A Practical Guide to SSH Tunnels: Local and Remote Port Forwarding
SSH port forwarding explained in a clean and visual way. How to use local and remote port forwarding. What sshd settings may need to be adjusted. How to memorize the right flags.
Materials by Ivan Velichko
Explore tutorials, challenges, courses, and more published by this author.
Tutorials by Ivan Velichko
See all →How Servers Work: A Hands-On Introduction to TCP Sockets
Learn how servers actually work by building a tiny TCP server and client from scratch. A hands-on introduction to sockets, TCP, and the network programming model every backend, DevOps, and platform engineer should go through at least once.
Tutorial on Containers
How Container Registries Work: Pushing and Pulling Images By Hand
Container registries look simple until you need to debug what was actually pushed, why a pull picked the wrong image, or why deleting a tag didn't remove anything. Learn how registries work by pushing, pulling, inspecting, and deleting image data directly through the Registry API.
Tutorial on Containers
What Is a Standard Container: Diving Into the OCI Runtime Spec
Are all containers just Linux processes? How does the OCI runtime specification define a container? What platforms do OCI containers support? What is a Docker container? Linux containers vs. Virtual Machine containers.
Tutorial on Containers
How Container Images Actually Work: Layers, Configs, Manifests, Indexes, and More
A practical deep dive into container image internals that will help you build a clear mental model of how images are composed, identified, stored, and distributed across registries.
How Kubernetes Reinvented Virtual Machines - In a Good Sense
How Virtual Machines were used to deploy services. What old problems containers solve and what new problems create. How Kubernetes used containers to recreate Virtual Machines in a better way?
Challenges by Ivan Velichko
See all →Debug a Go Container Image That Fails to Start After a Recent Change
A Go service that has always been shipped as a static binary in a scratch-y image suddenly fails to start in a container, while the local build works as before. Find what recent changes caused it and fix the image without reverting them.
Submissions: 9/20
Access a Private Kubernetes API Server Through an SSH SOCKS Proxy
The production Kubernetes cluster lives inside a private VPC, and its API server has no public endpoint. Turn an SSH connection to the bastion host into a SOCKS proxy and teach kubectl to use it, so the cluster becomes manageable from your workstation.
Automate Drive Provisioning With a Shell Script
Turn the manual storage provisioning workflow into an automation script: partition, format, mount, and persist a blank drive with a single non-interactive script.
Submissions: 36/126
SSH 101: Replace Password-Based Root Access with a Key-Based Admin Login
A newly provisioned server is reachable as root with a shared seed password. Create a sudoer admin user, switch SSH to key-based access, disable password and root logins, and retire the seed credential.
Submissions: 126/357
Reach a Remote Loopback Port Through an SSH Jump Host
An inventory service lives inside a private VPC and keeps its debugging port bound to 127.0.0.1. Use SSH local port forwarding with a jump-only bastion to query the debugging port from your workstation.
Submissions: 117/194
Reach Internal Servers Through a "No Shell" SSH Bastion
The application fleet lives inside a private VPC, reachable only through a locked-down bastion that refuses to give you a shell. Find a way to jump through the bastion and place a maintenance lock on two misbehaving servers.
Submissions: 75/95
Courses by Ivan Velichko
See all →Work-in-Progress
Hands-On Firecracker: microVMs From First Principles to Production
A hands-on introduction to Firecracker that takes you from booting your first microVM to building secure, production-ready sandbox infrastructure. Learn how to launch and control microVMs, wire up networking, share data efficiently, and harden execution - the essential skills for running autonomous agents and untrusted workloads safely at scale.
Computer Networking Fundamentals For Developers, DevOps, and Platform Engineers
A heavily illustrated introduction to the first two layers of Computer Networking: Ethernet and IP. A must for any developer or DevOps engineer who wants to build solid understanding of computer networking before they move to the higher-level protocols like TCP, UDP, and even HTTP.
Work-in-Progress
An Alternative Introduction to Dagger: Understanding the Core Concepts
Build a mental model of how Dagger works by migrating an example software project from traditional script-based automation to a Dagger-powered development workflow, peeking under the hood of the new technology on the way.
Course on Containers
Work-in-Progress
How (and Why) to Use containerd from the Command Line
Explore containerd with ctr, its default command-line client, try nerdctl as a potential Docker alternative, and learn how to debug Kubernetes Pods with crictl.
Shell Gyms by Ivan Velichko
See all → Shell Gym , on Linux
Linux 101: Meet the Linux Shell
Your first hands-on session in a Linux terminal. Practice running commands, reading their output, using arguments and options, checking whether commands succeed or fail, and chaining commands together. No prior Linux experience is required.
Skill Paths by Ivan Velichko
See all →Master SSH Tunnels: Local and Remote Port Forwarding
Learn how to reach an internal port on a remote machine from the local system, jump through a bastion into a private VPC, expose a development server to the Internet through a reverse tunnel, publish a home network device, and spin up a full-fledged SOCKS proxy with nothing but a regular SSH connection.
Linux Storage 101: Drives, Partitions, and Mounts
Practice the most common Linux storage operations in a series of hands-on challenges: discover and mount drives, create partition tables, format partitions with different filesystems, map directories with bind mounts, and make mount points survive a reboot.
Docker 101: Pull and Push Container Images
Learn how to move container images between your machine and container registries. Practice pulling images by tag, digest, and platform; tagging and pushing them to public and private registries; mirroring images across repositories; shipping images into air-gapped environments; and publishing multi-platform images.
Docker 101: Build Container Images
Learn how to write Dockerfiles from scratch and build production-ready container images. Start with the basics of image building and progress through handling dependencies, compiling applications, inspecting image internals, and optimizing builds with multi-stage Dockerfiles. Then go deeper with advanced Dockerfile instructions, analyzing image internals, and producing multi-platform builds.
Docker 101: Run and Manage Containers
Go from zero to a confident Docker beginner. Learn how to run containers of all kinds, interact with them, and build a clear mental model of how Docker manages your applications behind the scenes.
Beyond Docker: Run Containers Across Runtimes
Explore how different container runtimes - Docker, Podman, nerdctl, ctr, and runc - execute containers. Compare their UX, architecture, and impact on containerized applications.
Playgrounds by Ivan Velichko
See all →This playground was created by an iximiuz Labs user and is provided with no warranty.
HotROD + Jaeger on K3s
Jaeger's HotROD demo app pre-deployed on a 3-node K3s cluster, wired to a Jaeger v2 all-in-one over OTLP. Click a customer, then read the trace.
This playground was created by an iximiuz Labs user and is provided with no warranty.
OpenClaw on K3s with agent-sandbox + gVisor
A 3-node K3s cluster with gVisor (runsc), the kubernetes-sigs/agent-sandbox controllers, and the OpenClaw + gVisor example pre-deployed. OpenClaw's Control UI is available as a dedicated tab.
This playground was created by an iximiuz Labs user and is provided with no warranty.
OpenTelemetry Demo on k3s
A snapshot-backed three-node k3s cluster with the complete OpenTelemetry Demo, including Jaeger and Grafana.
This playground was created by an iximiuz Labs user and is provided with no warranty.
Dual-Network Router Lab
Five Ubuntu VMs across public and private subnets, joined by a dual-homed router. The private subnet has no direct Internet access.
This playground was created by an iximiuz Labs user and is provided with no warranty.
This playground was created by an iximiuz Labs user and is provided with no warranty.
Docker on Btrfs
Hands-on Docker on Btrfs: experiment with native snapshots, compression, and checksums; inspect setup, grow the filesystem live, and back up/restore images and containers.