infradrift

Detect infrastructure drift between a known-good baseline and the current state of any Linux server — packages, listening ports, user accounts, privileged groups, cron jobs and systemd services.

Take a snapshot when the server is in a good state. Run check any time — after a deploy, from cron, or during an incident — to see exactly what changed. No agent, no daemon, no dependencies on the server beyond Python.

📄 Example

  ╔═══════════════════════════════╗
  ║  infradrift  ·  drift report  ║
  ╚═══════════════════════════════╝

  Baseline   2026-05-10T09:00:00+02:00  (prod-01)  as root
  Current    2026-05-12T14:22:18+02:00  (prod-01)  as root


  ── Ports ─────────────────────────────────
  ⛔ +  4444/tcp on all interfaces  (nc) — new listening port
  ⛔ ~  6379/tcp on all interfaces  (redis-server) — now listening on a new address

  ── Users ─────────────────────────────────
  ⛔ ~  backup — account changed  shell /usr/sbin/nologin → /bin/bash
  ⛔ +  deploy — new user  uid=1005 shell=/bin/bash

  ── Privileged Groups ─────────────────────
  ⛔ +  deploy added to privileged group sudo

  ── Cron Jobs ─────────────────────────────
  ⚠  +  New cron job: @reboot  /tmp/.cache/update.sh  crontab:www-data

  ── Services ──────────────────────────────
  ⚠  ~  nginx  active → failed

  ── Packages ──────────────────────────────
  · ~  [apt] openssl upgraded  3.0.13-0ubuntu3 → 3.0.13-0ubuntu3.1

  ──────────────────────────────────────────
  8 changes detected  (5 critical, 2 warnings, 1 info)

✨ What it detects

Severity levels

📥 Installation

pip install infradrift

Run it as root for complete results: other users' crontabs and the process names of every socket are only visible to root. infradrift warns you when it runs unprivileged.

🛠 Usage

1 — Take a baseline snapshot

sudo infradrift snapshot

Saved to /var/lib/infradrift/baseline.json when run as root, or ~/.config/infradrift/baseline.json otherwise. The file is created with 0600 permissions: it lists users, ports and cron commands.

sudo infradrift snapshot --output /opt/baselines/prod-$(date +%F).json

2 — Check for drift

sudo infradrift check                                   # terminal report
sudo infradrift check --format json | jq .summary       # JSON on stdout, progress on stderr
sudo infradrift check -f markdown -o drift-report.md    # Markdown file
sudo infradrift check --baseline /opt/baselines/prod-2026-05-12.json --fail-on critical

3 — Diff any two snapshots

infradrift diff before-deploy.json after-deploy.json
infradrift diff web-01.json web-02.json --format markdown   # compare two servers

🔁 Use in cron / CI

# Every hour: keep a Markdown report only when something critical changed
0 * * * * root infradrift check --fail-on critical -o /var/log/infradrift/last.md || cp /var/log/infradrift/last.md /var/log/infradrift/alert-$(date +\%F-\%H).md

📋 Options

infradrift snapshot

infradrift check / infradrift diff BASELINE CURRENT

🧪 Development

pip install -e ".[dev]"
ruff check .
pytest

See CHANGELOG.md for release notes.

📝 License

MIT — see LICENSE.

🌐 Connect