Every lab runs in a disposable, in-browser sandbox with automated validation. 15 labs are free - the Linux labs plus two AI platform labs - and the other 82 open once your account is approved.
Running the 60-day cohort? Open the AI Platform Engineering syllabus.
New to a topic? Read the lesson first — model, commands and pitfalls, then the lab. Looking for a themed sandbox? Open the playgrounds.
Loading the lab catalog...
Linux labs and two AI platform labs are free. Sign in to request the rest.
Sign in to request97 labs
DevOps Pre-Requisites
Learn pre-requisites for DevOps practices including CLI navigation, package management, DNS, and programming language basics for Java, Node.js, and Python.
Create directories and files, then write content into them using redirection.
Practise absolute and relative paths. Navigation is state: where you stand matters.
Back up a directory, rename a file and clean up junk - the three operations you do every day.
Turn raw logs into answers. Count lines, isolate errors and filter out noise.
Use find to locate files by name and type anywhere under a tree.
Pick exact matches out of log files: case-insensitive, numbered, and recursive.
Update the package index, install and remove software with the Debian package manager, and inspect the package database. Graded against the dpkg database, not the terminal.
Start, enable and stop services with systemctl, and capture a unit's status. State is graded from systemd's own files, not from the screen.
Turn the names in /etc/hosts into IP addresses with a resolver, and inspect which resolver the machine is configured to use.
Compile a Java source file with javac and run the resulting class with java - the two commands every Java job starts with.
Use Maven to compile a project and package it into a jar, reading the coordinates from pom.xml.
Build the application, stage the artifact in /opt/deploy and describe its entry point in a manifest.
Wire a Node.js installation onto your PATH and confirm both node and npm resolve.
Initialise a package and manage its dependencies with npm, graded from package.json and node_modules.
Create a Python virtual environment, put it on PATH and confirm the interpreter version.
Install packages from a requirements file and the environment, then freeze the exact set. Graded from the venv's site-packages.
Collect facts about the machine into one report file, appending as you go.
Confirm which hosts are up, learn this machine's own address, and read the routing table that decides where packets go.
See which services a machine exposes, fetch one over HTTP, and capture what the firewall does to a blocked host.
A user reports 192.168.0.99 is down. Work the standard diagnostic toolkit - ping, traceroute - then prove your tooling by curling a healthy host.
Linux Administration
Essential Linux skills for DevOps. Learn shell scripting, package management, networking, security, and system administration.
Create a script file, give it a shebang and the execute bit - the anatomy of every script.
Write a multi-line script, make it executable, run it, and capture its output to a file.
Set precise file permissions and change ownership, exactly as you would on a real server.
Lock down a website tree: tighten every directory, hand ownership to root, then open one public file.
A deploy that worked yesterday now fails with 'Permission denied', and the file is still there. Read the mode, work out which of the three permission sets is wrong, and fix that one — without opening the file to everybody. Graded on the file's mode.
The service is running, the page loads, and it stopped again after last night's reboot. Someone started it instead of enabling it. Bring it up and make it survive a reboot. Graded on systemd state.
Git & Version Control
Master Git version control from basics to advanced topics. Learn branching, merging, remote repositories, and collaboration workflows.
Turn a plain project folder into a version-controlled repository, stage every file, and record the first commit.
Work the day-to-day loop on an existing repo: stage a changed file, commit it, then add a new file in a second commit.
Branch off, change the same file on two branches, merge, then resolve the conflict into a clean merge commit.
Stand up a bare repository as your own code host, wire it up as a remote, and push your history to it.
AWS Cloud
Learn Amazon Web Services hands-on: configure the AWS CLI and IAM, launch an EC2 instance behind a least-privilege security group, and lock down an S3 bucket. Graded against the account state the CLI actually wrote.
Point the AWS CLI at your account, then give a group read-only access and add a user to it. Graded against ~/.aws and the IAM store the CLI wrote - never against the terminal.
Open SSH from one address only, launch an instance into that group, and read the instance back from the API. Graded against the CLI's own resource store.
Create a bucket in the configured region, then make it private by default: versioning, encryption at rest and a public-access block. Graded against the bucket's own settings.
Create a group with read-only S3 access, add a user to it, and issue access keys - proving the user inherits exactly the group's policy and nothing more. Graded against the IAM store the CLI wrote - never the terminal.
Docker
Containerize an application hands-on: write a Dockerfile, build an image, run it as a container publishing a port, then describe a web-and-database stack in Docker Compose and bring it up with its own network and named volume.
Write a Dockerfile for the Node.js app in ~/web-app, build it into an image, and run that image as a named container publishing port 3000. Graded against the image store and the container's config the daemon wrote - never the terminal.
Describe the web and database services of ~/stack in a docker-compose.yml, add a named volume for the database, and bring the project up with Compose. Graded against the containers, network and volume the project created.
Kubernetes
Master container orchestration with Kubernetes. Learn pods, services, deployments, and YAML configuration through hands-on practice.
Declare a Pod running Nginx in ~/k8s/web-pod.yaml and apply it, then put a Service in front of it that selects the Pod's label on port 80. Graded against the objects the API server (the cluster state file) actually holds - never the terminal.
Move from a bare Pod to a Deployment: declare three replicas of Nginx, apply it, then add a ConfigMap carrying the app's configuration so the workload is self-describing. Graded against the cluster state.
Take the existing Node app from source to a running container, then declare the same workload in Kubernetes: a two-replica Deployment and a Service on port 80. Graded against the Docker daemon state and the cluster state - not the terminal.
Create a ConfigMap holding application configuration, then run a Pod that reads it as environment variables. Graded against the cluster state the API server actually holds - never the terminal.
Add a Helm chart repository, install a release into the cluster, list deployed releases, then uninstall it. Graded against the Helm release state the CLI recorded - never the terminal.
From the CKA task set: a HorizontalPodAutoscaler named apache-server must target a Deployment in the autoscale namespace, aiming at 50% CPU per Pod, between 1 and 4 Pods. The cluster starts empty here (the exam gives you the Deployment already), so create both. Graded against the cluster state.
From the CKA task set: expose container port 80 of the nginx container in the front-end Deployment through a Service named front-end-svc, in the spline-reticulator namespace. The exam hands you the Deployment; the cluster starts empty here, so create it first. Graded against the cluster state.
From the CKA task set: the NGINX Deployment nginx-static is configured by the nginx-config ConfigMap, and TLS 1.3 must be the only accepted protocol. Create the ConfigMap with ssl-protocols set to TLSv1.3, then deploy nginx-static in that namespace. Graded against the ConfigMap state and its manifest.
A Pod without an Ingress is only reachable by port-forward. Declare an Ingress named web for the host web.ophir.local, routing / to the Service web on port 80, with TLS terminating at the secret web-tls. Graded against the Ingress object.
The database Pods in the data namespace should accept connections from the frontend and from nowhere else. Write a NetworkPolicy that selects app: db, declares Ingress in its policyTypes, and allows only Pods labelled app: frontend. Graded against the policy object the API server stored.
The Deployment is ready, the Service exists, and `curl` to it hangs. The Service selects a label no Pod carries. Find the mismatch, fix the manifest and re-apply it — a live patch that the YAML still contradicts will come back. Graded against the Service object and the file.
Terraform
Infrastructure as Code with Terraform. Learn HCL syntax, providers, variables, state management, and AWS resource provisioning.
Describe an AWS instance in ~/terraform/main.tf: configure the provider, declare an aws_instance, then init and apply. Graded against the configuration on disk and the state Terraform wrote - never the terminal.
Parameterize the configuration with an input variable, create two instances with count, and expose an output. Graded against the applied state: the instances must carry the variable's value.
Factor a bucket into a local module under ./modules/storage, call it from the root configuration, and apply. Graded against the state, where the module's resource must appear as module.storage.aws_s3_bucket.data.
Observability
Read the failure from real logs, count errors, capture the failing request, bring the service back and leave an executable health check behind. Graded against files and systemd state.
An API is down. Count the errors in its log, capture the failing request id, bring the systemd unit back up, enable it at boot and write a health-check script. Graded against the log-derived files and systemd state.
Write a prometheus.yml with scrape targets for the application and node exporter, then define an alerting rule that fires when the error rate exceeds a threshold. Graded against the config files on disk.
Create a Grafana dashboard for application metrics, list it, then remove it. Graded against the dashboard state the CLI recorded.
Security & DevSecOps
Find a leaked secret, move it into the environment, ignore the real env file, lock its permissions and stage only safe files.
A real key is sitting in config.js and .env is one commit away from being exposed. Move the key to an environment variable, ignore .env, lock its permissions, add a safe example file, then stage only the safe files.
Read a Trivy scan report showing a CRITICAL CVE in a base image, then write a remediation plan that upgrades the image, pins the fixed package version and documents the risk acceptance. Graded against the remediation files on disk.
Two of the cheapest container wins: never run as root, and never bake secrets into the build context. Pin the base image, drop to a non-root user, keep .env and node_modules out of the build, then build the hardened image.
Ansible
Automation with Ansible. Learn YAML syntax, inventory management, playbooks, modules, variables, and conditional logic through an nginx configuration lab.
Write a site.yml playbook for the local web host, then run it with ansible-playbook: install nginx with apt, copy the site config with copy, and start/enable it with service. Graded against the package database, filesystem and systemd state.
Write an Ansible playbook that installs the httpd package and starts/enables the service, then run it against localhost and verify the service state. Graded against the package database and systemd files Ansible wrote.
Jenkins
CI/CD with Jenkins. Learn installation, configuration, CLI usage, backup/restore, and building continuous delivery pipelines.
Author a Jenkinsfile with agent, build and deploy stages, then a post block that always runs.
Write a GitHub Actions workflow that builds, tests and deploys an application on push to main. Graded against the workflow file on disk.
A pipeline that deploys something untagged cannot be rolled back to. Version the app, commit it, build an image from that version, and make the workflow fire on a tag rather than on every push. Graded against the repository and the image store.
Python Programming
Python fundamentals for DevOps. Learn syntax, data structures, functions, control flow, and programming concepts essential for automation through a health-check CLI lab.
Create a Python virtual environment, pin requests and pytest, write an argparse health-check CLI that exits non-zero on a bad response, and leave a run script. Graded against the environment and project files.
Artificial Intelligence
Free hands-on labs for Artificial Intelligence: index and evaluate a retrieval knowledge base, define an MCP tool contract and assemble a LangChain retrieval chain. Gemini labs are being written.
Index the support docs, retrieve the refund policy with source attribution, and write a grounding prompt that forces answers to use only the supplied context. Graded against the retrieval index and output files.
Index the support docs, retrieve the refund policy, test an out-of-scope question and write an evaluation that records the cited answer and the honest no-answer result. Graded against the retrieval outputs and eval.md.
Define an MCP server and a search_docs tool with an input schema, then document the input/output/error contract and the rule for when the model should call it.
Pin LangChain, write a retrieval chain with a prompt template and string parser, and add a run script that invokes it with a question. Graded against the environment and files.
The introductory MCP exercise, without a model: register a local server in the client settings, define one tool's input schema, and write the transcript that shows when the model must call it and when it must refuse. Graded on the files a client would actually read.
LangGraph makes the control flow explicit: a typed state, named nodes, and edges between them. Define the state, wire retrieve → answer with START and END, then pin the dependency and provide a run script. Graded on the graph definition, not on a model call.
AI Platform Engineering
The hands-on half of the 60-day AI Platform Engineering cohort: request a GPU in the scheduler, serve Llama 3 with vLLM, lock model weights down in object storage, keep a Hugging Face token out of the manifest, and ship the whole thing with Terraform and a deploy workflow. No accelerator is provisioned - these labs grade the manifests and policies you would apply.
Open the 60-day syllabusSchedule an inference workload that asks the cluster for an accelerator, runs the vLLM image, and is reachable on 8000. The sandbox simulates the scheduler and grades the manifest - no GPU hardware is provisioned.
Stand up an OpenAI-compatible inference server: the Hugging Face token in a Secret, the model selected with a vLLM argument, and a Service on 8000. Graded against the cluster state - the model itself is not downloaded here.
Model weights are the most valuable object in an AI platform. Create a dedicated bucket, version it, encrypt it, and block every public access path. Graded against the S3 store the CLI wrote - never the terminal.
A Hugging Face token in a committed manifest is a leaked token. Create it as a Secret, reference it with secretKeyRef, and prove the YAML itself contains no credential. Graded on the files and the cluster state.
The cohort milestone: provision the namespace with Terraform, apply a GPU-requesting inference workload with its Secret and Service, and write the workflow that redeploys it on a tag. Graded across the Terraform state, the cluster and the workflow file.
MLOps
Build reproducible machine-learning environments: pinned dependencies, a trainable script, persisted models and a run entrypoint. The second lab adds a Flask serving API with health and prediction endpoints; the third versions a dataset with DVC; the fourth restores a dataset from the DVC cache and remote; the fifth logs an MLflow experiment and registers its model; the sixth deploys a model-serving workload on Kubernetes; the seventh containerizes a Streamlit dashboard; the eighth containerizes a FastAPI inference API; the ninth hosts a model API on an EC2 VM with Nginx, Gunicorn and systemd; the tenth deploys a KServe InferenceService; the eleventh adds an HPA for the serving workload. The rest of the path is being written.
Write a document covering the MLOps pillars, the gap between data science and production, and common reasons models fail after deployment. Graded against the document on disk.
Write a lifecycle map from data collection to monitoring and a failure report that names detection, mitigation and prevention. Graded against the two documents.
Pin the dependencies, write a training script that reads the dataset, persist the model, and add a run script.
Create a virtual environment, pin Flask, then write a serving API with /health and /predict, a container image that exposes port 8000 and a run script. The install is graded in the venv; the API is graded on the files it defines.
Initialise DVC, add data.csv to its cache, configure a storage remote and push the object. Graded against .dvc/config, data.csv.dvc and the remote object store.
The working copy is gone but the DVC cache and metadata are present. Check out the data, configure the remote, push the object, delete the cache and pull it back. Graded against the working copy, cache and remote state.
Create a venv with MLflow installed, write a training script that opens a run, logs parameters, metrics and an artifact, registers the model, and leave a run script that points MLflow at a local tracking store. Graded against the installed packages and the files.
Declare a two-replica model-serving Deployment, inject MODEL_PATH from a ConfigMap, expose it through a Service on port 80 and apply all three. Graded against the Kubernetes object state.
Write a Dockerfile for the Streamlit dashboard, build and tag the image with port 8501 exposed, confirm the start command, and run it as streamlit-app with host port 8501. Graded against the Docker daemon state.
Write a FastAPI app with /health and /predict, containerize it with Uvicorn on port 8000, build the image and run it as fastapi-app. Graded against the API files and Docker daemon state.
Provision a public web security group and a tagged EC2 instance, then configure the VM's Gunicorn unit, Nginx reverse proxy and systemd services. Graded against the AWS store and the sandbox service state.
Write a KServe InferenceService for churn, point it at the model artifact, set the sklearn runtime, apply it with kubectl and verify the applied CRD fields. Graded against the KServe object state.
Deploy the churn-api workload, declare a HorizontalPodAutoscaler targeting it, and set 2-5 replicas with a 70% CPU target. Graded against the Kubernetes and HPA object state.
Create a venv with pandas and scikit-learn, write a feature-engineering script that splits the data, scales the feature and writes features.csv, and leave a run script. Graded against the environment and files.
Document the model's intended use, limitations, metrics and owner, then define the roles and approval gate that move it from experimentation to operations.
A pinned requirements file on your laptop is not reproducibility — the laptop is the variable. Pin the environment, put the training run in an image, and build that image so anyone can run the same job. Graded against the files and the image store.
A feature pipeline that silently accepts bad data produces a model that silently fails. Declare the schema, write a validator that exits non-zero when the data violates it, and wrap it in a run script. Graded on the contract and the validator.
A model without paperwork cannot be audited, rolled back or defended. Write the model card a reviewer needs, and the lineage record that says which data and which run produced this artefact. Graded on the required fields.
Tracking is only useful if it changes a decision. Query the experiment, pick the run with the best accuracy, and register that run as the model — instead of shipping whichever notebook was open last.
A model that raises a stack trace on bad input is not an API. Give /predict a typed contract, return 422 for a violation instead of a 500, and pin that behaviour with a contract test.
Two units run side by side: the stable model on 8000 and the candidate on 8001. Bring the candidate up, prove it is healthy, then move Nginx's upstream to it — a release you can undo by editing one line. Graded on service state and the proxy config.
Run the stable model and the candidate side by side, then point the Service at the candidate by changing one label. Rollback is the same edit in reverse — no rebuild, no redeploy.
Capstone
Build an image, declare the Kubernetes workload, write the GitHub Actions workflow, commit the GitOps source and sync it through Argo CD. One end-to-end delivery path graded across Docker, Git, Argo CD and the cluster.
Build the web app image, write the Kubernetes Deployment and Service, add a GitHub Actions workflow, commit the GitOps source, then register and sync the app with Argo CD. Graded against Docker, Git, Argo CD and cluster state.
Build a containerized app, write a Trivy security scan step, declare the Kubernetes workload and register it with Argo CD. Graded against Docker, the security scan file, the cluster and Argo CD state.