Learn to secure what you ship.
Hands-on courses and field notes to help you secure what you ship — Kubernetes, CI/CD pipelines, secrets, and cloud security, beginner to advanced, each ending with a self-test.
A free, command-first DevSecOps library
SecOpsLog is a free, independent library of DevSecOps tutorials, structured courses, and field notes. It teaches engineers how to build security into the way software is shipped — from the Linux shell and Docker images through Kubernetes, CI/CD pipelines, secrets management, and infrastructure as code — instead of bolting it on after release. Every lesson is command-first: you get the exact commands to run in production, the output you should expect, and the failure each control prevents. There is no signup, no paywall, and no fluff — just practical security you can apply on Monday.
The material is written for the engineer who owns the deployment — platform and DevOps engineers, SREs, security engineers, and developers who ship their own code. Courses run from beginner to advanced, every section closes with a self-test, and each course ends with a rotating final exam, so you can measure what actually stuck.
Multi-stage Docker builds that cut image size by 80%
Split build tooling from the runtime so your final image ships only the binary and its deps — smaller, faster, safer.Read the tutorialCourses
Beginner to advanced tracks per topic — every course ends with a self-test.
Topics
Every post is tagged by tool and layer of the stack.
Learn the whole delivery pipeline
Eight stops from the shell to production — hover any step to see what it covers.
What you’ll learn
The library follows the full delivery pipeline. On the platform side, that means container and Kubernetes security: image hardening, non-root builds, RBAC, Pod Security, NetworkPolicies, and admission control. In the pipeline, it means CI/CD hardening — least-privilege runners, OIDC federation instead of long-lived keys, and gated, auditable deploys. For the software supply chain, you generate SBOMs, scan dependencies for known vulnerabilities, and sign artifacts with Cosign so only trusted builds reach production.
Secrets management moves you off hardcoded credentials with Vault — dynamic secrets, automatic rotation, and PKI. Infrastructure as code with Terraform and OpenTofu shows how to scan plans before they run, pin providers, and protect state. And because shipping securely is only half the job, SecOpsLog also covers detection and response: reading audit logs, recognizing runtime signals, and knowing what to do in the minutes after an incident.
You can start anywhere and go as deep as you like. Follow a structured course from beginner to advanced, pick a role-based learning path through the stack, drop into a single field note to solve one specific problem, or grab a cheat sheet for quick reference during real work. New tutorials and notes are published regularly, each written to be run rather than skimmed and fact-checked against the tools and versions teams actually use today.
SecOpsLog is independent and free on purpose — to keep the barrier to good security as low as possible. There are no accounts to create and nothing to install just to read a lesson. The goal is simple: help more teams ship software that is secure by default, and make the practices behind it legible to anyone willing to open a terminal and follow along.