Learn DevOps from zero to production.

313 small steps on one real app. You finish ready for mid and senior DevOps work.

Where Courier runs as you go
  1. 000-046 Your laptop Linux, networking, Git, Python
  2. 047-058 One VPS, by hand systemd, nginx, TLS, backups
  3. 059-099 Containers and pipelines Docker, GitHub Actions, zero-downtime deploys
  4. 100-123 Infrastructure as code Ansible, Terraform, Packer
  5. 124-188 Kubernetes on your VPS k3s, Helm, Argo CD, observability, security
  6. 189-219 AWS, GCP, Azure EKS, GKE, AKS, one session each
  7. 220-312 Own servers, then senior work reliability, platform, FinOps, consulting

One app for the whole course

Courier is a small parcel-tracking SaaS. You never write its features. You make it ship, scale, survive and cost less.

web

Node, Next.js

Tracking page and shop dashboard

api

Python, FastAPI

REST API, auth, shipments. Postgres, Redis, RabbitMQ

worker

Go

Sends notifications and updates statuses from the queue

carrier-mock

Go

Fake carrier that floods webhooks when a step needs it

Failure knobs built in

Every service reads flags that break it on purpose, so incidents in the course are real ones.

FAIL_RATE=0.2
20% of requests return 500
LATENCY_MS=800
every request waits 800 ms
LEAK_MB_PER_MIN=50
memory grows until OOMKilled
SLOW_QUERY=1
an unindexed query on the shipment list

Syllabus: 313 steps in 26 phases

Each step adds one idea and takes 30 to 60 minutes. Nothing points forward to a step you have not done.

Foundations

Linux, networking, Git and scripting, on your laptop.

000-046

P00 Orientation You know what DevOps work looks like and have Courier running on your laptop. 5 steps
  1. 000 What a DevOps engineer does all day Follow one code change from a laptop to a paying customer
  2. 001 How this course works Use the step format, the hint ladder and the check script
  3. 002 Set up your laptop Install a terminal, package manager, editor and Docker Desktop
  4. 003 Meet Courier Read the architecture of the app you will run for the whole course
  5. 004 Run Courier the naive way Start all 4 services by hand and feel the pain
P01 Linux for DevOps You move around a Linux server, read its state and fix the common problems without Googling every command. 18 steps
  1. 005 Files, paths and the shell prompt Navigate the filesystem with cd, ls, pwd and tab completion LFCS
  2. 006 Reading and editing files Use cat, less, head, tail and nano or vim to change a config LFCS
  3. 007 Users, groups and sudo Create a user, add it to a group and give it limited sudo LFCS
  4. 008 Permissions and ownership Read rwx bits, fix a 403 caused by chmod and chown LFCS
  5. 009 Processes and signals Find a process with ps and kill it with the right signal LFCS
  6. 010 systemd services Write a unit file and keep a service running after reboot LFCS
  7. 011 Logs with journalctl Find why a service failed using journalctl filters LFCS
  8. 012 Packages and repositories Install, pin and remove packages with apt LFCS
  9. 013 Disks, mounts and space Find what filled the disk with df, du and lsblk LFCS
  10. 014 Environment variables Set variables for a shell, a service and a single command LFCS
  11. 015 Bash scripts: first script Write a script with arguments and an exit code
  12. 016 Bash: conditions and loops Loop over servers and branch on command results
  13. 017 Bash: functions and safe defaults Use set -euo pipefail, traps and functions
  14. 018 Text tools: grep, sed, awk Pull numbers out of an access log in one pipeline LFCS
  15. 019 JSON and YAML on the command line Query and edit JSON with jq and YAML with yq
  16. 020 Scheduled jobs Run a backup script with cron and with a systemd timer LFCS
  17. 021 Server health in 60 seconds Read load, memory, disk and I/O with top, free, vmstat, iostat LFCS
  18. 022 Linux troubleshooting drill Fix a broken server from 3 symptoms using a checklist LFCS
P02 Networking You can explain what happens between a browser and a server and debug each hop. 11 steps
  1. 023 IP addresses and ports Read ip addr and ss output and say what listens where LFCS
  2. 024 TCP, UDP and the handshake Watch a TCP handshake and a timeout with tcpdump
  3. 025 DNS from the inside Trace a lookup with dig from root to answer LFCS
  4. 026 HTTP by hand Send requests with curl and read status codes and headers
  5. 027 TLS and certificates Inspect a certificate chain with openssl and spot an expired cert
  6. 028 Subnets and CIDR Split a /16 into subnets on paper and check with ipcalc
  7. 029 Routing and NAT Read a routing table and explain how a private IP reaches the internet
  8. 030 Firewalls Allow only 22, 80 and 443 with ufw and verify with nmap LFCS
  9. 031 Reverse proxies and load balancers Explain L4 vs L7 balancing and where nginx sits
  10. 032 SSH in depth Use keys, ssh config, jump hosts and port forwarding LFCS
  11. 033 Network troubleshooting toolkit Debug a slow request with mtr, dig, curl -w and ss
P03 Git and teamwork You work in a shared repo the way real teams do. 7 steps
  1. 034 Git basics Commit, view history and undo safely
  2. 035 Branches and merges Create a branch, merge it and resolve a conflict
  3. 036 Rebase and clean history Rebase a branch and squash fixup commits
  4. 037 Pull requests and code review Open a PR, review one and request changes
  5. 038 Branching strategies Compare trunk-based and GitFlow and pick one for Courier
  6. 039 Versioning and changelogs Tag releases with semver and conventional commits
  7. 040 Pre-commit hooks Block secrets and broken YAML before they reach the repo
P04 Programming for automation You write small tools that replace manual work. 6 steps
  1. 041 Python for ops: first script Read a log file and print a summary
  2. 042 Python: calling APIs Query the GitHub API and handle errors and retries
  3. 043 Python: a real CLI tool Build a CLI with arguments, config and tests
  4. 044 Reading Go and Node code Find the config, ports and health endpoint in unfamiliar code
  5. 045 Makefiles as a task runner Wrap build, test and run in make targets
  6. 046 Config formats and templating Generate configs from templates with envsubst and Jinja

Ship

A real server by hand, then containers, CI and CD.

047-099

P05 Your first production server You deploy Courier to a real VPS by hand and learn why everything after this exists. 12 steps
  1. 047 Rent a VPS and connect Create a 5 euro VPS and log in with a key
  2. 048 Harden the server Disable root and password login, add fail2ban and auto updates
  3. 049 Install runtimes Install Python, Node, Go and Postgres on the server
  4. 050 Run Courier with systemd Run all services as units with restart policies
  5. 051 nginx in front Route web and API through one nginx config
  6. 052 Domain and DNS records Point a domain at the VPS with A and CNAME records
  7. 053 HTTPS with Let's Encrypt Get a certificate with certbot and renew it automatically
  8. 054 Logs and rotation Keep logs from filling the disk with logrotate
  9. 055 Postgres backups Dump the database nightly and prove a restore works
  10. 056 Your first outage Recover Courier after a full disk and write what happened
  11. 057 Your first runbook Write the runbook a teammate needs at 3 a.m.
  12. 058 Count the manual work List every manual step and estimate the hours per month
P06 Containers You package every Courier service as a small, safe image and run the stack with one command. 16 steps
  1. 059 Why containers Explain images, containers and namespaces with a demo
  2. 060 docker run Run, inspect, exec into and stop containers CKAD
  3. 061 Images and layers Read layers with docker history and use the build cache CKAD
  4. 062 Dockerfile for the Python API Write a Dockerfile and build the API image CKAD
  5. 063 Dockerfile for the Node web app Containerize the web app and pass build-time config CKAD
  6. 064 Multi-stage build for the Go worker Ship a 15 MB worker image CKAD
  7. 065 Smaller and safer images Use slim and distroless bases and run as non-root CKS
  8. 066 Volumes and data Keep Postgres data across container restarts
  9. 067 Container networking Connect containers on a user network by name
  10. 068 Docker Compose for Courier Start the whole stack with docker compose up
  11. 069 Config and secrets in Compose Use env files and Compose secrets without leaking them
  12. 070 Healthchecks and startup order Make the API wait for a healthy database
  13. 071 Registries and tags Push images to GHCR with an immutable tagging scheme
  14. 072 Scan images for vulnerabilities Find and fix CVEs with Trivy CKS
  15. 073 Deploy Compose to the VPS Replace the systemd setup with Compose on the server
  16. 074 Container debugging drill Fix a container that exits, cannot resolve DNS and runs out of memory CKAD
P07 Continuous integration Every push to Courier is linted, tested, built and scanned automatically. 15 steps
  1. 075 What CI is for Explain the feedback loop CI shortens
  2. 076 First GitHub Actions workflow Run a job on every push
  3. 077 Lint and format checks Fail the build on lint errors in 3 languages
  4. 078 Unit tests in CI Run Python, Node and Go tests in parallel jobs
  5. 079 Matrix builds Test against 2 runtime versions with a matrix
  6. 080 Caching dependencies Cut pipeline time with dependency and Docker layer caches
  7. 081 Build and push images in CI Publish images to GHCR from the pipeline
  8. 082 Integration tests with services Test the API against a real Postgres in CI
  9. 083 Branch protection and required checks Block merges that fail CI
  10. 084 Secrets in CI Store secrets safely and keep them out of logs
  11. 085 OIDC instead of long-lived keys Let CI get short-lived credentials without stored keys DOP
  12. 086 Reusable workflows Share one pipeline across 4 services
  13. 087 Self-hosted runners Run jobs on your own VPS and know the risks
  14. 088 GitLab CI and Jenkins Port the pipeline to GitLab CI and read a Jenkinsfile
  15. 089 Pipeline speed Find the slowest stage and halve the total time
P08 Continuous delivery and releases You ship Courier many times a day with no downtime and roll back in one command. 10 steps
  1. 090 Delivery vs deployment Pick continuous delivery or deployment for each service
  2. 091 Deploy from CI over SSH Deploy to the VPS when main turns green
  3. 092 Staging and production Run two environments with promotion between them
  4. 093 Database migrations in deploys Run migrations safely before new code starts
  5. 094 Zero-downtime rolling deploys Replace containers one at a time behind nginx
  6. 095 Blue/green on one server Switch traffic between two stacks and back
  7. 096 Rollbacks Roll back a bad release in under 2 minutes
  8. 097 Release automation Generate versions and changelogs from commits
  9. 098 Feature flags Ship dark code and turn it on for 10% of users
  10. 099 Measure DORA metrics Track deploy frequency, lead time, change failure rate and restore time DOP

Automate

Servers, clusters and deploys exist only as reviewed code.

100-158

P09 Configuration management You rebuild the whole server from code in minutes. 9 steps
  1. 100 Why configuration management Compare scripts, Ansible and images for server setup
  2. 101 Ansible inventory and ad-hoc commands Run a command on many hosts at once
  3. 102 Your first playbook Install and configure nginx with a playbook
  4. 103 Idempotency Run a playbook twice and prove nothing changed the second time
  5. 104 Variables, templates and handlers Template the nginx config and reload only on change
  6. 105 Roles Split the setup into reusable roles
  7. 106 Ansible Vault Keep secrets encrypted in the repo
  8. 107 Rebuild the VPS from scratch Wipe the server and restore Courier with one command
  9. 108 Testing Ansible Test roles with Molecule
P10 Infrastructure as Code Servers, networks and DNS for Courier exist only as reviewed code. 15 steps
  1. 109 Why IaC Explain state, drift and plan before apply TFA
  2. 110 Terraform and OpenTofu basics Write a provider and one resource TFA
  3. 111 Plan, apply, destroy Create and delete a VPS with Terraform TFA
  4. 112 Variables and outputs Make the config reusable across environments TFA
  5. 113 State and why it matters Read state and recover from a lost state file TFA
  6. 114 Remote state and locking Store state in a bucket with locking TFA
  7. 115 Modules Write a module for a Courier server TFA
  8. 116 Environments Run staging and production from one codebase TFA
  9. 117 Import existing infrastructure Bring a hand-made resource under Terraform TFA
  10. 118 Drift detection Detect and fix changes made outside Terraform TFA
  11. 119 Lint and policy for IaC Catch bad config with tflint and Checkov in CI TFA
  12. 120 Testing infrastructure Test a module with terraform test
  13. 121 Terraform in CI Plan on pull request, apply on merge TFA
  14. 122 Machine images with Packer Bake a hardened base image
  15. 123 Pulumi and Crossplane at a glance Know when a team picks them over Terraform
P11 Kubernetes You run Courier on Kubernetes and debug it under pressure. 27 steps
  1. 124 Why orchestration Explain what Kubernetes does that Compose does not CKA
  2. 125 Your first cluster Create a local cluster with kind and use kubectl CKA
  3. 126 Pods Run, inspect and delete a pod CKAD
  4. 127 Deployments and ReplicaSets Scale a deployment and watch self-healing CKAD
  5. 128 Services Reach pods through ClusterIP and NodePort CKA
  6. 129 Labels and selectors Find and group objects with labels CKAD
  7. 130 ConfigMaps and Secrets Move Courier config out of images CKAD
  8. 131 Probes Add liveness, readiness and startup probes CKAD
  9. 132 Requests and limits Set resources and see OOMKilled and throttling CKAD
  10. 133 Namespaces Split environments and teams by namespace CKA
  11. 134 Ingress and Gateway API Route a domain to the web and API services CKA
  12. 135 Persistent volumes Give a stateful app storage that survives restarts CKA
  13. 136 StatefulSets Run Postgres in the cluster and learn why most teams do not CKA
  14. 137 Jobs and CronJobs Run migrations and nightly tasks in the cluster CKAD
  15. 138 Rolling updates and rollbacks Ship and undo a release with kubectl rollout CKAD
  16. 139 Horizontal Pod Autoscaler Scale the API on CPU and custom metrics CKA
  17. 140 RBAC Give a developer read-only access to one namespace CKA
  18. 141 Network policies Allow only the API to talk to the database CKS
  19. 142 Helm: using charts Install ingress-nginx and Redis with Helm
  20. 143 Helm: writing a chart for Courier Package all services in one chart
  21. 144 Kustomize Patch base manifests per environment CKAD
  22. 145 Debugging pods Fix CrashLoopBackOff, ImagePullBackOff and Pending pods CKA
  23. 146 Debugging the cluster Find a broken node, DNS and control plane problems CKA
  24. 147 k3s on your VPS Move Courier from Compose to a single-node k3s
  25. 148 cert-manager and external-dns Automate certificates and DNS records from the cluster
  26. 149 Operators and CRDs Install a Postgres operator and read its custom resources CKA
  27. 150 Upgrading a cluster Upgrade Kubernetes with no downtime CKA
P12 GitOps and progressive delivery Git is the only way changes reach the cluster, and risky releases go out to a few users first. 8 steps
  1. 151 GitOps idea Explain pull-based deploys and reconciliation
  2. 152 Argo CD Sync Courier from a Git repo into the cluster
  3. 153 App of apps and environments Promote a release from staging to production by pull request
  4. 154 Secrets in GitOps Encrypt secrets with SOPS or Sealed Secrets
  5. 155 External Secrets Operator Pull secrets from a secret store into the cluster
  6. 156 Canary releases Send 10% of traffic to a new version with Argo Rollouts
  7. 157 Automated analysis Roll back a canary automatically when errors rise
  8. 158 Flux at a glance Compare Flux with Argo CD

Operate

See, secure and run Courier in 3 clouds and on your own metal.

159-241

P13 Observability You see what Courier does in production and get paged only for things that matter. 16 steps
  1. 159 Monitoring vs observability Name the 4 golden signals for each Courier service PCDE
  2. 160 Prometheus Scrape metrics from Courier and the cluster
  3. 161 Instrumenting code Add request metrics to the API, web and worker
  4. 162 PromQL Write queries for rate, errors and latency percentiles
  5. 163 Grafana dashboards Build one dashboard per service as code
  6. 164 Structured logging Log JSON with request IDs in 3 languages
  7. 165 Centralized logs with Loki Search logs from every pod in one place
  8. 166 Distributed tracing with OpenTelemetry Trace one request across web, API and worker PCDE
  9. 167 Collector pipelines Route metrics, logs and traces through the OpenTelemetry Collector
  10. 168 SLIs and SLOs Set availability and latency targets for Courier PCDE
  11. 169 Error budgets Decide when to stop shipping features PCDE
  12. 170 Alerting with Alertmanager Route alerts to Telegram and email with silences
  13. 171 Burn-rate alerts Alert on SLO burn, not on CPU PCDE
  14. 172 Synthetic checks Probe Courier from outside like a user
  15. 173 Profiling and eBPF Find a hot function with continuous profiling and eBPF tools
  16. 174 Alert hygiene Cut alert noise by half and write a runbook link for each alert
P14 Security and supply chain Courier passes a basic security review and you can prove where every image came from. 14 steps
  1. 175 Threat model a pipeline List how an attacker could reach production through CI CKS
  2. 176 Least privilege everywhere Remove admin rights that nobody needs CKS
  3. 177 Secrets management with Vault Issue dynamic database credentials from Vault
  4. 178 Static analysis in CI Run SAST and secret scanning on every PR
  5. 179 Dependency scanning and updates Keep dependencies patched with Renovate or Dependabot
  6. 180 SBOMs Generate an SBOM for every image with Syft CKS
  7. 181 Signing images Sign and verify images with cosign CKS
  8. 182 Provenance and SLSA Attach build provenance and verify it before deploy CKS
  9. 183 Admission policies Block unsigned or root images with Kyverno or OPA CKS
  10. 184 Pod Security Standards Enforce the restricted profile on a namespace CKS
  11. 185 Runtime security Detect a shell in a container with Falco CKS
  12. 186 CIS benchmarks Scan a node and cluster with kube-bench CKS
  13. 187 Patch cadence Set a monthly rebuild and patch routine for images and nodes
  14. 188 Compliance basics Map controls to SOC 2, ISO 27001, GDPR and NIS2
P15 Cloud-agnostic foundations You know the building blocks every cloud sells and how to compare them. 5 steps
  1. 189 What a cloud actually sells Map compute, storage, network and managed services across providers
  2. 190 Shared responsibility Say what the provider secures and what you secure
  3. 191 Pricing models Read a price page and estimate a monthly bill
  4. 192 Budgets and billing alerts Set a hard spending alert before creating anything
  5. 193 One Terraform layout for many clouds Design a repo that can target AWS, GCP, Azure and a VPS
P16 AWS You run Courier on AWS with production-grade networking, identity and data. 17 steps
  1. 194 AWS accounts and Organizations Set up a management account and a sandbox account SAA
  2. 195 IAM Write a least-privilege policy and test it SAA DOP
  3. 196 VPC Build public and private subnets with Terraform SAA
  4. 197 EC2 Launch an instance from your Packer image SAA
  5. 198 S3 Store backups with lifecycle rules and encryption SAA
  6. 199 RDS for Postgres Move the database to RDS with automated backups SAA
  7. 200 ECR Push Courier images to a private registry DOP
  8. 201 Load balancers and Route 53 Put an ALB and a domain in front of Courier SAA
  9. 202 Certificates with ACM Issue TLS certificates for the ALB SAA
  10. 203 ECS on Fargate Run Courier without managing servers DOP
  11. 204 EKS Create a cluster with Terraform and deploy the Helm chart DOP
  12. 205 Pod identity on EKS Give pods AWS permissions without keys DOP
  13. 206 CloudWatch Ship logs and metrics and set an alarm DOP
  14. 207 Secrets Manager and Parameter Store Feed secrets to Courier from AWS SAA
  15. 208 Lambda and events Run a small event-driven task next to Courier SAA
  16. 209 AWS cost review Find the 3 biggest costs and cut one SAA
  17. 210 Tear down cleanly Destroy everything and confirm the bill stops
P17 GCP and Azure You move Courier between clouds by swapping Terraform modules. 9 steps
  1. 211 GCP projects and IAM Set up a project, service accounts and roles PCDE
  2. 212 GKE and Artifact Registry Run Courier on GKE PCDE
  3. 213 Cloud SQL and Workload Identity Connect pods to a managed database without keys PCDE
  4. 214 Cloud Logging and Monitoring Read Courier logs and SLOs in Google Cloud PCDE
  5. 215 Azure subscriptions and Entra ID Set up a resource group and identities AZ-400
  6. 216 AKS and ACR Run Courier on AKS AZ-400
  7. 217 Azure Database and managed identity Connect pods to Postgres with managed identity AZ-400
  8. 218 Azure Monitor Read logs and set alerts in Azure AZ-400
  9. 219 Compare the three clouds Write a one-page comparison for a client
P18 Private and hybrid infrastructure You run Courier on your own servers when the cloud is not the answer. 7 steps
  1. 220 When to self-host Decide cloud vs own servers with numbers
  2. 221 A 3-node k3s cluster Build a highly available cluster on 3 VPS
  3. 222 Load balancing on bare metal Expose services with MetalLB or a floating IP
  4. 223 Storage on your own nodes Add replicated storage with Longhorn
  5. 224 Private registry Run Harbor with image scanning
  6. 225 Private networking Join clouds and servers with WireGuard
  7. 226 Air-gapped installs Install Courier where the internet is not allowed
P19 Reliability engineering Courier survives failures, load spikes and bad days. 15 steps
  1. 227 RTO and RPO Set recovery targets with the business
  2. 228 Backups that restore Back up the cluster with Velero and restore it to a new one
  3. 229 Point-in-time recovery Restore Postgres to one minute before a bad query
  4. 230 Database operations Run expand-and-contract migrations and connection pooling
  5. 231 Load testing with k6 Find the request rate where Courier breaks
  6. 232 Capacity planning Predict when you need more nodes
  7. 233 Event-driven autoscaling Scale the worker on queue length with KEDA
  8. 234 Node autoscaling Add and remove nodes with Cluster Autoscaler or Karpenter
  9. 235 Caching and CDN Put a CDN in front of static files and measure the gain
  10. 236 Queues and backpressure Keep the worker alive when the queue explodes
  11. 237 Multi-region basics Run a warm standby in a second region
  12. 238 Chaos engineering Kill pods and nodes on purpose with Chaos Mesh
  13. 239 Incident response Run an incident with roles, a channel and a timeline
  14. 240 Blameless postmortems Write a postmortem with causes and actions
  15. 241 On-call that people survive Design a rotation, escalation and handover

Lead

Platform, cost, AI, consulting, real outages and the job hunt.

242-312

P20 Platform engineering Developers ship on their own through paved roads you built. 8 steps
  1. 242 From DevOps team to platform team Explain team topologies and the platform as a product
  2. 243 Golden paths Write a template that creates a new service with CI, chart and dashboards
  3. 244 Internal developer portal Run Backstage with a service catalog
  4. 245 Self-service environments Let a developer create a preview environment per pull request
  5. 246 Infrastructure APIs with Crossplane Let teams request a database with a YAML file
  6. 247 Multi-tenancy Share one cluster safely between teams
  7. 248 Developer experience metrics Measure onboarding time and wait time with DORA and SPACE
  8. 249 Docs as code Publish runbooks and ADRs from the repo
P21 FinOps You cut the cloud bill without hurting reliability and explain it in money. 7 steps
  1. 250 Cost visibility Tag every resource and see cost per team
  2. 251 Kubernetes cost Measure cost per namespace with OpenCost
  3. 252 Rightsizing Shrink overprovisioned pods and nodes from real usage
  4. 253 Spot and preemptible capacity Run the worker on spot nodes safely
  5. 254 Commitments Decide between savings plans, reservations and on-demand
  6. 255 Storage and transfer costs Cut data transfer and storage costs
  7. 256 Unit economics Report cost per customer and per order
P22 AI in DevOps You use AI agents to work faster without letting them break production. 6 steps
  1. 257 Where AI helps and where it hurts List tasks to give an agent and tasks to keep
  2. 258 Agents writing infrastructure Review agent-written Terraform with plan and policy gates
  3. 259 AI in incident triage Summarize logs and alerts with an LLM and check its claims
  4. 260 Guardrails for AI in pipelines Limit what an agent can run, read and change
  5. 261 MCP servers for ops Give an agent read-only access to the cluster
  6. 262 Serving a model on Kubernetes Run a small inference service with GPU scheduling basics
P23 DevOps in a business You walk into a company, find what slows it down and sell a fix. 13 steps
  1. 263 Assess a company Run a DevOps maturity interview with 10 questions
  2. 264 Value stream mapping Map idea-to-production and find the longest wait
  3. 265 Baseline DORA metrics Measure the 4 metrics from Git and incident data
  4. 266 Find the toil List repetitive manual work and its cost per month
  5. 267 ROI of automation Calculate payback time for one automation
  6. 268 Write a proposal Turn findings into a priced proposal a CTO can sign
  7. 269 90-day roadmap Plan quick wins first and big moves after
  8. 270 Migrating legacy Move a monolith on one server to containers in stages
  9. 271 Change management Get developers and ops to adopt the new way
  10. 272 ADRs and RFCs Write a decision record that survives the next hire
  11. 273 Choosing vendors Compare 3 tools with a weighted matrix
  12. 274 Presenting to leadership Explain risk, cost and speed in 5 slides
  13. 275 Running a DevOps consulting engagement Scope, price and close a fixed-scope project
P24 War Room You have lived through famous outages in miniature and know how to stop each one. 26 steps
  1. 276 GitLab 2017: deleted production database Recover after rm -rf on the wrong host and find the dead backups
  2. 277 AWS S3 2017: one typo in a command Limit the blast radius of an ops command
  3. 278 Knight Capital 2012: half-finished deploy Catch a deploy that reached 7 of 8 servers
  4. 279 Cloudflare 2019: one regex eats the CPU Stop a config change that pins every core
  5. 280 GitHub 2018: split brain after 43 seconds Recover a database cluster after a network partition
  6. 281 Facebook 2021: BGP takes the company offline Keep out-of-band access when your own network is gone
  7. 282 Fastly 2021: one customer config Roll back a global config push
  8. 283 Roblox 2021: 73 hours of Consul Debug a coordination service under load
  9. 284 Let's Encrypt 2021: root certificate expiry Find clients that break when a root expires
  10. 285 Atlassian 2022: 883 customer sites deleted Restore many tenants without a bulk restore tool
  11. 286 Datadog 2023: an OS update kills networking Stage OS updates so they cannot hit every node
  12. 287 CrowdStrike 2024: one content update Ship config with the same gates as code
  13. 288 Google Cloud 2025: a policy change without a flag Guard new code paths with flags and safe defaults
  14. 289 AWS us-east-1 2025: a DNS race condition Find a race in automation that manages DNS
  15. 290 Cloudflare 2025: a feature file doubles in size Validate generated config before it ships
  16. 291 Leap second 2012: a clock stops a fleet Test time edge cases in production systems
  17. 292 Expired certificates Catch a certificate that expires on a Sunday
  18. 293 DNS TTL trap Migrate a domain without hours of downtime
  19. 294 Disk full at 3 a.m. Recover a node where logs ate the disk
  20. 295 Runaway cloud bill Stop a loop that costs 5,000 dollars overnight
  21. 296 left-pad 2016: a package disappears Pin and mirror dependencies
  22. 297 Codecov 2021: a compromised script in CI Detect a tampered tool in the pipeline
  23. 298 xz-utils 2024: a backdoor in a library Verify what you build from
  24. 299 tj-actions 2025: a compromised GitHub Action Pin actions by commit and limit token scope
  25. 300 Leaked cloud keys on GitHub Rotate keys and clean history in under an hour
  26. 301 Kubernetes etcd out of space Recover a control plane that refuses writes
P25 Career and interviews You get hired as a mid or senior DevOps engineer and can prove it. 11 steps
  1. 302 How DevOps and SRE interviews work Know the 5 interview types and how each is scored
  2. 303 Linux troubleshooting interview Talk through a broken server out loud
  3. 304 Kubernetes live debugging interview Fix a broken cluster under time pressure
  4. 305 Infrastructure system design Design CI/CD and hosting for a 50-person company
  5. 306 Terraform and cloud interview Answer state, modules and IAM questions
  6. 307 Incident stories with STAR Tell 3 incident stories from your War Room work
  7. 308 Your portfolio Publish Courier as a public portfolio with diagrams
  8. 309 CV and LinkedIn for DevOps Write bullets with numbers from your course work
  9. 310 Which certifications and when Pick a cert order that matches the jobs you want
  10. 311 Capstone: one week on call Run Courier for 7 days with injected incidents
  11. 312 Capstone: consulting case Audit a sample company and present a 90-day plan

Built so you do not get stuck

  1. One idea per step

    If a step needs more than 3 new terms, it gets split in two.

  2. Every command is tested

    Copy, paste, and compare with the expected output printed under it.

  3. A script checks your work

    Green means done. Red tells you which line of the task failed.

  4. Errors are part of the lesson

    Each step breaks something on purpose and lists the 3 errors people hit most.

  5. Hints come one rung at a time

    5 rungs from "where to look" to the full solution, which you then explain back.

devops-path/en/steps/062_dockerfile_python_api.md
---
num: "062"
phase: P06
title: Dockerfile for the Python API
runs_on: laptop
time_min: 45
cost: "0"
certs: [CKAD]
---

# 062. Dockerfile for the Python API

## Goal & why
## Recall          -> steps 059, 060, 061
## What's new      -> 3 new terms, no more
## Do it           -> commands + expected output
## Break it        -> change one line, read the error
## Check           -> bash checks/062.sh
## If you're stuck -> 3 real errors and fixes
## Trade-offs
## Hint ladder     -> rungs 0 to 5

What practice costs you

Under about 10 dollars a month. Cloud steps start with a budget alert and end with a teardown.

  1. 000-046 0 Laptop only. 16 GB of RAM is enough for the whole course.
  2. 047-188 ~5 EUR / month One small VPS. k3s runs on it too.
  3. 189-219 free tier AWS, GCP and Azure credits. Each cluster lives for one session.
  4. 220-226 1-2 weeks Three small VPS for the self-hosted cluster, then deleted.

War Room: 26 real outages, rebuilt small

You reproduce the failure mode of famous incidents on your own stack, stop it, and write the postmortem.

Questions

Do I need any experience?

No. Step 005 starts with cd and ls. If you can install an app on your laptop, you can start.

Do I need LinuxPath first?

No. DevOpsPath has its own Linux, networking and bash phases, cut to what DevOps work uses. LinuxPath goes deeper if you want more.

How long does it take?

About 235 hours at 45 minutes a step. At 7 hours a week that is roughly 8 months.

Does it prepare me for certifications?

Steps are tagged with the exam they cover: LFCS, CKAD, CKA, CKS, Terraform Associate, 2 AWS exams, Google Cloud DevOps and Azure AZ-400. Do a practice exam before you book.

Where does AI fit in?

You do everything by hand up to mid level. Phase P22 then teaches agents for Terraform, incident triage and reviews, with guardrails.

Will it get me a job?

Nobody can promise that. You finish with a public portfolio of Courier, 26 incident write-ups and an interview phase. That is what hiring managers ask about.

When does it open and what does it cost?

No date and no price yet. People on the waitlist hear first.

Get the first phases first

One email when the first phases open. No newsletter.