shouldiuse.io

VERDICT

Should I use Codefresh?

[ Octopus Deploy ](/) - codefresh.io

Depends. Buy if you run Kubernetes at scale and want managed Argo GitOps plus CI in one platform. Skip it for simple apps or non-Kubernetes stacks — GitHub Actions or GitLab CI is simpler and cheaper.

Confidence

Medium. Based on 20+ public sources; pricing figures not disclosed in the pages reviewed.

Ratings

  • Value for moneyNo public pricing found
  • Ease of useSnippets don't isolate usability
  • Feature depth
  • Support qualityNo support-quality evidence
  • Security posture

Pricing

Not disclosed

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed

Best for

  • Kubernetes-heavy engineering orgs
  • GitOps / Argo CD adopters
  • Enterprise microservices deployments
  • Teams wanting SaaS CI with hybrid runners

Not for

  • Small teams shipping simple web apps
  • Shops not running Kubernetes
  • Startups needing transparent, self-serve pricing
  • Orgs without dedicated DevOps staff

Gotchas - check before you buy

medium

No public pricing in sources; expect sales-led quotes and usage-based costs

medium

Built on Argo CD, which had a 2024 denial-of-service advisory; keep patched

medium

Octopus acquisition (2024) may shift roadmap, packaging, or pricing

medium

Guess: pipeline definitions are Codefresh-specific; migrating to another CI means rewrites

Pros and cons

Pros

  • Advocated as a top CI choice on Kubernetes
  • 4.66/5 SoftwareAdvice rating; functionality praised
  • Hybrid runner runs pipelines on your own infrastructure
  • Backed by Octopus Deploy after 2024 acquisition
  • Supports Snyk, Aqua, Twistlock scanning inside pipelines

Cons

  • Scores lower at 3.6/5 across 72 reviews
  • Critics on Reddit call its shell handling 'weird'
  • High-severity platform CVE (CVSS 8.6) disclosed
  • Buyers openly ask peers about pricing and costs

Sources & method

Analyzed 9/26/2026 - 10 sources - One high-severity CVE (CVSS 8.6, authenticated API) disclosed for the platform; upstream Argo CD had a 2024 DoS advisory.

official x1review x5security x2news x2
  • CVE-2026-12878 — Codefresh platform, High (CVSS 8.6), Authenticated API privilege-escalation vulnerability disclosed Aug 2026; patch promptly.
  • Argo CD denial-of-service advisory (2024), Upstream Argo CD, which Codefresh GitOps is built on, was vulnerable to DoS via malicious payloads.

Key stats

  • Feature depth: 4/5

    Rating

  • Not disclosed

    Starting price

  • 10

    Sources

  • Analyzed

  • Value for money. No public pricing found
  • Ease of use. Snippets don't isolate usability
  • Feature depth: 4/5. CI, CD, GitOps, hybrid runners in one
  • Support quality. No support-quality evidence
  • Security posture: 3/5. High CVE disclosed; publishes security page
  • 4.66/5 SoftwareAdvice rating 2026 reviews
  • 3.6/5 RFP.wiki rating 72 reviews
  • 384 Companies using it TheirStack
  • Feb 2024 Acquired by Octopus Deploy

Pricing

Not disclosed

Security

One high-severity CVE (CVSS 8.6, authenticated API) disclosed for the platform; upstream Argo CD had a 2024 DoS advisory.

  • CVE-2026-12878 — Codefresh platform, High (CVSS 8.6)Authenticated API privilege-escalation vulnerability disclosed Aug 2026; patch promptly.⁷
  • Argo CD denial-of-service advisory (2024)Upstream Argo CD, which Codefresh GitOps is built on, was vulnerable to DoS via malicious payloads.⁸

What users say

Review sites rate it well (4.66/5 SoftwareAdvice; 3.6/5 with 72 reviews on RFP.wiki) and Reddit debates are mixed-to-positive for Kubernetes use.

“I advocate for Codefresh”
Reddit, r/devops

Alternatives

Compare Codefresh with each alternative.

  • GitHub Actions

    Default for GitHub repos; simple, cheap, no Kubernetes lock-in.

  • GitLab CI/CD

    All-in-one DevOps platform if you want one vendor.

    Codefresh vs GitLab CI/CD

  • Argo CD (self-hosted)

    Free GitOps engine Codefresh is built on; run it yourself.

  • Buildkite

    CI used by Shopify and Basecamp; bring your own infrastructure.

Companies that could

  • Shopify Uses Buildkite instead
  • Basecamp Uses Buildkite instead
Full analysis

Based on 20+ public sources; pricing figures not disclosed in the pages reviewed.

Powerful Kubernetes GitOps platform for big engineering orgs; overkill for simple apps or teams without Kubernetes.

Methodology

Based on 20+ public sources; pricing figures not disclosed in the pages reviewed.

Sources

  1. Codefresh Reviews & Pricing — SoftwareAdvicesoftwareadvice.com
    review
  2. Codefresh vs Travis CI — RFP.wikirfp.wiki
    review
  3. Best CI system on Kubernetes — Redditreddit.com
    review
  4. Codefresh Reviews — Gartner Peer Insightsgartner.com
    review
  5. Octopus Deploy Acquires Codefreshoctopus.com
    news
  6. Codefresh Software Pricing — Vendrvendr.com
    review
  7. CVE-2026-12878 — SentinelOne vulnerability databasesentinelone.com
    security
  8. Argo CD DoS advisory — GitHubgithub.com
    security
  9. Codefresh Runner docscodefresh.io
    official
  10. Companies that use Codefresh — TheirStacktheirstack.com
    news

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.