shouldiuse.io

Categories

VERDICT

Runatlantis (Atlantis) Review

Depends

Should I use Runatlantis (Atlantis)?

Terraform Pull Request Automation - runatlantis.io

· 1 month ago

Great fit if you have 3+ engineers collaborating on Terraform via pull requests and someone to operate a server. Skip it if you're a solo dev or want a zero-ops managed platform with vendor support.

Confidence

Medium. Based on ~35 public sources; thin on structured ratings since it's open-source tooling with no vendor review pages.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

$0

Open Source (self-hosted)

ModelSelf-hosted
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • Teams of 3+ engineers on Terraform
  • PR-driven plan/apply workflows
  • Cost-conscious orgs avoiding per-user IaC pricing
  • Shops keeping cloud credentials in-house

Not for

  • Solo developers — running terraform plan locally is enough
  • Small teams wanting a zero-ops managed platform
  • Orgs needing SLA-backed vendor support
  • Teams with nobody to patch and monitor a server

Gotchas - check before you buy

high

Four public security advisories in 2025-2026; track releases and patch fast

medium

Free software, not free ops: upgrades, backups, and HA are your job

medium

No vendor SLA — production breakage depends on community GitHub issues

medium

Plans can go stale between PR updates, forcing manual refreshes

Pros and cons

Pros

  • Free and open source — no seats or usage pricing
  • Self-hosted, so cloud credentials stay on your infra
  • Automates terraform plan/apply inside pull requests
  • Built-in policy checks via Conftest/OPA
  • Custom workflows handle non-standard setups

Cons

  • Self-hosted: you own uptime, scaling, and HA
  • Recurring CVEs 2025-2026, including an auth-bypass flaw
  • Stale plan bugs reported on old PRs
  • No vendor SLA; you rely on community support

Sources & method

- 11 sources - Active advisory stream: auth bypass, path traversal (CVSS 8.1), and info exposure fixed across 2025-2026 releases — patch promptly.

official x4review x3security x3news x1
  • CVE-2026-82282, Atlantis through 0.47.1 fails to authenticate the /github-app endpoint
  • CVE-2026-64679 (CVSS 8.1), Path traversal vulnerability rated high severity
  • CVE-2025-58445, Vulnerability in runatlantis tracked by NVD, September 2025
  • GHSA-xh7v-965r-23f7, Service version publicly exposed via /status API endpoint

Key stats

  • Value for money: 5/5

    Rating

  • $0

    Starting price

  • 11

    Sources

  • Analyzed

  • Value for money: 5/5. Free forever; only cost is your ops time
  • Ease of use: 3/5. Helm/Docker setup; per-repo config files
  • Feature depth: 4/5. Custom workflows, policy checks, drift detection
  • Support quality: 2/5. Guess: community GitHub support, no SLA
  • Security posture: 2/5. Four advisories 2025-26, including CVSS 8.1
  • $0 Price Open source, no paid tiers
  • Self-hosted Hosting model Credentials stay in your infra
  • CVSS 8.1 Worst recent CVE CVE-2026-64679, path traversal
  • 4 Public advisories 2025-2026 window

Pricing

Open Source (self-hosted)

$0

  • Unlimited repos and users on your own infra
  • Docker and Kubernetes Helm deployment
  • Community support only

Security

Active advisory stream: auth bypass, path traversal (CVSS 8.1), and info exposure fixed across 2025-2026 releases — patch promptly.

  • CVE-2026-82282Atlantis through 0.47.1 fails to authenticate the /github-app endpoint⁸
  • CVE-2026-64679 (CVSS 8.1)Path traversal vulnerability rated high severity⁹
  • CVE-2025-58445Vulnerability in runatlantis tracked by NVD, September 202510
  • GHSA-xh7v-965r-23f7Service version publicly exposed via /status API endpoint

What users say

Users on Reddit actively champion Atlantis for Terraform PR automation, though some hesitate about self-hosting responsibilities.

“PSA: Love terraform? Love CI/CD? You want to run Atlantis.”
Reddit, r/devops
Full analysis

Based on ~35 public sources; thin on structured ratings since it's open-source tooling with no vendor review pages.

Free self-hosted Terraform PR automation. Great for 3+ engineer teams; solo devs just use plain CI.

Methodology

Based on ~35 public sources; thin on structured ratings since it's open-source tooling with no vendor review pages.

Read how a report is made.

Sources

  1. Atlantis official siterunatlantis.io
    official
  2. runatlantis/atlantis on GitHubgithub.com
    official
  3. Conftest Policy Checking docsrunatlantis.io
    official
  4. Atlantis deployment docs (Helm/K8s)github.com
    official
  5. Reddit PSA recommending Atlantisreddit.com
    review
  6. Reddit: HA for Atlantis Open Source?reddit.com
    review
  7. Atlantis Review 2026devopsboys.com
    review
  8. CVE-2026-82282 (Rapid7)rapid7.com
    security
  9. CVE-2026-64679 (SentinelOne)sentinelone.com
    security
  10. CVE-2025-58445 (NVD)nvd.nist.gov
    security
  11. Gruntwork: Atlantis or Terragrunt Scalegruntwork.io
    news

Add this review to your site

This check for Runatlantis (Atlantis) says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Runatlantis (Atlantis) Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.