Enforce TLSv1.3-Only Policy on a Production NGINX Deployment
by Omkar Shelke
Update a production NGINX ConfigMap to restrict TLS to v1.3 only, then verify the change enforces the security policy.
Submissions: 34/41
Challenges
Focused, hands-on problems for sharpening your DevOps and server-side skills. Some teach specific concepts while others mirror real-world scenarios. Every challenge includes hints, feedback, and automated solution checks.
Restrict Access to a Unix Domain Socket
A daemon exposes a Unix domain socket that every local user can talk to. Protect it so that only root and members of a dedicated group may connect - the same way Docker restricts access to /var/run/docker.sock.
Submissions: 50/75
Disable API Server NodePort and Configure kube-scheduler Resource Requests
by Omkar Shelke
Configure the kube-scheduler static pod with CPU resource requests based on node allocatable, and disable the NodePort access to the Kubernetes API server so it is only reachable via ClusterIP.
Submissions: 22/30
Troubleshoot CrashLoopBackOff Caused by a Missing TLS Secret
by Omkar Shelke
A deployment is failing because the application cannot load its TLS certificate. Create the missing secret and mount it into the deployment so the Flask app can serve TLS traffic.
Submissions: 32/45
Verify Kernel Isolation Between Kata Containers and runc Using RuntimeClass
by Omkar Shelke
Prove that Kata Containers Pods run inside a dedicated VM with a separate guest kernel, completely isolated from the host kernel, by comparing kernel versions across runc and Kata runtimes.
Submissions: 21/29
Secure a Container Registry with Authentication and TLS
Set up your own OCI-compatible container registry with username/password authentication and HTTPS - the kind of protection you'd expect before using a registry in production.
Submissions: 35/63
A Simple Sandbox Breakout: Spot It and Stop It
Investigate a potentially compromised CI host. A sandboxed "agent" running in the background is suspected of breaking out - confirm the breach and neutralize it without taking the sandbox down.
Submissions: 42/95
Install a Private npm Package in a Dockerfile Without Leaking Credentials
Build a container image for a Node.js app that uses a private npm package without leaking the registry credentials into the image layers.
Submissions: 32/55
Schedule a Maintenance Pod with Host Namespace Access Using Taints, Tolerations, and NodeSelector
by Omkar Shelke
Learn how to taint a node, schedule a Pod using nodeSelector and tolerations, and share the host network, PID, and IPC namespaces with the Pod.
Submissions: 15/18
Control Cross-Namespace Traffic Using NetworkPolicy
by Omkar Shelke
A multi-tier application runs across two namespaces. Learn how to isolate the application tier and restrict database access to only the application namespace.
Submissions: 13/14