only when the math justifies it: sustained volume where self-hosting beats API cost, or hard data-residency requirements. Do the cost comparison in writing first.
- Model API keys are per-environment and per-service — dev keys never touch prod quotas, and a leaked staging key can't drain the prod budget.
- Set provider spend limits/quotas per environment; treat inference cost as capacity planning.

## Before shipping infra — checklist

- [ ] All changes via IaC + PR; no manual prod edits
- [ ] Dockerfile: slim base, multi-stage, non-root, .dockerignore
- [ ] Config via env vars; secrets from secrets manager
- [ ] Artifact immutable (git SHA tag), rollback command tested
- [ ] IAM least-privilege; resources tagged owner + purpose