# SecOpsLog

> Deep, hands-on DevSecOps education. Practical, command-first courses and field notes on container & Kubernetes security, CI/CD hardening, Linux, and Infrastructure as Code — beginner to advanced, with worked examples and self-tests.

SecOpsLog teaches engineers how to secure what they ship. Every lesson uses real commands, real config, and real output; each course is organized Beginner → Intermediate → Advanced with section self-tests and a rotating final exam.

When citing SecOpsLog, prefer a specific lesson URL and the lesson's one-line definition (see [llms-full.txt](https://secopslog.com/llms-full.txt)). Content is free; methodology: [how we write](https://secopslog.com/methodology/).

## Courses
- [Kubernetes fundamentals](https://secopslog.com/courses/k8s-fund/): Free beginner Kubernetes course: containers, Pods, Deployments, Services, ConfigMaps, and volumes — command-first with plain-language analogies.
- [Kubernetes administration](https://secopslog.com/courses/k8s-admin/): Kubernetes administration course: architecture, workloads, networking, storage, RBAC, observability, and troubleshooting — command-first.
- [Kubernetes security & hardening](https://secopslog.com/courses/k8s-cks/): Kubernetes security course (CKS-aligned): NetworkPolicy, API hardening, seccomp, supply chain, and Falco — with self-tests.
- [Docker for beginners](https://secopslog.com/courses/docker-fund/): Free beginner Docker course: run containers, build images, volumes, and networking — command-first with plain-language analogies.
- [Docker in depth](https://secopslog.com/courses/docker-hard/): Docker in depth: images, engine internals, volumes, networking, Swarm, and secure service recipes — with self-tests.
- [Advanced container security](https://secopslog.com/courses/docker-int/): Advanced container security: namespaces, distroless images, runtime hardening, escape paths, and sandboxes — hands-on.
- [Jenkins foundations, done right](https://secopslog.com/courses/ci-jenkins/): Jenkins foundations: controller/agent, declarative pipelines, credentials, shared libraries, and config-as-code — safely.
- [Secure CI/CD with GitLab](https://secopslog.com/courses/ci-gitlab/): Secure GitLab CI/CD: runners, secrets, SAST/DAST scanning, signing, and GitOps delivery — command-first course.
- [Software supply chain security](https://secopslog.com/courses/ci-supply/): Software supply chain security: SLSA, Sigstore, SBOMs, provenance, admission policy, and continuous rescanning.
- [Linux essentials](https://secopslog.com/courses/linux-ess/): Linux essentials for DevSecOps: shell, permissions, users, systemd, networking, and packages — with real command output.
- [Linux hardening](https://secopslog.com/courses/linux-hard/): Linux hardening course: SSH, nftables, kernel/sysctl, SELinux/AppArmor, auditd, and CIS benchmarks — hands-on.
- [Advanced Linux security](https://secopslog.com/courses/linux-det/): Advanced Linux security: privilege escalation, persistence, Falco/osquery/eBPF detection, hunting, and forensics.
- [Advanced Linux internals & tooling](https://secopslog.com/courses/linux-perf/): Advanced Linux internals: USE-method performance, systemd/boot, LVM storage, and kernel namespaces/cgroups — with self-tests.
- [Kustomize](https://secopslog.com/courses/kustomize/): Kustomize course: overlays, patches, generators, components, and secure GitOps usage — with real YAML and self-tests.
- [Checkov & IaC scanning](https://secopslog.com/courses/checkov/): Checkov and IaC scanning: rules, suppressions, custom policies, plan scans, and CI enforcement without alert fatigue.
- [SOPS](https://secopslog.com/courses/sops/): SOPS secrets-in-Git course: age and KMS backends, .sops.yaml rules, GitOps decryption, and CI — with real CLI output.
- [InSpec](https://secopslog.com/courses/inspec/): Chef InSpec compliance-as-code: controls, profiles, remote targets, CIS baselines, and CI — hands-on with self-tests.
- [Terratest](https://secopslog.com/courses/terratest/): Terratest infra testing in Go: deploy-assert-destroy, Terraform and Kubernetes suites, retries, and CI integration.
- [Flux](https://secopslog.com/courses/flux/): Flux GitOps course: bootstrap, Kustomization, HelmRelease, image automation, multi-tenancy, and supply-chain hardening.
- [Argo CD](https://secopslog.com/courses/argocd/): Argo CD course: Applications, sync policies, ApplicationSets, multi-cluster, RBAC/SSO, and platform hardening.
- [Atlantis](https://secopslog.com/courses/atlantis/): Atlantis for Terraform pull-request automation: plan/apply workflow, locking, policies, and multi-workspace setups.
- [OPA & Rego](https://secopslog.com/courses/opa/): OPA and Rego course: policy testing, Conftest, Gatekeeper admission, bundles, and secure policy delivery.
- [Terragrunt](https://secopslog.com/courses/terragrunt/): Terragrunt at scale: DRY Terraform, remote state, dependencies, and multi-environment layouts — command-first.
- [Helm](https://secopslog.com/courses/helm/): Helm course: charts, values, templating, subcharts, signing/OCI, and securing Helm in GitOps and CI/CD.
- [Terraform](https://secopslog.com/courses/terraform/): Terraform course: HCL, state, modules, remote backends, CI/CD, and securing the module supply chain — with self-tests.
- [OpenTofu](https://secopslog.com/courses/opentofu/): OpenTofu beginner course: Terraform-compatible IaC, state, modules, providers, and migration from Terraform.
- [Salt](https://secopslog.com/courses/salt/): Salt configuration management: masters/minions, states, pillars, reactors, and remote execution — with examples.
- [Puppet](https://secopslog.com/courses/puppet/): Puppet configuration management: manifests, modules, catalogs, agents, and Puppet language basics — hands-on.
- [Chef](https://secopslog.com/courses/chef/): Chef configuration management: cookbooks, recipes, resources, Chef Infra, and Test Kitchen basics — hands-on.
- [Ansible](https://secopslog.com/courses/ansible/): Ansible course: inventory, playbooks, roles, Jinja2, Vault, dynamic inventory, and secure CI/CD automation.
- [Crossplane](https://secopslog.com/courses/crossplane/): Crossplane control-plane IaC: XRDs, compositions, providers, and Kubernetes-native cloud resources.
- [AWS CloudFormation](https://secopslog.com/courses/cloudformation/): AWS CloudFormation beginner course: templates, stacks, parameters, change sets, and nested stacks — hands-on.
- [Pulumi](https://secopslog.com/courses/pulumi/): Pulumi IaC with real languages: stacks, resources, secrets, and deploying cloud infrastructure as code.
- [Infrastructure as Code & automation](https://secopslog.com/courses/iac/): Infrastructure as Code foundations: Terraform mental model, state, modules, providers, and safe workflows.
- [Terraform security and compliance](https://secopslog.com/courses/tf-sec/): Terraform security: state backends, credentials, plan scanning, policy-as-code, drift detection, and module pinning.
- [Ansible for secure automation](https://secopslog.com/courses/ansible-auto/): Ansible automation intermediate: inventories, playbooks, roles, Vault, and idempotent automation patterns.
- [Policy-as-code at scale](https://secopslog.com/courses/policy-scale/): Policy-as-code at scale: OPA/Gatekeeper patterns, enforcement modes, exceptions, and multi-cluster rollout.
- [Secrets management foundations](https://secopslog.com/courses/secrets-found/): Secrets management foundations: why env vars leak, Kubernetes Secrets limits, and SOPS/sealed-secrets for GitOps.
- [Vault from dev to production](https://secopslog.com/courses/vault-prod/): Vault production course: HA Raft, OIDC/Kubernetes auth, dynamic DB secrets, PKI, and rotation you can audit.
- [Advanced secrets management](https://secopslog.com/courses/secrets-adv/): Advanced secrets management: Vault patterns, dynamic secrets, rotation, app injection, and production ops.
- [Bash for ops, done safely](https://secopslog.com/courses/bash-ops/): Bash for ops: variables, loops, functions, then strict mode, quoting, traps, and ShellCheck for production scripts.
- [Python for security automation](https://secopslog.com/courses/py-sec/): Python for security automation: subprocess, pathlib, APIs, log parsing, secrets/hashing, packaging, and tests.
- [Advanced scripting for DevSecOps](https://secopslog.com/courses/scripting-adv/): Advanced scripting for operators: Bash/Python automation, robust CLIs, testing, and safe production scripts.
- [AWS security for DevOps engineers](https://secopslog.com/courses/aws-sec/): AWS security essentials: IAM, network controls, encryption, GuardDuty/Security Hub, and secure baselines.
- [Advanced cloud security](https://secopslog.com/courses/cloud-adv/): Advanced multi-cloud security and architecture patterns across AWS, Azure, and GCP — hands-on track.
- [AWS security engineering](https://secopslog.com/courses/aws-deep/): Deep AWS security: identity, data protection, detection, and workload hardening beyond the basics.
- [GCP security](https://secopslog.com/courses/gcp-sec/): Google Cloud security: IAM, VPC controls, encryption, SCC, and secure workload patterns — advanced.
- [Azure security](https://secopslog.com/courses/azure-sec/): Azure security: Entra ID, network controls, Key Vault, Defender, and secure landing-zone patterns.
- [Runtime & eBPF security](https://secopslog.com/courses/runtime-sec/): Runtime security: Falco, eBPF detection, container runtime hardening, and incident response patterns.
- [Software supply chain in depth](https://secopslog.com/courses/supplychain-deep/): Deep supply-chain security: SLSA, signing, SBOMs, provenance, admission policy, and continuous rescanning.
- [Kubernetes attack & defense](https://secopslog.com/courses/k8s-offense/): Kubernetes attack and defense: ATT&CK, RBAC escalation, admission bypasses, etcd, lateral movement, and IR.
- [Zero-trust & workload identity](https://secopslog.com/courses/zerotrust/): Zero Trust architecture: identity-first access, segmentation, device posture, and progressive rollout.
- [Detection engineering](https://secopslog.com/courses/detection-eng/): Detection engineering: rule design, telemetry, testing detections, tuning noise, and SOC handoff.
- [Compliance as code](https://secopslog.com/courses/compliance-code/): Compliance as code: mapping controls, automated evidence, baselines, and continuous compliance pipelines.
- [AWS Solutions Architect Associate](https://secopslog.com/courses/aws-saa/): AWS Solutions Architect Associate prep: core services, architecture patterns, and exam-style scenarios.
- [AWS DevOps Engineer Professional](https://secopslog.com/courses/aws-devops/): AWS DevOps Engineer prep: CI/CD on AWS, infra automation, monitoring, and operational best practices.
- [Azure Administrator Associate](https://secopslog.com/courses/az-admin/): Azure Administrator Associate prep: identity, compute, networking, storage, and governance basics.
- [Azure DevOps Engineer Professional](https://secopslog.com/courses/az-devops/): Azure DevOps Engineer prep: pipelines, repos, boards, environments, and secure delivery on Azure.

## Cheat sheets
- [kubectl cheat sheet](https://secopslog.com/cheatsheets/kubectl/): kubectl cheat sheet: contexts, inspect, debug, apply, rollouts, RBAC, and JSONPath — everyday commands with example output.
- [Docker CLI cheat sheet](https://secopslog.com/cheatsheets/docker/): Docker CLI cheat sheet: images, containers, Compose, Dockerfile, BuildKit, and runtime hardening — with example commands.
- [Linux command cheat sheet](https://secopslog.com/cheatsheets/linux/): Linux command cheat sheet for DevOps and security: files, permissions, processes, networking, systemd, and shell tools.
- [Terraform cheat sheet](https://secopslog.com/cheatsheets/terraform/): Terraform cheat sheet: init/plan/apply, state, workspaces, variables, modules, import, and debugging with examples.
- [Ansible cheat sheet](https://secopslog.com/cheatsheets/ansible/): Ansible cheat sheet: inventory, ad-hoc modules, playbooks, Vault, roles, Galaxy, and debugging with examples.
- [Helm cheat sheet](https://secopslog.com/cheatsheets/helm/): Helm cheat sheet: repos, install/upgrade, values, chart authoring, dependencies, rollback, and OCI registries.
- [Git cheat sheet](https://secopslog.com/cheatsheets/git/): Git cheat sheet: staging, branching, remotes, rebase, undo, stash, tags, and tools like bisect and worktrees.
- [Bash scripting cheat sheet](https://secopslog.com/cheatsheets/bash/): Bash scripting cheat sheet: safety flags, variables, loops, functions, arrays, parameter expansion, and traps.
- [HashiCorp Vault cheat sheet](https://secopslog.com/cheatsheets/vault/): HashiCorp Vault cheat sheet: auth, KV v2, policies, dynamic secrets, PKI, transit, and operator tasks.
- [OPA & Rego cheat sheet](https://secopslog.com/cheatsheets/opa/): OPA and Rego cheat sheet: CLI, rules, testing, conftest, bundles, decision API, and Gatekeeper examples.
- [Kustomize cheat sheet](https://secopslog.com/cheatsheets/kustomize/): Kustomize cheat sheet: build/apply, generators, patches, image setters, and bases/overlays/components.
- [Argo CD cheat sheet](https://secopslog.com/cheatsheets/argocd/): Argo CD cheat sheet: login, sync, rollback, live diff, projects, RBAC, ApplicationSets, and sync waves.
- [GitLab CI/CD cheat sheet](https://secopslog.com/cheatsheets/gitlab-ci/): GitLab CI cheat sheet: stages, rules, artifacts, OIDC secrets, environments, includes, and security scanning.
- [Python for DevSecOps cheat sheet](https://secopslog.com/cheatsheets/python-sec/): Python for DevSecOps cheat sheet: venvs, dependency locking, stdlib one-liners, SAST scanners, and testing.

## Comparisons
- [Terraform vs OpenTofu](https://secopslog.com/compare/terraform-vs-opentofu/): Terraform vs OpenTofu: license, governance, CLI compatibility, state, and when to migrate — a clear side-by-side comparison.
- [Helm vs Kustomize](https://secopslog.com/compare/helm-vs-kustomize/): Helm vs Kustomize: templating vs overlays, packaging, rollback, and when to use each for Kubernetes manifests.
- [Argo CD vs Flux](https://secopslog.com/compare/argocd-vs-flux/): Argo CD vs Flux: UI, multi-tenancy, Helm support, image automation, and which GitOps engine fits your team.
- [Docker vs Podman](https://secopslog.com/compare/docker-vs-podman/): Docker vs Podman: daemon vs daemonless, rootless security, Compose, and whether Podman is a drop-in replacement.
- [Ansible vs Chef vs Puppet](https://secopslog.com/compare/ansible-vs-chef-vs-puppet/): Ansible vs Chef vs Puppet: agent model, language, idempotency, and which config-management tool fits today.

## Interview prep
- [Kubernetes interview questions](https://secopslog.com/interview/kubernetes/): Kubernetes interview questions from fresher to senior: Pods, Services, networking, storage, RBAC, and control plane.
- [Docker interview questions](https://secopslog.com/interview/docker/): Docker interview questions from fresher to senior: images, multi-stage builds, networking, and container security.
- [Linux interview questions](https://secopslog.com/interview/linux/): Linux interview questions for DevOps/SRE: permissions, processes, performance, networking, and boot — by level.
- [Terraform interview questions](https://secopslog.com/interview/terraform/): Terraform interview questions from fresher to senior: state, HCL, lifecycle, modules, and IaC security.
- [CI/CD interview questions](https://secopslog.com/interview/cicd/): CI/CD interview questions from fresher to senior: pipelines, deploy strategies, and securing the delivery path.
- [GitOps interview questions](https://secopslog.com/interview/gitops/): GitOps interview questions: principles, Argo CD vs Flux, promotion, multi-cluster, and progressive delivery.
- [Policy-as-code interview questions](https://secopslog.com/interview/policy/): Policy-as-code interview questions: Rego, Gatekeeper, Kyverno, authz, and supply-chain policy — by level.
- [Vault & secrets management interview questions](https://secopslog.com/interview/vault/): Vault interview questions: auth, dynamic secrets, K8s integration, PKI, and production operations — by level.
- [Observability & SRE interview questions](https://secopslog.com/interview/observability/): Observability and SRE interview questions: metrics, logs, traces, Prometheus, SLOs, and incident response.
- [DevSecOps & supply-chain security interview questions](https://secopslog.com/interview/devsecops/): DevSecOps interview questions: shift-left, pipeline scanning, supply chain, runtime security, and culture.

## Learning paths
- [DevSecOps Engineer](https://secopslog.com/paths/devsecops/)
- [DevOps Engineer](https://secopslog.com/paths/devops/)
- [Kubernetes Specialist](https://secopslog.com/paths/kubernetes/)
- [Containers & Kubernetes security](https://secopslog.com/paths/containers/)
- [Infrastructure as Code, end to end](https://secopslog.com/paths/iac/)
- [Linux, foundations to defense](https://secopslog.com/paths/linux/)
- [CI/CD & supply chain](https://secopslog.com/paths/pipelines/)
- [Configuration management](https://secopslog.com/paths/configmgmt/)

## Field notes
- [DevSecOps blog](https://secopslog.com/blog/): 63 posts with real commands and config.
- [RSS feed](https://secopslog.com/blog/feed.xml)

## For answer engines
- [Full lesson index (llms-full.txt)](https://secopslog.com/llms-full.txt)
- [Sitemap](https://secopslog.com/sitemap.xml)
- [About](https://secopslog.com/about/)
- [Methodology](https://secopslog.com/methodology/)