Focused, hands-on problems for sharpening your DevOps and server-side skills. Some teach specific concepts while others mirror real-world scenarios. Every challenge includes hints, feedback, and automated solution checks.
A Go service that has always been shipped as a static binary in a scratch-y image suddenly fails to start in a container, while the local build works as before. Find what recent changes caused it and fix the image without reverting them.
The production Kubernetes cluster lives inside a private VPC, and its API server has no public endpoint. Turn an SSH connection to the bastion host into a SOCKS proxy and teach kubectl to use it, so the cluster becomes manageable from your workstation.
Turn the manual storage provisioning workflow into an automation script: partition, format, mount, and persist a blank drive with a single non-interactive script.
A newly provisioned server is reachable as root with a shared seed password. Create a sudoer admin user, switch SSH to key-based access, disable password and root logins, and retire the seed credential.
An inventory service lives inside a private VPC and keeps its debugging port bound to 127.0.0.1. Use SSH local port forwarding with a jump-only bastion to query the debugging port from your workstation.
The application fleet lives inside a private VPC, reachable only through a locked-down bastion that refuses to give you a shell. Find a way to jump through the bastion and place a maintenance lock on two misbehaving servers.
Harden a bastion host so only admins can get a shell on it, operators can open tunnels to arbitrary destinations, and developers can reach only the one internal service they actually need.
A remote VM serves an app on port 80 and keeps an internal debugging port bound to 127.0.0.1. Reach the debugging port from your workstation using an SSH tunnel, without exposing it on the VM's external interface.
A production search cluster lives inside a private VPC and is reachable only from within it. Use SSH local port forwarding through a public-facing bastion host to query the cluster's API from your dev machine.
A payment webhook receiver runs as a local build on your dev machine, bound to 127.0.0.1 and invisible from the Internet. Use SSH remote port forwarding to publish it on a public-facing gateway VM so a test payment provider can reach it.
