Focused, hands-on DevOps and server-side problems with hints, feedback, and automated solution checks.
On a dual-homed Linux server, a service bound to one network's IP address may still be reachable from another network. Learn how to prevent this unexpected access without disrupting legitimate connections.
On a dual-homed Linux server, a service bound to the IP address of one interface may still accept connections that arrive through the other interface. Learn how to reach such a service through an interface it doesn't listen on, using a routing trick.
A stock Django + Strawberry GraphQL service ships with five common weaknesses. Probe each one from the terminal, fix it in the real project, and watch the lab confirm the remediation against the live endpoint.
Play a security researcher: identify the hosts a black-box container keeps making encrypted HTTPS calls to, route them through a MITM proxy, fake the certificate, and see what the container sends over the network.
Run a Deployment under the container runtime's seccomp profile, roll out a custom profile to the worker nodes, and fix a profile that blocks a syscall the application needs.
The platform team is rolling out Pod Security Admission. A monitoring agent is already blocked, the storefront team needs a staged rollout, and payments must move to the strictest level without losing its running service.
A common setup for small deployments: two servers (VM or bare-metal), each with a public and a private IP. The app listens on the public port but wants to talk to Redis over the private network. Can you set it up?
The security team left five NetworkPolicy files on the workstation. Only one of them lets the frontend reach the backend while granting nothing more. Identify it and deploy it, unchanged.
kubectl is dead: the kube-apiserver certificate expired and the control plane is down, while the workload quietly keeps serving. Diagnose the expiry offline, renew the certificates, bring the control plane back, and prove the cluster recovered.
Kubernetes 1.37 can hand every pod its own short-lived X.509 identity, no service mesh and no sidecar involved. The API is served out of the box, but it issues nothing without a signer, and a request nobody answers leaves the pod waiting forever. Get a stalled workload its certificates, give its client an identity of its own, and make the server actually enforce mutual TLS.
