Restrict SSH Bastion Access by User Role
Harden a bastion host so only admins can get a shell on it, operators can open tunnels to arbitrary destinations, and developers can reach only the one internal service they actually need.
Focused, hands-on problems for sharpening your DevOps and server-side skills. Some teach specific concepts while others mirror real-world scenarios. Every challenge includes hints, feedback, and automated solution checks.
Challenges crafted by iximiuz Labs to help you master DevOps and Server Side topics.
Harden a bastion host so only admins can get a shell on it, operators can open tunnels to arbitrary destinations, and developers can reach only the one internal service they actually need.
Sometimes an image needs to be removed from a registry - because it was pushed by mistake, contains sensitive data, or simply should no longer be available. Practice purging a container image properly: remove the tag, trace it to the manifest and blobs behind it, and make sure the image can no longer be pulled - even by digest.
An internal service is halfway through a Python-to-Go rewrite: the amd64 build already runs the new Go code while arm64 still ships the legacy Python one - same API, two completely different codebases and Dockerfiles. Can you build and push a single multi-platform image from the two independent single-platform variants?
Combine your knowledge of QEMU emulation, cross-compilation, and remote builders to build and push a multi-platform container image (linux/amd64 + linux/arm64) to a registry.
Save a container image as an OCI layout, extract its filesystem layers, and mount them together using OverlayFS to get a flat container-like rootfs.
Create two partitions on a blank disk: one smaller ext4 for service logs and the rest btrfs for service data. Mount both and prove they work.
Learn how to build a secure, lightweight, and production-ready Python container image for a FastAPI application by following this hands-on challenge full of practical tips and tricks. Solutions for pip + venv, poetry, and uv are included.
Learn how to build a secure, lightweight, and production-ready container image for a dynamically linked Go application by following this hands-on challenge full of practical tips and tricks.
Hack your way through this challenge making the OOM kills invisible again.
An ultimate Kubernetes debugging challenge: can you copy files to/from a running Pod that doesn't have a shell or other command line tools installed?