Focused, hands-on DevOps and server-side problems with hints, feedback, and automated solution checks.
Run a Deployment under the container runtime's seccomp profile, roll out a custom profile to the worker nodes, and fix a profile that blocks a syscall the application needs.
The platform team is rolling out Pod Security Admission. A monitoring agent is already blocked, the storefront team needs a staged rollout, and payments must move to the strictest level without losing its running service.
A deployment is failing because the application cannot load its TLS certificate. Create the missing secret and mount it into the deployment so the Flask app can serve TLS traffic.
A Pod must be fully isolated from the cluster network. Deny all incoming traffic and block all outgoing traffic except DNS queries on port 53.
A developer named siddhi requires read-only access to specific resources in the production namespace. Create a Role and RoleBinding to grant the minimum required permissions without any write access.
Enforce Kubernetes security best practices by disabling automatic ServiceAccount token mounting and providing a short-lived projected token to the application Pod.
Learn how to control traffic between Pods using Kubernetes NetworkPolicy. Apply a default deny-all policy and then selectively allow only the traffic that is required between frontend and backend Pods.
Learn how to taint a node, schedule a Pod using nodeSelector and tolerations, and share the host network, PID, and IPC namespaces with the Pod.
A multi-tier application runs across two namespaces. Learn how to isolate the application tier and restrict database access to only the application namespace.
Harden a container by implementing a read-only root filesystem with specific writable volumes for nginx. This is a critical security practice to prevent runtime modifications.