Skip to content

Learn DevSecOps

Advanced scripting for DevSecOps

For engineers who have finished Bash for ops and Python for security automation and now write automation that runs unattended in production. The Bash half covers processes and file descriptors, error propagation that errexit cannot see, signals and shutdown under systemd and Kubernetes, trust boundaries and privilege, testing, and when a script has outgrown Bash. The Python half covers tool structure and typed configuration, failure design with deadlines and idempotent retries, concurrency on Python 3.14 including the free-threaded build, fleet automation over subprocess, SSH and HTTP, and hostile input. It ends with observability, shipping artifacts, release gates with SBOMs and signatures, and a certificate-rotation runner that ties both languages together. Every example ran on the lab machine.

Advanced4 sections · 15 lessons · ~11h total · 47-question self-test

01

Shell in production

6 lessonsTest yourself

01Processes, pipes and file descriptors in real scriptsWhere Bash forks, file descriptors, process substitution status, process groups and wait -n.35 min 02Error propagation you can trustWhat errexit cannot see, stack traces from ERR traps, and gates that fail closed.20 min 03Signals, timeouts and shutdown under systemd and KubernetesRe-raise vs exit, PID 1, forwarding signals, deadlines and drain budgets.35 min 04Trust boundaries: arguments, environment and privilegeOption injection, remote quoting, PATH and BASH_ENV, races and dropping privilege.40 min 05Testing shell automationBats with fakes, testing signals and timeouts, and ShellCheck and Bats as CI gates.35 min 06When a script has outgrown BashClear criteria, a Bash wrapper with a Python core, JSON between them and a safe migration.30 min

02

Python automation engineering

5 lessonsTest yourself

01Designing a CLI tool: structure, config and exit contractsLayered typed config validated once, static vs runtime checks, and plan/apply.45 min 02Failure design: exceptions, deadlines, retries and cleanupException taxonomy, deadline budgets, idempotent retries, SIGTERM and ExitStack.40 min 03Concurrency on Python 3.14: threads, processes, interpreters and asyncioThe GIL build and the free-threaded build, forkserver, and asyncio task groups.45 min 04Fleet automation: subprocess fan-out, SSH and HTTP at scaleBounded fan-out, process-group kills, pinned SSH host keys and partial failure.40 min 05Handling hostile input at scaleSize and time budgets, ReDoS, deserialization choices, validation and TOCTOU.45 min

03

Operate and ship

3 lessonsTest yourself

01Observable jobs: exit contracts, logs, metrics and audit trailsJSON logs, metrics that reveal a job that never ran, idempotency and audit lines.55 min 02Shipping automation: locks, artifacts and runtimesDeclare, lock, build, verify, distribute and isolate: wheels, zipapps and containers.40 min 03Release gates: tests, analysis, SBOM, signing and verificationWhat coverage, types, linters, audits, SBOMs and signatures each prove and do not.45 min

04

Capstone

1 lessonTest yourself

01Capstone: a certificate-expiry and rotation runnerA Bash entry point, a packaged Python core, a fleet, a flaky CA API and release gates.90 min

Progress is saved in this browser only — no account required.

Quick reference

Bash scripting cheat sheetCheat sheet Linux interview questionsInterview guide

Final exam

Test yourself on everything

47 questions drawn from all 4 sections — every answer explained as you pick.

Start final exam