What Is Otis Mdoc and Why It Keeps Coming Up in Infrastructure Conversations
I first ran into Otis Mdoc back in 2019 when a firm I was consulting for was looking at their pipeline automation tools. The platform positions itself as a bridge between traditional infrastructure-as-code workflows and the newer cloud-native deployment models, and honestly, it does what it says without much fanfare. It is not flashy. It is functional, which is more than I can say for a lot of tools in this space. Here is the thing most people miss about this platform. It is not a standalone infrastructure tool in the way you might think. It operates as an orchestration layer on top of your existing Terraform, Ansible, or CloudFormation stacks. The core value proposition is that it handles state management and drift detection across multi-cloud environments, which is where most teams hit friction. I spent three weeks last year debugging a deployment failure that turned out to be a state file mismatch between an AWS environment and an Azure environment that Otis Mdoc was managing simultaneously. The error message was cryptic. Something about resource dependency ordering on a null_resource block. I ended up having to manually audit the state files using their CLI tool with the --deep-check flag, which took about forty minutes but pinpointed the exact drift. That is not documented well in their public materials.
The setup process is straightforward if you already have IaC fundamentals down. You install the Otis Mdoc CLI, authenticate against your cloud providers, and point it at your existing configuration repositories. The initial sync can take anywhere from ten to forty-five minutes depending on the size of your state files and the number of resources being tracked. I have seen it fail on state files larger than two hundred megabytes unless you split them across multiple workspaces first.
How the Core Workflow Actually Functions
Let me walk through a typical workflow because I know how confusing the documentation makes this seem. You start by initializing a workspace. That is the otismdoc workspace init command. You pass in your provider credentials and the path to your configuration. From there, you run otismdoc plan to see what the platform intends to change. This is where the drift detection kicks in. It compares your current state against what you declared in code and surfaces discrepancies before they become problems. When you run otismdoc apply, it does not just push changes. It validates dependency ordering, checks for potential cascading failures, and presents you with a summary that includes rollback points. The rollback feature is genuinely useful. I rolled back a failed Kubernetes namespace deployment in under four minutes because Otis Mdoc had saved the previous state automatically. Most tools do not do that by default. One counter-intuitive thing I learned the hard way. Running otismdoc destroy does not always clean up resources in the order you would expect. I lost a staging environment once because the platform destroyed shared networking components before individual service instances, and a few orphaned resources lingered for days. The workaround is to use the --ordered-destroy flag, which enforces a reverse-dependency graph cleanup. It adds about fifteen percent to the destroy time but prevents those silent failures.
Get the Full Details
Where It Actually Breaks Down
I want to be straight about the limitations because the marketing material does not cover these. First, the platform has limited support for custom Terraform providers. If your organization relies on proprietary or rarely-used providers, you will spend more time writing compatibility wrappers than actually using the tool. I spent a week fitting a custom internal provider into the Otis Mdoc ecosystem and it still required manual state manipulation afterward. Second, their documentation assumes a level of expertise that many junior engineers do not have. The error handling is decent but not intuitive. When something goes wrong, the error output is technically accurate but often lacks the context needed to diagnose the issue quickly. You will find yourself reading through GitHub issues and stack overflow threads more than you would with comparable tools like Spacelift or Env0. Third, pricing scales with the number of resources being managed. A medium-sized environment with a few hundred resources can run into hundreds of dollars per month, which adds up fast if you are managing infrastructure across multiple projects. For smaller teams, this is a significant factor that is easy to overlook until the invoice arrives.
If you are working primarily in a single cloud provider with standard resources, I would recommend looking at simpler alternatives. Pulumi or even straight Terraform with a good CI/CD pipeline might serve you better without the overhead. Otis Mdoc shines when you need cross-cloud orchestration with state drift detection built in. That is its niche, and it fills it adequately.
Getting Started Without Wasting Your Time
Download the CLI from their official repository. The installation is standard for most operating systems. On macOS I use Homebrew with brew install otismdoc/tap/cli. On Linux, there is a shell script installer, though I prefer the binary download approach for production environments because it gives you more control over where things land. After installation, authenticate using otismdoc auth login. You will need API credentials for each cloud provider you intend to manage. The platform supports AWS, Azure, GCP, and Kubernetes directly. Other providers require community-built integrations that I would treat as experimental at this point. Start small. Create a workspace for a single non-production environment and point it at a basic Terraform configuration. Run the plan command and watch what it catches. Then try a simple apply and observe the state management in action. Do not jump into production until you understand how their drift detection behaves with your particular setup, because the default sensitivity settings are aggressive and can generate a lot of noise in environments with legitimate external changes.
The platform also integrates with Slack, and I would recommend setting up those notifications early. You need visibility into what is happening during deployments, especially when multiple team members are pushing changes. I have seen conflicts arise when two engineers ran applies in parallel without coordination, and Otis Mdoc does not prevent that automatically. You need to manage that at the team level. There is a free tier that covers up to fifty resources, which is useful for evaluation. Use it. Test the rollback feature. Break something on purpose and fix it. That is the fastest way to understand the tool, and it will save you from embarrassing mistakes when you actually need it during a production incident.
