Focused, hands-on DevOps and server-side problems with hints, feedback, and automated solution checks.
Run a Deployment under the container runtime's seccomp profile, roll out a custom profile to the worker nodes, and fix a profile that blocks a syscall the application needs.
The platform team is rolling out Pod Security Admission. A monitoring agent is already blocked, the storefront team needs a staged rollout, and payments must move to the strictest level without losing its running service.
kubectl is dead: the kube-apiserver certificate expired and the control plane is down, while the workload quietly keeps serving. Diagnose the expiry offline, renew the certificates, bring the control plane back, and prove the cluster recovered.
Kubernetes 1.37 can hand every pod its own short-lived X.509 identity, no service mesh and no sidecar involved. The API is served out of the box, but it issues nothing without a signer, and a request nobody answers leaves the pod waiting forever. Get a stalled workload its certificates, give its client an identity of its own, and make the server actually enforce mutual TLS.
A daemon exposes a Unix domain socket that every local user can talk to. Protect it so that only root and members of a dedicated group may connect - the same way Docker restricts access to /var/run/docker.sock.
A deployment is failing because the application cannot load its TLS certificate. Create the missing secret and mount it into the deployment so the Flask app can serve TLS traffic.
Set up your own OCI-compatible container registry with username/password authentication and HTTPS - the kind of protection you'd expect before using a registry in production.
Investigate a potentially compromised CI host. A sandboxed "agent" running in the background is suspected of breaking out - confirm the breach and neutralize it without taking the sandbox down.
Build a container image for a Node.js app that uses a private npm package without leaking the registry credentials into the image layers.
Learn how to taint a node, schedule a Pod using nodeSelector and tolerations, and share the host network, PID, and IPC namespaces with the Pod.
