arkade Is Still the Fastest Way to Bootstrap a Dev Cluster — Here's What 4,600 Stars Won't Tell You

I keep finding arkade on machines I didn't put it on. New hires, contractors, that one stubborn teammate who insists on installing kubectl from a curl-bash script he found in 2019 — they all eventually land on arkade get. With 4,600+ stars and a commit cadence that hasn't slowed down since 2020, this thing has quietly become infrastructure, even if nobody calls it that.

The repo landed on my radar again because of a recent push that touched oci install symlink handling, registry auth, and a new gha-bump vendoring. That's a lot of churn for a tool most people think of as "that one CLI installer." Let me walk through what arkade actually is in 2026, what the recent commits tell us about its direction, and whether it deserves a spot in your dotfiles.

What It Actually Does

Strip away the README's "open source marketplace" language and arkade is three things glued together:

1. A CLI downloader (arkade get) that fetches binaries straight from upstream GitHub releases, with OS/arch detection and version pinning.
2. A Kubernetes app installer (arkade install) that wraps Helm and the raw kubectl apply path for ~53 apps, with sane defaults exposed as flags.
3. An OCI installer (arkade oci install) that pulls binaries from container registries — newer, less polished, but filling a real gap.

There's also a system package mode for installing OS-level deps, a Helm chart bumper, and a CI helper (arkade gha) for GitHub Actions. The breadth is the point. The tagline in the README — "the brew install of Kubernetes" — is honest if you squint.

What it isn't: a package manager. There's no dependency resolution, no lock file, no transactional updates. You run arkade get kubectl, it drops a binary in ~/.arkade/bin/. That's it. If you want Helm 3.14.0 instead of whatever's latest, you pass --version.

Why It Matters

The ecosystem gap arkade fills is real and embarrassing. Every fresh dev machine or CI runner faces the same gauntlet: install kubectl, kind/k3d, helm, kustomize, stern, jq, yq, the list of CNCF tooling nobody maintains a single canonical installer for. apt is months behind. brew doesn't ship everywhere. The official install scripts are copy-pasted from old Stack Overflow answers.

What arkade does is treat each tool's GitHub releases page as the source of truth and grab the right binary. That's it. It's a 200-line solution to a problem the Linux package maintainers refuse to coordinate on.

The timing is interesting too. The recent commit log shows a clear pivot toward OCI — oci install, oci login, oci publish, symlink containment, digest validation. Whoever owns arkade (Alex Ellis, predominantly — 641 of the commits are his) is preparing for a world where CLIs ship as OCI artifacts. That's not a guess, it's in the diff: three commits in the last week alone harden oci publish against symlink traversal and cycle attacks. This is real engineering work, not feature creep.

Key Features Worth Knowing

arkade get with smart tool detection. Run it without args and it'll sniff your kubeconfig and only fetch what you're missing. This is the killer feature nobody talks about. On a CI box with no context, it's a downloader. On a developer's laptop, it's a one-shot bootstrap.

53 pre-wired Kubernetes apps. ingress-nginx, cert-manager, argocd, openfaas, k3s, istio, portainer — they all install with arkade install <name>, with flags exposed instead of values.yaml gymnastics. The README compares itself to Helm and the comparison is fair: arkade is the "happy path" install, Helm is the "I need 27 custom values" install.

arkade oci for the next generation. Worth highlighting because it's the direction. arkade oci install alexellis/slicer-agent is a clean replacement for the curl-pipe-sh pattern. The recent work on registry auth, symlink containment, and digest pinning tells me the maintainer is taking the security side seriously — there are real CVE-shaped failure modes for "fetch a binary from a registry and run it," and they're closing them.

arkade gha-bump for GitHub Actions. A small but sharp utility for keeping pinned action versions fresh. Vendored fresh in the latest release.

Aliases baked in. ark is wired up at install time. Tiny thing, but it removes friction every single day.

Who Should Use This

Use arkade if:

• You spin up Kubernetes clusters often and you're tired of typing helm repo add for the same five charts.
• Your CI runners need kubectl/helm/kustomize without maintaining a custom Docker image.
• You're teaching someone Kubernetes and want to skip the 20-minute preamble.
• You want OCI-based binary distribution and arkade oci install already speaks it.

Don't use it if:

• You need reproducible, locked-down builds in regulated environments. arkade reaches out to upstream releases at runtime. Pin versions with --version and verify checksums if you must.
• You want a single tool to rule every machine. arkade doesn't pretend to replace apt or brew for system packages. It complements them.
• You need enterprise support contracts. This is one maintainer's project with a small group of regulars (nitishkumar71, rgee0, Waterdrips round out the top five contributors). The bus factor is real.

Concerns and Limitations

A few honest gripes from poking at the codebase and the commit log.

Catalog freshness is community-driven. The 204 CLIs and 53 apps are maintained by the same folks who file issues when a tool renames its binary or switches release hosts. If your favorite tool isn't in there, the path is to open a PR with a new entry — but that means the catalog can lag behind reality. I've personally hit arkade get returning a 404 because the upstream renamed a release asset, and the fix took a few days.

The vendor tree is getting chunky. Look at the go.mod — there's docker/cli, docker/docker-credential-helpers, opencontainers/image-spec, all the registry plumbing, plus sethvargo/go-password and gopkg.in/fsnotify.v1. That's a lot of transitive code for a CLI installer, and the security surface area of oci install is non-trivial. The recent symlink hardening commits suggest the maintainer knows this. I'd still want to audit what you're running before pointing this at a production fleet.

One-person bus factor. Alex Ellis has 641 commits. Dependabot has 92. The next human contributor has 52. If Alex steps away, the project will keep building, but the catalog curation rate will slow down. That's fine for a tool that's largely a curated list of URLs, but it's worth knowing.

The system-packages mode is uneven. It's billed as a way to install OS packages too, but it really shines on Linux and is awkward elsewhere. If you're on macOS, brew is still faster.

arkade install flattens Helm. This is a feature, mostly, but the FAQ entry "How does arkade compare to helm?" doesn't hide the tradeoff: arkade wraps Helm in a way that hides values.yaml complexity, which is great for happy paths and bad for the 5% of cases where you need to do something the maintainer didn't anticipate. The escape hatch is --set, but you can feel the abstraction straining past 6-7 overrides.

Verdict

Install it. curl -sLS https://get.arkade.dev | sh and put export PATH=$HOME/.arkade/bin:$PATH in your shell rc. Use arkade get for the half-dozen CLIs you forget the exact download URL for. Use arkade install to spin up the cluster add-ons you don't want to write a values.yaml for at 11pm.

It's not going to replace your package manager. It won't solve reproducibility. It won't ship enterprise support. What it will do is shave 20 minutes off every cluster bootstrap and every new laptop setup, and it will keep doing so for free, indefinitely, with one person's full attention behind it.

The recent OCI work — symlink containment, digest pinning, registry auth, the slicer-agent and signet shortcuts — is the strongest signal I can ask for that this project is being maintained by someone who thinks about security, not just features. That's the difference between a weekend hack with 4,600 stars and a tool I'd actually put in my dotfiles.

Repo: github.com/alexellis/arkade