Kestra

What it is

Kestra is an open-source orchestration platform for data, AI and infrastructure workflows, made by Kestra Technologies. A flow is a YAML file of tasks, and a trigger starts it on a schedule, on an event or from an API call. Its plugins run scripts in Python, Node.js, R, Go or Shell, query databases and call APIs. You can build the same flow in a YAML editor, a no-code editor or the built-in AI Copilot, and all three stay in sync. A coding agent such as Claude Code can write and deploy flows too.

1. A schedule comes due or an event arrives
2. The trigger starts an execution of your flow
3. Workers run each task: a script, a query or an API call
4. Each task passes its outputs to the next one
5. The UI shows every run’s logs, outputs and state

Who it suits

Data and platform engineers who run pipelines, scripts and infrastructure jobs on a schedule or on events, and want them kept as code in Git. Teams leaving Apache Airflow get a skill that ports a DAG to a Kestra flow. Developers who already work in Claude Code, Codex or Cursor can describe a flow and let the agent deploy it.

Skip the open-source edition if each person needs a login and a role of their own. It has one basic-auth account that everyone shares, and RBAC, SSO and multi-tenancy belong to the paid Enterprise Edition.

Where to use it

The open-source edition is a server you host, and you reach it from a browser, a terminal or your editor. Kestra also offers Kestra Cloud, a managed platform.

• Your machine: one Docker container with an embedded H2 database, or Docker Compose with PostgreSQL
• Kubernetes: two Helm charts, a starter one for evaluation and a production one where you bring the database and storage
• The cloud: a CloudFormation template for AWS, and Terraform modules for an Azure VM and for Google Cloud
• Coding agents: Claude Code, Codex and Cursor through the Docs MCP server, the Agent Skills and kestractl. Windsurf, OpenCode and other agents read the same skill files
• Your editor and terminal: the VS Code extension and kestractl, the Kestra command line

The installation page also covers a single VM on AWS, Google Cloud, Azure or DigitalOcean, and a standalone JAR.

How to set it up

Get it saves a zip of Mindket’s setup notes in your downloads folder, with each platform’s and agent’s steps from Kestra’s docs. The quickest route is one Docker command.

1. Start Docker. On Windows, the Quickstart says to enable WSL first.
2. Run the single Docker command. It pulls the slim image and starts Kestra on port 8080.
3. Wait for the log line Main server is running. Then open localhost:8080 in your browser and create your user right away.
4. Create a flow and run it. Paste the README’s hello_world flow into a new flow, run it and read its log.
5. Connect a coding agent, if you use one. The kit’s Claude Code, Codex and Cursor notes add the Docs MCP server, the Agent Skills and kestractl.

docker run --pull=always --rm -it -p 8080:8080 --user=root \
  --name kestra \
  -v kestra_data:/app/storage \
  -v kestra_db:/app/data \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /tmp:/tmp \
  kestra/kestra:latest-slim server local

On Windows, the README gives versions of the command for PowerShell, CMD and WSL, and the kit’s Docker notes copy all three. This is the README’s first flow.

id: hello_world
namespace: dev

tasks:
  - id: say_hello
    type: io.kestra.plugin.core.log.Log
    message: "Hello, World!"

How to use it

Each flow has an id, a namespace and a list of tasks. Add a triggers list and it starts by itself. The Docs MCP page shows the shape of a blueprint that runs a Python script when files land in an S3 bucket.

id: s3_trigger
namespace: company.team

tasks:
  - id: process
    type: io.kestra.plugin.scripts.python.Script
    # ...

triggers:
  - id: watch
    type: io.kestra.plugin.aws.s3.Trigger
    bucket: your-bucket
    prefix: incoming/
    interval: PT1M

In the UI, the editor checks your YAML as you type and draws the flow as a live graph. The Copilot sidebar has Ask, Edit and Plan modes, and Edit and Plan change nothing until you approve. From a terminal, kestractl checks, deploys and runs flows. These are the Claude Code Quickstart’s lines.

kestractl flows validate ./flows/
kestractl flows deploy ./flows/ --override
kestractl executions run tutorial github_stars --wait

Example

Kestra runs on your machine. Claude Code has the Docs MCP server, the two skills and a kestractl context. You type the Quickstart’s prompt:

Use kestra-flow to write a flow in the tutorial namespace that calls
https://api.github.com/repos/kestra-io/kestra every hour and logs the
star count. Save it as ./flows/github_stars.yaml. Then use kestra-ops
to deploy it to my Kestra instance, run it, and tell me the result.

Claude Code writes the flow file, then deploys and runs it.

To write it, Claude Code looks up the HTTP and Log task schemas on the Docs MCP server. kestractl validates, deploys and runs the flow. In the UI, github_stars appears in the tutorial namespace with one execution that logs the star count. Its Schedule trigger keeps it running every hour, so disable the trigger or delete the flow when you finish.

For newcomers and experts

If you are new. Orchestration means one tool starts your jobs, runs their steps in order, retries what fails and keeps the logs. In Kestra each job is a flow, and the UI shows every run with its logs and outputs. Start with the Docker command. Then paste the hello_world flow, run it and read the log line it writes. The AI Copilot can draft a flow for you once you give Kestra a Google Gemini key, the provider the open-source edition supports.

For experts. Kestra 2.0 splits the control plane from the data plane. Workers no longer touch the database. Each holds a gRPC stream to a Worker Controller, so it can run in another region or inside a restricted network. In the open-source edition that channel is plaintext and unauthenticated by default, and the controller hands each worker the instance’s encryption key. Keep workers and controllers on a trusted network, and set the shared kestra.grpc.basic-auth credentials to stop unknown workers. They add no TLS, and anyone who can capture the traffic can read them.

Task outputs now sit in their own storage, out of the execution record. For locked-down production, the Docker page calls an exact version tag such as v<X.X.X> the best choice. latest is a rolling tag whose support ends at the next stable release, about two months on, and latest-lts follows the long-term support line. Workers deployed without Docker need their plugins as JAR files first, and kestractl plugins download fetches them from Maven Central.

Moving from 1.x has a migration guide, and the migrate-kestra-2 skill guides a Kestra 1.3 instance and its flows through the upgrade. ForEach and ForEachItem became one Loop task, and trigger conditions are now written as when. For CI, the kestractl page gives flows validate-by-query --all --output json as a gate. It checks every flow on the instance and exits non-zero on violations.

Good to know

The open-source edition runs on servers you control, and a few things reach out or need care.

• License: Apache-2.0, copyright Kestra Technologies. The Enterprise Edition is a separate paid product with RBAC, SSO, multi-tenancy, audit logs and API tokens
• First login: on a fresh install with no basic-auth set, the hardening page says the Setup page at /ui/main/setup is public. Whoever reaches it first can set the credentials and lock you out. Set kestra.server.basic-auth username and password in the configuration before others can reach the port, and Kestra skips the Setup page
• Local setup: the Docker command runs as root and mounts the Docker socket. The Quickstart calls it local evaluation and points to the hardening guide before others can reach it
• Usage data: the server and the UI each send an anonymous usage report by default. Set kestra.anonymous-usage-report.enabled and kestra.ui-anonymous-usage-report.enabled to false to stop both
• Network: the slim image fetches plugins from Maven Central. The Docs MCP server at api.kestra.io is public and read-only and never connects to your instance. Three of the skills need network access to api.kestra.io
• AI Copilot: it answers only once you configure a model provider. In 2.0.0, setting kestra.ai.enabled to false still leaves the button and Fix with AI working, a known issue the page lists
• Removal: press Ctrl+C to stop the container. The volumes stay, and docker volume rm kestra_data kestra_db wipes them