Learn
Practical setup guides, configuration walkthroughs and troubleshooting notes, each paired with the terminal output you should expect. Organised by the technology you are working with.
Latest guide
A Service With Endpoints and No TrafficPaid
The Service failure that passes every check people run first. This walks the three port numbers that have to agree, asks the container which one it actually serves, and fixes it with a single field.
kubectl delete pod webpod "web" deleted from default namespacekubectl get podsNAME READY STATUS RESTARTS AGEnginx 1/1 Running 0 12ssidecar-demo 2/2 Running 0 12sChoose a technology and follow its path in order.
-
75 free
Kubernetes
Install and operate real clusters, then specialise by role.
- KCNAKubernetes and Cloud Native Associate Unlock
- KCSAKubernetes and Cloud Native Security Associate Unlock
- CKACertified Kubernetes Administrator Unlock
- CKADCertified Kubernetes Application Developer Unlock
- CKSCertified Kubernetes Security Specialist Unlock
-
Free
Containers
Build and run images, with a daemon or without one.
- DockerImages, layers, registries and Compose.
- PodmanDaemonless, rootless containers, pods and systemd units.
-
11 free
Linux
Storage, SELinux, services and the shell, on Red Hat Enterprise Linux.
Browse 67 guides
Kubernetes
Install and operate real clusters, then specialise by role.
Containers
Build and run images, with a daemon or without one.
Linux
Storage, SELinux, services and the shell, on Red Hat Enterprise Linux.
- KCNAKubernetes and Cloud Native Associate Unlock
- KCSAKubernetes and Cloud Native Security Associate Unlock
- CKACertified Kubernetes Administrator Unlock
- CKADCertified Kubernetes Application Developer Unlock
- CKSCertified Kubernetes Security Specialist Unlock
- DockerImages, layers, registries and Compose.
- PodmanDaemonless, rootless containers, pods and systemd units.
- RHCSARed Hat Certified System Administrator Unlock
Nothing here yet.
All guides
The whole library, searchable. Use this when you already know what you are looking for.
435 guides
-
A Service With Endpoints and No TrafficPaid
The Service failure that passes every check people run first.
-
Troubleshooting Authentication and Authorization FailuresPaid
Four ways a request fails to reach an object, produced deliberately one after another, so the error text tells you which layer to look at instead of sending you to RBAC every time.
-
Falco Runtime Detection and Resource LimitsPaid
A syscall-level detector is the only thing that sees what happens INSIDE a container.
-
EndpointSlices in DetailPaid
Where a Service's backend list actually lives, the three conditions each address carries, and a side-by-side comparison with the object EndpointSlices replaced.
-
Expanding a PersistentVolumeClaimPaid
Growing a volume under a running Pod.
-
Common CKS Task MistakesPaid
On a performance exam nothing tells you that you were wrong.
-
Getting a Pod Past Pod Security AdmissionPaid
A namespace that refuses your Pod, read from the developer's side: what the message is asking for, where each field actually belongs, and how much of it you need at each of the three levels.
-
Headless and ExternalName ServicesPaid
The two Service types that are not proxies.
-
hostPort and hostNetworkPaid
The two ways a Pod can take a port on the node it runs on, what each does to scheduling, and why a Deployment that uses either one quietly stops scaling.
-
Container Immutability at RuntimePaid
The image is a starting point, not a guarantee.
-
Troubleshooting Init Container FailuresPaid
A Pod held before its application ever starts.
-
Troubleshooting a Namespace Stuck TerminatingPaid
A namespace held open by one object inside it.
-
Pod DNS Policy and dnsConfigPaid
The file the kubelet writes into every Pod, the two settings that decide how a name is resolved, and the one combination where the spec field and the file disagree.
-
Troubleshooting Pod ContainerCreatingPaid
A Pod that is scheduled and still will not start.
-
Troubleshooting Pod TerminatingPaid
A delete that returns successfully and leaves the object behind.
-
Readiness Failures and Service EndpointsPaid
One Pod taken out of a Service without being restarted, put back without being rescheduled, and then the identical probe moved to livenessProbe so the difference is measured rather than described.
-
Querying Kubernetes Audit LogsPaid
An audit log is a haystack by design.
-
Reclaim Policies and Recovering a Released VolumePaid
The emergency lever for a volume you are about to delete, and the four-step recovery that gets the data back afterwards - ending with the file read out of the rebound volume.
-
Service Session AffinityPaid
What a ClusterIP does with repeated requests, what changes when you pin them, what happens when the pinned backend disappears, and the source-IP assumption that makes the whole feature fragile.
-
Service Traffic Policies and Source IPPaid
One Pod on one node, reached through every node's NodePort.
-
Service Types End to EndPaid
The three Service types on one workload, each proved from the place it is supposed to be reachable from - and an honest look at what a LoadBalancer does on a cluster that has a controller for it and on one that does not.
-
Time Management on a Performance ExamPaid
A performance exam is two hours of tasks, and some of that time is not yours.
-
Identifying the Phases of an AttackPaid
One compromised Pod, three phases, and then the same three phases from the defender's side.
-
Troubleshooting a Stalled RolloutPaid
A Deployment that stops half way and keeps serving traffic while it does.
-
Troubleshooting a Stuck StatefulSetPaid
A StatefulSet update that stops at the highest ordinal and stays there.
-
Troubleshooting Failed JobsPaid
A Job that gives up, read from the object rather than guessed at - and the one field that decides whether every attempt leaves evidence behind or only the last one does.
-
Enabling Kubernetes Audit LoggingPaid
Every guide before this one changed something and nothing wrote down who did it.
-
Volume subPath and Mounted File PermissionsPaid
The two things that go wrong when configuration reaches a container as a file: a mount that hides the directory it landed on, and a permissions field that is decimal when everyone reads it as octal.
-
Assessing Cluster Detection CoveragePaid
Every guide in this domain changed something and then put it back.
-
Threat Detection Across Cluster LayersPaid
The competency asks you to detect threats across infrastructure, apps, networks, data and users.
-
A securityContext That Passes the Restricted StandardPaid
The previous guide ended with a refusal listing four fields.
-
AppArmor and seccomp Profiles for PodsPaid
The largest piece of genuinely new ground between KCSA and CKS.
-
Container Runtime SecurityPaid
The kubelet does not run containers - it asks a runtime to.
-
NetworkPolicy Default Deny and DNS
Isolation techniques is a Domain 1 competency and NetworkPolicy is the one you will be asked about.
-
Encrypting Secrets at Rest in etcdPaid
Secrets are base64 in the API and plaintext in etcd, and turning that off means editing the apiserver.
-
etcd Security and Access ControlPaid
Every object in the cluster is a row in etcd, so etcd access is cluster access - and on a default kubeadm cluster the Secrets in it are not encrypted.
-
Auditing RBAC PermissionsPaid
Before you can minimise RBAC you have to find what is over-broad, and reading every Role by hand does not scale past about ten.
-
Hardening a Pod with securityContext
The previous page had a Pod refused for four separate violations.
-
KCSA in the Kubernetes Certification Path
This site teaches KCNA, KCSA and CKS.
-
Ingress TLS Configuration
A cluster with no ingress controller ignores every Ingress object silently, so this guide installs one, creates a certificate and a TLS Secret, wires them together and then proves the result the only way that counts - by reading the certificate off the wire.
-
Least-Privilege Identity and Access on the NodePaid
Identity and access management in this domain means the host's, not the cluster's: who can log in, what they can become, and what a shell on this machine is worth.
-
Managing Kubernetes SecretsPaid
Encryption at rest protects the datastore.
-
Restricting Node External Network AccessPaid
The node's listening ports are only a finding once you prove what answers on them.
-
Minimizing an Over-Broad RBAC RolePaid
The most likely RBAC task you will be handed is not writing a Role from nothing - it is taking one that says `*` and leaving it saying as little as possible.
-
Minimizing the Base Image FootprintPaid
The first supply-chain competency is the one with the best return: most of what a scanner finds in your image was never yours.
-
Minimizing the Host OS FootprintPaid
A Kubernetes node is a Linux box, and most of what makes it dangerous was installed before Kubernetes was.
-
Protecting Node Metadata and Endpoints
Every Pod can address the node it runs on, and on a cloud cluster it can address the metadata service that hands out credentials.
-
Pod Security Admission Levels
Pod Security Admission is the control a KCSA candidate is most likely to be asked about and least likely to have seen refuse anything.
-
Pod Security Admission: enforce, audit and warnPaid
Every namespace you create admits a privileged container and says nothing about it.
-
Pod-to-Pod Encryption with Cilium WireGuardPaid
The orientation guide flagged `Encryption: Disabled` as a task rather than a fact.
-
Restricting Kubernetes API AccessPaid
Restricting API access means three different things - who may call without a credential, what they get if they do, and who can reach the endpoint at all.
-
NetworkPolicy for Cluster-Level Access Control
The first competency in the first domain, and the task most likely to appear in front of you: take a namespace that can reach everything and leave it able to reach one service.
-
Restricting Permitted Image RegistriesPaid
Securing a supply chain means deciding what the cluster will run before it runs it.
-
CIS Benchmark Review with kube-bench
The competency says use the CIS benchmark to review the configuration of Kubernetes components, so this guide runs it, fixes what it finds, and runs it again to prove the fix.
-
Sandboxed Containers with gVisor and RuntimeClassPaid
The previous guide ended with two tenants sharing one kernel.
-
Container Scanning and Vulnerability StalenessPaid
A vulnerability scan is a timestamped claim about an image, not a property of it.
-
ServiceAccount Tokens and automountServiceAccountTokenPaid
The competency says exercise caution in using service accounts, and the caution has three parts: stop mounting credentials into workloads that never call the API, give the ones that do their own identity, and know which token type you are looking at.
-
Signing and Verifying Artifacts with CosignPaid
A digest proves bytes did not change.
-
Static Analysis of a DockerfilePaid
The manifest is the last place to fix a workload's security and the Dockerfile is nearly the first.
-
Static Analysis of Kubernetes ManifestsPaid
Admission control refuses a bad workload at the last possible moment.
-
The 4C Cloud Native Security Model
The 4Cs are usually four nested rings on a slide, which is why people can recite them without using them.
-
kube-apiserver Security FlagsPaid
The apiserver is the only way into the cluster, so its flags are the cluster's security posture.
-
The KCSA Practice Cluster and Its Defaults
Security behaviour depends on what is installed, so this guide reads the lab off the machines rather than describing it.
-
Control Plane Static Pod ManifestsPaid
Domain 2 is about the security of each cluster component, and the first thing to understand is where they come from.
-
Kubelet API Access and PortsPaid
Every node runs an API that can list Pods, read logs and exec into containers - and it is not the apiserver.
-
Node Authorization and NodeRestrictionPaid
A kubelet authenticates to the apiserver as `system:node:<name>` in the group `system:nodes`, and what that identity may read is decided per request rather than by a role.
-
The CKS Practice Clusters
This path runs on three clusters rather than one, because CKS work is meant to damage things and a cluster you are about to break should not be the one another path depends on.
-
Upgrading Kubernetes to Patch VulnerabilitiesPaid
"Upgrade Kubernetes to avoid vulnerabilities" is a competency and a task you can be handed, and it is the one place where getting the order wrong turns maintenance into an outage.
-
Verifying Kubernetes Platform Binaries
The last competency in Cluster Setup is the one people skip: check that the binary you are about to run is the one that was published.
-
Namespace Isolation for Multi-TenancyPaid
A namespace separates names and nothing else.
-
CKS Exam Format and Domain Weights
CKS is a performance exam sat on live clusters, and it is the only Kubernetes certification with a prerequisite.
-
Software Bills of Materials (SBOM)Paid
Understanding your supply chain starts with knowing what you shipped.
-
KCSA Exam Format and Domain Weights
KCSA is multiple choice - 60 questions in 90 minutes - and it wants 75%, which is the highest threshold of any exam on this site.
-
Moving from KCSA to CKS
If you have come from KCSA you already know most of the vocabulary, and that is worth less than it feels.
-
Cluster DNS and Service Discovery
A Pod reported NXDOMAIN for the apiserver and then fetched a page from it seconds later.
-
Compromised Container Blast RadiusPaid
Assume the application is already owned - a dependency, an upload handler, an unauthenticated admin path - and ask what the attacker now has.
-
Admission Control and ValidatingAdmissionPolicyPaid
Admission control is where a cluster stops being a set of defaults and starts being your policy.
-
Network-Based Attack VectorsPaid
The pod network is flat and cluster DNS is open to everyone in it, so lateral movement needs no exploit - a name and a port are enough.
-
Denial of Service and Resource ControlsPaid
Availability is the third of the three properties, and the one Kubernetes gives away by default: a container with no `resources` block may take the whole node.
-
kube-proxy and Service ImplementationPaid
A Service is not a process.
-
Attacker Persistence MechanismsPaid
Getting in is one problem; staying in is a different one, and in Kubernetes it is solved with ordinary objects that look like configuration.
-
Privilege Escalation from Pod to NodePaid
The most important idea in the KCSA threat model is that `create pods` is a privilege escalation primitive.
-
Private Registry AuthenticationPaid
Private images need a credential, and Kubernetes stores it as an ordinary Secret with the password in clear.
-
RBAC FundamentalsPaid
RBAC is 30% of the KCSA pool by keyword, more than any other subject.
-
ResourceQuota and LimitRange as Security ControlsPaid
Availability is part of security, and the cheapest denial of service in Kubernetes is a neighbour who asks for everything.
-
Image Scanning and Supply Chain ChecksPaid
Supply chain compliance asks two questions: what is in the thing you ship, and what is known to be wrong with it.
-
Kubernetes Secrets and Exposure PathsPaid
Secrets are 27% of the KCSA pool by keyword.
-
Network Flow ObservabilityPaid
Observability is a security control when it answers who talked to whom and whether it was allowed.
-
Storage Security: StorageClass, PV and CSIPaid
Storage is a component like the kubelet or etcd, and it has its own security questions: who may provision it, where the bytes actually live, and what happens to them when the workload goes away.
-
CIS Benchmark Assessment with kube-benchPaid
The CIS Kubernetes Benchmark is the compliance framework KCSA names, and kube-bench is how it is run.
-
Cluster PKI and Certificate Signing RequestsPaid
Every component of this cluster proves who it is with a certificate, and all of them trace back to files in one directory.
-
kubeconfig Files and Client CertificatesPaid
Client security is a Domain 2 competency and a kubeconfig is the client.
-
Image Tags, Digests and Pull PolicyPaid
Supply chain security starts with a question with a surprising answer: what did this Pod actually run? A tag is a mutable pointer, and the cluster records what it resolved to in a different field.
-
Pod Security Standards in DetailPaid
`privileged`, `baseline` and `restricted` are easy to recite and hard to place.
-
Projected ServiceAccount TokensPaid
ServiceAccount tokens changed shape in 1.24 and most material has not caught up.
-
Commonly Confused KCSA ConceptsPaid
Multiple-choice security questions are built on distinctions: two things that sound the same and behave differently.
-
Threat Modeling with STRIDEPaid
A threat modelling framework is a list of questions somebody worked out so you do not have to.
-
Trust Boundaries: Authentication and AuthorizationPaid
A threat model is a map of boundaries, and Kubernetes has four that matter: the human at a terminal, the Pod holding a token, the apiserver deciding twice about every request, and the node underneath.
-
Namespaces as a Security BoundaryPaid
Namespaces are the most over-trusted object in Kubernetes.
-
Service Mesh Security CapabilitiesPaid
KCSA asks what a service mesh provides.
-
Audit Logging and Cluster RecordsPaid
Audit logging is a Domain 3 competency and this cluster has none - which makes it a good place to measure the gap precisely.
-
KCSA Exam Timing and Error BudgetPaid
KCSA is 60 questions in 90 minutes at 75%, the highest pass mark on this site.
-
Privilege Escalation Paths in RBACPaid
Auditing RBAC by reading it does not scale - there are 74 ClusterRoles on a cluster with nothing installed.
-
Canary Deployments by Replica CountPaid
A canary needs no mesh and no ingress weighting: put both versions behind one Service with one shared label, and the traffic split is the ratio of ready Pods.
-
CronJob Schedules and concurrencyPolicy
A CronJob creates a Job on a schedule, and the interesting question is what it does when the previous Job is still running. `concurrencyPolicy` answers it, and the default is to let them overlap.
-
securityContext: runAsNonRoot and CapabilitiesPaid
A securityContext decides who the process is and what it may do, and each setting has a characteristic failure. `runAsNonRoot` against a root image refuses to start at all; `readOnlyRootFilesystem` lets the container start and then breaks its first write; dropping capabilities produces `Operation not permitted` from a command that has always worked.
-
Service Selectors and EndpointsPaid
A Service whose selector matches nothing is completely valid.
-
ServiceAccounts, Roles and RoleBindingsPaid
Every Pod runs as a ServiceAccount whether you choose one or not, and by default it can do nothing.
-
Non-Destructive Swap ConfigurationPaid
The objective's key word is *non-destructively*: swap is added while the machine keeps running and its existing swap keeps working.
-
Ingress Rules and Ingress ControllersPaid
An Ingress is only a request.
-
Finding Deprecated API VersionsPaid
"Understand API deprecations" is a CKAD objective and it shows up as a manifest that used to work and now does not.
-
Archive and Compression Tools
One objective naming three tools.
-
Blue-Green Deployments with Service SelectorsPaid
Blue-green needs no special tooling in Kubernetes.
-
Boot, Reboot and ShutdownPaid
The shortest objective in the blueprint, with one genuine trap: `shutdown -k` is described as sending warnings without shutting down, and it also creates `/run/nologin`, which stops every unprivileged user logging in until it is removed.
-
Building and Loading Images Without a Registry
CKAD lists defining, building and modifying container images, and the modifying half is what actually comes up: overriding an image's entrypoint, arguments and environment from the Pod spec.
-
Editing Live Objects: apply, edit, patch and replace
CKAD hands you existing objects more often than empty namespaces, and there are four ways to change one: `set` for the handful of fields with a verb, `patch` for everything else, `edit` for exploration, and delete-and-recreate for the fields that cannot change at all.
-
Choosing a Workload Object
"Choose and use the right workload resource" is a CKAD objective, and the differences are easier to see than to remember.
-
Shell Conditionals with if and testPaid
One objective, which names `if`, `test` and `[]` explicitly.
-
On-Demand Mounting with autofsPaid
One objective.
-
Privileged Access with sudoPaid
One objective, asked constantly.
-
RPM Repository ConfigurationPaid
A write-a-file objective, and the most common way to lose it is to write the file, confirm with `dnf repolist`, and move on. `repolist` does not validate anything - it lists a broken repository as happily as a working one.
-
User Account ManagementPaid
One objective, and the commands are short.
-
XFS, ext4 and VFAT FilesystemsPaid
Three filesystems, three `mkfs` commands, and one asymmetry that matters: **XFS cannot be shrunk**. ext4 is shrunk here to prove the contrast, and VFAT is shown silently ignoring a `chmod` - because it has no concept of Unix permissions at all.
-
Custom Resources and the Operator PatternPaid
CKAD asks you to discover and use resources that extend Kubernetes.
-
Default Permissions and umaskPaid
One objective.
-
Controllers and Pod RecreationPaid
Deployment Pods are interchangeable and named at random; StatefulSet Pods have stable identities and each keeps its own disk across deletion and rescheduling.
-
Linux Permission TroubleshootingPaid
The objective is diagnosis, not syntax.
-
dnf Updates and Transaction HistoryPaid
Covers the "install and update software packages" objective and the one dnf feature that can rescue a task: every transaction is logged and most can be undone.
-
Package Management with dnfPaid
Two objectives, and the install and remove halves take about a minute each.
-
Text Editing with Vim
One objective, and the exam gives you no graphical editor.
-
Events, describe and kubectl topPaid
Almost every "why is this broken" question is answered by events, and almost everyone reads them the slow way.
-
Extending LVM Volumes and FilesystemsPaid
The objective is one line and the mistake is universal: growing the logical volume does not grow the filesystem on it.
-
Files, Directories and Links
Two objectives that belong together, because the difference between a hard link and a soft link is invisible until you move or delete what they point at.
-
Process Discovery and TerminationPaid
One objective covering both halves: finding CPU and memory-intensive processes and killing them.
-
firewalld Zones, Services and PortsPaid
This appears in two objectives - networking and security - and is one skill.
-
Flatpak Repositories and ApplicationsPaid
RHEL 10 removed the whole container domain from EX200 and added two Flatpak objectives in its place, so there is very little RHCSA material on this yet.
-
Job Completions, Parallelism and backoffLimit
Three fields decide how a Job behaves: `completions` (how many successes are needed), `parallelism` (how many at once) and `backoffLimit` (how many failures before giving up).
-
ConfigMaps: Environment Variables and Volume MountsPaid
There are three ways to create a ConfigMap and four ways to consume one, and CKAD tasks use all of them.
-
Generating YAML with --dry-run=client
Nobody passes CKAD by typing `apiVersion: apps/v1` from memory sixteen times.
-
Debugging a Container Without a ShellPaid
Minimal and distroless images have no shell, so `kubectl exec` fails and the standard debugging routine stops at step one. `kubectl debug` adds an ephemeral container to the running Pod - sharing its network namespace, so it sees the same IP and can reach the same things - without restarting anything.
-
GPT Partitioning with partedPaid
One objective, and the commands are short.
-
grep and Regular Expressions
One objective covering both grep's options and regular expressions.
-
Group Membership ManagementPaid
One objective, and one mistake worth more marks than the rest of the domain combined: `usermod -G` without `-a` replaces every secondary group instead of adding one, reports nothing, and exits 0.
-
Helm Install, Upgrade and RollbackPaid
Helm is a package manager with a memory: every install and upgrade is a revision it can go back to.
-
Hostname and Name ResolutionPaid
One objective, and one tool choice that matters more than it looks: `dig` and `host` query DNS directly and ignore `/etc/hosts`, so they can report a failure for a name that resolves perfectly well. `getent hosts` uses the same path an application does.
-
Init Containers and Completion Order
An init container runs to completion before the next one starts, and all of them finish before any application container begins.
-
Root Password Reset from Boot LoaderPaid
One objective, asked in some form on almost every attempt.
-
IPv4 Configuration with nmcliPaid
Half of one objective.
-
IPv6 Network ConfigurationPaid
The other half of the addresses objective.
-
SSH Key-Based AuthenticationPaid
One objective, three commands, and two failure modes that produce the identical unhelpful message.
-
Using kubectl explain for Field Reference
The exam allows the Kubernetes documentation, and a browser is still slower than the terminal for the question you actually have: what is this field called and where does it go. `kubectl explain` answers from the schema of the cluster you are connected to, which means it is never the wrong version, and `--recursive` prints a whole subtree in one screen.
-
Kustomize with kubectlPaid
Kustomize is built into kubectl, which makes it the one packaging tool guaranteed to be available on the exam.
-
Labels and Selectors
Labels are how every object in Kubernetes finds every other object - a Service finds Pods, a Deployment owns a ReplicaSet, a NetworkPolicy picks a target.
-
LVM Logical VolumesPaid
The top LVM layer and the one you actually put a filesystem on.
-
Container Logs and --previousPaid
When a container restarts, `kubectl logs` shows you the new one - which has not failed yet, so the error is not in it. `--previous` reads the dead container's log, and it is where the actual cause lives.
-
Shell Loops with for, while and untilPaid
One objective, phrased as "process file, command line input" - so the forms that matter are the ones that read a file and the ones that read a command's output.
-
Persistent systemd Journal ConfigurationPaid
By default the journal lives on tmpfs and is destroyed at every reboot - so the logs explaining why a machine went down are gone by the time you can read them.
-
Boot Loader ConfigurationPaid
One objective, and the last of the 62.
-
Persistent Mounts with UUID and LabelPaid
The objective that can cost every other mark on the exam: a malformed `/etc/fstab` stops the machine booting, and the grader reboots before marking.
-
NFS Mounts and Client PackagesPaid
The objective is the client side, and step one is the one that wastes the most time: `nfs-utils` is not installed on a minimal RHEL 10, and without it `mount -t nfs` fails with a message about a "remote address" that mentions no package at all.
-
Network Services at BootPaid
One objective, and it is a two-part answer that a one-part answer fails: NetworkManager must be enabled, **and** the connection must be set to autoconnect.
-
ConfigMap Consumption MethodsPaid
A ConfigMap is one object, but a Pod can consume it three ways at once - as an environment variable, as a mounted directory, and as a single file placed with subPath.
-
One-Time Jobs with atPaid
The second of the three tools the scheduling objective names, and the only one for "once, then never again".
-
Passwords and Account AgingPaid
One objective covering two things that look alike and are not: password expiry and account expiry.
-
LVM Physical VolumesPaid
The bottom layer of LVM, and the shortest of the three objectives.
-
Service Ports: port, targetPort and nodePortPaid
Three numbers are involved in getting a request to a container - `port`, `targetPort` and `containerPort` - and only two of them matter.
-
Shell Script ArgumentsPaid
One objective, `$1` and `$2` by name.
-
Process Priority with nice and renicePaid
A one-line objective with one genuinely non-obvious rule: a normal user can make their own process nicer but cannot make it greedier again, not even back to where it started.
-
Command Output in Shell ScriptsPaid
The last of the four scripting objectives, and the one that turns a script from a list of commands into something that reacts.
-
kubectl port-forward and proxyPaid
`kubectl port-forward` tunnels a local port to something in the cluster through the API server, which means it works on any Service, needs no NodePort and no Ingress, and reaches things that are not exposed at all.
-
Readiness Probes and Rollout ProgressPaid
A readiness probe restarts nothing.
-
Shell Redirection and Pipelines
One objective, and most of it is muscle memory.
-
Resource Requests, Limits and OOMKilledPaid
Requests are what the scheduler reserves; limits are what the kernel enforces.
-
Restoring Default SELinux ContextsPaid
The objective says "restore default file contexts", and the exam question behind it is always the same: a service cannot read files in a directory it should be able to.
-
Deployment Rollback and Revision HistoryPaid
`kubectl rollout undo` goes back one step, which is rarely the step you want.
-
RPM Queries and Local Package InstallationPaid
Covers "install and update software packages from the local file system" and the rpm queries that answer exam questions faster than dnf can.
-
Pod Phase Versus ReadinessPaid
STATUS says Running and the Service answers nothing.
-
Manual Scaling and HorizontalPodAutoscalerPaid
`kubectl scale` is one command and always works.
-
Scheduled Tasks with cronPaid
Part of one objective that names cron, at and timer units together. cron is the oldest and still the fastest to write.
-
Secrets: Creation, Consumption and EncodingPaid
A Secret is a ConfigMap with a different name, a type field, and one genuine difference: mounted Secrets land on tmpfs rather than disk.
-
SELinux BooleansPaid
One objective, and the easiest SELinux fix when it applies: policy already contains the rule you need and it is switched off.
-
SELinux File and Process ContextsPaid
One objective covering files and processes.
-
SELinux Enforcing and Permissive ModesPaid
The shortest SELinux objective.
-
SELinux Port LabelsPaid
One objective.
-
systemd Service State and EnablementPaid
One objective, and the single most expensive misunderstanding available: `start` and `enable` are unrelated.
-
Setting the Default Namespace in a Context
Most CKAD tasks name a namespace, and every one of them is scored in that namespace.
-
Special Permissions: SUID, SGID and Sticky BitPaid
Not a separate objective, and assumed by two that are: the collaborative directory in the groups objective needs SGID, and diagnosing permissions needs you to read an `s` or a `t` where you expected an `x`.
-
SSH, scp and rsync Transfers
Two objectives: accessing remote systems over SSH, and transferring files securely.
-
Linux File and Directory Permissions
chmod syntax takes ten minutes to learn.
-
RHCSA Exam Time ManagementPaid
Not an objective. 180 minutes, 210 of 300 to pass, and no partial credit for a task that half works.
-
User Switching and Login ShellsPaid
The objective is "log in and switch users in multi-user targets", and the one thing worth practising is that `su user` and `su - user` leave you with different environments.
-
systemd Targets and Boot SelectionPaid
Two objectives: booting into a target manually, and configuring the default.
-
systemd Timer UnitsPaid
The third tool the scheduling objective names, and the one Red Hat now ships its own periodic work as.
-
The CKAD Practice Cluster
CKAD tasks assume things exist: a default StorageClass so a PVC binds, an ingress controller so an Ingress does something, a metrics-server so an HPA has a denominator.
-
systemd Journal and System LogsPaid
One objective and the most useful troubleshooting skill in the blueprint.
-
ResourceQuota and LimitRangePaid
A ResourceQuota caps what a namespace may consume in total, and it has a side effect nobody expects the first time: once you quota a compute resource, every Pod must declare it, and `kubectl run` stops working.
-
NetworkPolicy Egress and DNSPaid
A default-deny egress policy blocks port 53 along with everything else, so DNS stops working and every symptom points at DNS rather than at the policy you just wrote.
-
Liveness, Readiness and Startup ProbesPaid
An application that takes 40 seconds to start and a liveness probe that gives up after 15 will never run: the probe kills it mid-boot, forever.
-
Deployment Rollout Health and AvailabilityPaid
A Deployment does not replace Pods; it manages two ReplicaSets and moves replicas between them under a budget.
-
Shell Help and Command Discovery
Two objectives in one guide: issuing commands with correct syntax, and locating documentation in man, info and /usr/share/doc.
-
Sidecar Containers in Jobs
A Job is complete when its Pod's containers have all terminated.
-
RHCSA Practice Lab Machines
Most of EX200 can be practised on one machine.
-
Controlling a Rollout with maxSurge and maxUnavailablePaid
`maxSurge` and `maxUnavailable` are the only two knobs on a rolling update, and together they decide whether a deploy is invisible to users or an outage.
-
Time Synchronization with ChronyPaid
One objective, one config file, and one thing worth insisting on: `systemctl is-active chronyd` proves the service runs, not that the clock is right. `chronyc tracking` and `timedatectl` are what answer the question the objective actually asks.
-
SELinux Denial TroubleshootingPaid
Not a separate objective, and what the other five are really testing.
-
System Tuning with tunedPaid
A small objective, usually taught as three commands to memorise.
-
LVM Volume GroupsPaid
The middle layer, and the one that makes LVM worth using: a volume group can grow by absorbing another disk while everything above it stays running.
-
Pod Volumes and Volume Lifetime
An application needs two kinds of storage: scratch space that can vanish, and data that must not. `emptyDir` and a PersistentVolumeClaim cover both, and the only thing that reliably confuses people is a claim that reports `Pending` while nothing at all is wrong with it.
-
Exposing Pod Metadata with the Downward APIPaid
The downward API injects facts about the Pod into the Pod - its name, the node it landed on, its own IP, the memory limit it was given.
-
RHCSA on RHEL 10 Changes
RHEL 10 changed enough that older RHCSA material is actively misleading, and the corrections circulating about it are not all correct either.
-
CKAD Exam Format and Scope
CKAD is two hours of practical tasks on a cluster somebody else built.
-
RHCSA Reboot Persistence ChecklistPaid
Not an objective.
-
RHCSA Exam Format and Objectives
EX200 is 180 minutes of real work on a real machine: no multiple choice, no internet, and a grader that reads the state of the system rather than the commands you typed.
-
Multi-Container Pods: Shared Network and Volumes
Every multi-container pattern on the CKAD - sidecar, adapter, ambassador - is built out of exactly two shared things: one network namespace and any volumes you mount in both containers.
-
Running Shell ScriptsPaid
Not an objective on its own, and assumed by all four that are.
-
Progressive Delivery and Automated RollbackPaid
A Deployment gives you one rollout strategy and no opinion about whether the new version is any good.
-
Podman Containers as systemd Units
A nine-line `.container` file becomes a real systemd service, and `systemctl --user enable` then fails on it because the unit is generated, not installed.
-
Podman Auto-Update with systemd
Push a new image under the same tag and `podman auto-update` pulls it and restarts the container - no orchestrator.
-
DaemonSets and Node EligibilityPaid
"A DaemonSet runs one Pod on every node" is the definition everyone learns and it is not what the controller does.
-
Podman Pods and Infra Containers
`podman pod inspect` answers the question directly: `shared=[uts ipc net]`.
-
Podman Private Registry Setup
A registry container on podman03, and the first push fails with `http: server gave HTTP response to HTTPS client`.
-
Sidecar ContainersPaid
An init container with `restartPolicy: Always` is not an init container.
-
Podman Image Signature Policy
Two identical images in one registry, one signed.
-
Podman tmpfs and Read-Only Filesystems
`--opt type=tmpfs --opt o=size=8m` makes a volume that lives in RAM and enforces its size - a 16 MB write stops at 8.
-
The Argo CD Application ResourcePaid
Point Argo CD at a Git path with twenty lines of YAML and it deploys, then keeps deploying.
-
SLOs, SLIs and Error BudgetsPaid
An SLO is not a document.
-
Helm Charts and Release StatePaid
helm create scaffolds a working chart, helm template renders it without a cluster, and --dry-run creates nothing at all - not even the namespace.
-
HorizontalPodAutoscaler and Resource Requests
An HPA on a Deployment with no CPU requests reports cpu: <unknown>/60% forever.
-
Podman Volume Backup
`podman volume export` writes a plain tar of a volume's contents - no helper container, no `-v $(pwd):/backup` incantation.
-
Building Images with Containerfiles
Five instructions, five STEP lines, and an image tagged `localhost/app:1` - Podman prefixes locally built images with a registry that does not exist, which is the first thing that will confuse you when you try to push it.
-
Buildah and podman build
`buildah` is already installed - it arrived with Podman.
-
Docker Build Cache in CI/CD
A CI worker starts with an empty cache every run, which is why naive pipelines rebuild everything every time.
-
Creating a User with a CertificateSigningRequestPaid
Kubernetes has no User object.
-
Docker Disk Usage and Cleanup
Where the space actually goes - measured, not guessed.
-
Draining a Node for MaintenancePaid
`kubectl drain` refuses twice before it works, and each refusal names the flag it wants: DaemonSet pods, then pods with no controller.
-
Podman Remote Client Setup
`podman system connection add` succeeds without testing anything, then the first real command fails with an ssh handshake error.
-
Podman Capability Dropping and Restoration
Each failure names the next capability: chown, then bind.
-
Essential Podman CLI Commands
The dozen commands that cover most days, and the `--format` template that turns any of them into a single line you can script against.
-
PVC Expansion and Volume SnapshotsPaid
Patch a PVC from 64Mi to 128Mi and it reports 128Mi requested against 64Mi actual, with FileSystemResizePending.
-
Troubleshooting Expired Certificates
kubeadm certificates last one year and renewing them is one command.
-
Cloud Native Standards: CRI, CNI, CSI and OCI
CRI, CNI, CSI and OCI are not trivia - they are why you can swap Docker for containerd, Flannel for Calico, or one storage backend for another without Kubernetes noticing.
-
Generating Kubernetes YAML from Podman
`podman kube generate` turns a pod you built by hand into a real `apiVersion: v1 / kind: Pod` manifest.
-
Podman Quadlet and Deprecated systemd Generation
`podman generate systemd` still runs and opens with `[DEPRECATED]`.
-
Owner References and the Controller Chain
Two numbers tell you whether a controller has caught up with your change, and one field explains why deleting a Pod does not help.
-
Grafana Dashboards for KubernetesPaid
The chart ships Grafana already pointed at Prometheus, with 29 dashboards delivered as ConfigMaps and loaded by a sidecar.
-
Docker Image SBOMs and Provenance
You cannot answer "are we affected by this CVE" without knowing what is inside your images.
-
Inspecting Podman Containers
Four questions and the command for each: what has it said, what is it running, what is it costing, and what has it changed. `podman diff` is the one people never reach for and should.
-
Installing Argo CD
The documented one-liner fails on this chart with "annotations: Too long".
-
Podman Installation on Ubuntu 26.04
Podman installs from Ubuntu's own repository in a single command.
-
Installing Prometheus on Kubernetes
Install kube-prometheus-stack with Helm and watch all four node-exporters go into CrashLoopBackOff.
-
kubectl Productivity for the ExamPaid
Two hours, seventeen tasks. `--dry-run=client -o yaml` writes the manifest you were about to type from memory, `kubectl explain` replaces the browser tab, and jsonpath answers a question instead of printing a table to read.
-
kubectl and the Kubernetes API
Turn up the verbosity and kubectl stops being magic: it is a GET to an HTTPS endpoint that returns JSON.
-
Podman User Services and Linger
Everyone repeats that a rootless service dies at logout.
-
Podman Container Logs and Persistence
`podman rm` the container and `podman logs` says no such container - but `journalctl --user CONTAINER_NAME=talker` still prints every line. journald is the store; `podman logs` is only a reader that needs the container to exist.
-
Docker to Podman Migration Differences
`docker run` mostly just works.
-
Moving Podman Images Without a Registry
`podman image scp localhost/multi:1 lab02::` copies an image host to host and prints `Loaded image`.
-
Podman Multi-Stage Builds
The same Containerfile produces an 8.66 MB image and a 182 MB one, and the difference is which stage you stop at. `--target` builds the discarded half so you can look at what was thrown away.
-
Podman Netavark and Aardvark DNS
Two Rust binaries in /usr/lib/podman that you never invoke: netavark configures the network and aardvark-dns answers name lookups.
-
Podman Network Drivers Beyond Bridge
`--network none` leaves a container with loopback and nothing else. `host` gives it your namespace outright.
-
Default Alerting Rules and Alert TuningPaid
A fresh kube-prometheus-stack fires nineteen alerts on a working cluster.
-
Taints and Tolerations: NoSchedule and NoExecutePaid
A taint is a node saying no.
-
Pod Sandboxes and Pause ContainersPaid
Ten Pods on this node means ten pause containers doing nothing at all.
-
Podman Pasta Networking
A rootless container on the default network has `eth0` set to 192.168.0.21 - the host's own LAN address - and an empty IPAddress field.
-
podman-compose and Docker Compose Differences
The same compose.yaml gives you `stack_web_1` from podman-compose and `stack-web-1` from `podman compose`.
-
Podman and Docker CLI Differences
`podman-docker` puts a /usr/bin/docker on your PATH and most commands just work.
-
Docker Production Troubleshooting
The failures you will actually meet, each reproduced deliberately so you recognise the exact wording.
-
Podman Low-Port Publishing and sysctl
`-p 80:80` rootless fails with `pasta failed ...
-
RBAC: Roles, ServiceAccounts and BindingsPaid
A ServiceAccount starts able to do almost nothing.
-
Docker Read-Only Containers and Capabilities
Harden a real nginx container to a read-only filesystem and four capabilities - including the two failed attempts, because the failures are where the learning is.
-
Podman Error Diagnosis
Every failure on this path named its own cause: `Invalid argument` versus `Permission denied`, pasta versus nginx on port 80, a netns error that still exits 0.
-
Docker Compose with Podman
Enable `podman.socket`, set `DOCKER_HOST`, and the genuine Docker Compose binary brings up a two-service stack on Podman.
-
Renewing Cluster CertificatesPaid
`kubeadm certs renew all` rewrites eleven certificates and tells you to restart four components.
-
Podman Kubernetes YAML Replica Behavior
A Deployment asking for three replicas gets a warning and one pod.
-
Resource Requests, Usage and Cost
A cluster can be completely full while every node sits at 3% CPU.
-
Podman Pod Restart with systemd
A `.pod`, a `.volume` and a `.container` file, and starting one of them starts all three.
-
Podman Rootless and Rootful Capabilities
`CapEff: 00000000800405fb` in a rootless container, and the identical value under sudo.
-
Rootless Podman Build UID Limits
`RUN chown 65000:65000` builds fine and `RUN chown 70000:70000` fails with `Invalid argument`, because /etc/subuid grants you exactly 65536 subordinate UIDs.
-
Rootless Docker and Daemon Socket Access
Membership of the docker group is equivalent to root on the host, and most people who have it do not know why.
-
Rootless Podman Defaults
You are root inside the container and uid 1000 outside it, at the same instant, for the same process.
-
Running Kubernetes YAML with Podman
`podman kube play` runs a Kubernetes manifest on a single host with no cluster, no kubelet and no API server. `podman kube down` then prints a netns error and exits 0 - the pod is gone, and the same pod built by hand tears down silently.
-
Running and Managing Podman Containers
The five states a container moves through, and the two flags that decide whether you ever see it again.
-
Scale to Zero on KubernetesPaid
Kubernetes will happily run zero replicas - that half of serverless is built in.
-
GitOps Self-Heal and PrunePaid
Scale a managed Deployment by hand and the change is gone before the next command runs.
-
Podman Short Names and Registry Resolution
`podman pull hello-world` fetches `quay.io/podman/hello`, not Docker's image - and the same command on the same host returns a different image once one is already in your store.
-
Docker Swarm Cluster Architecture
Docker's own orchestrator, already in the engine you have installed.
-
Docker Swarm Node Maintenance and Failover
Take a machine out of service without dropping a request.
-
Docker Swarm Overlay Networks and Routing Mesh
Publish a port on a cluster and every node answers it - including nodes running none of your containers.
-
Docker Swarm Rolling Updates and Rollback
Change the image on a live service and watch the cluster replace tasks a few at a time.
-
Docker Swarm Services and Scheduling
A service is a desired state, not a container.
-
Docker Swarm Stacks and Secrets
Deploy a Compose file to the whole cluster with one command, and distribute a password to only the services that need it - proved by the service that should not have it finding nothing at all.
-
PodDisruptionBudgets and Node DrainPaid
`ALLOWED DISRUPTIONS 0` and a drain that retries every five seconds forever: `Cannot evict pod as it would violate the pod's disruption budget`. minAvailable 3 with 3 replicas permits nothing, and the arithmetic is the whole guide.
-
The cgroup Driver: kubelet and containerdPaid
The kubelet and the runtime each decide how to talk to cgroups.
-
The KCNA Practice Cluster
Four nodes, Kubernetes 1.36.4, containerd 2.2.6 - and a kubectl one minor behind the server, which is supported and worth understanding rather than fixing.
-
Podman Default Network DNS Behavior
`getent hosts beta` exits 2 on the default network and resolves on a user-defined one.
-
Podman Volume Ownership and Permissions
A container running as its own user 1000 writes files owned by host UID 100999.
-
The CNCF Landscape and Project Maturity
The CNCF landscape is usually taught as a poster to memorise.
-
Pod Security Admission Namespace Labels
One label on a namespace turns a privileged Pod from Running into Forbidden.
-
Podman Without a Daemon
Start a container, then look for the process that owns it. `pgrep podman` finds nothing, `podman.service` is inactive, and the running nginx is a child of PID 1 by way of a 96-argument monitor called conmon.
-
HPA, VPA and Cluster Autoscaler
HPA adds Pods, VPA resizes them, Cluster Autoscaler adds nodes.
-
Podman Pods and Shared Localhost
A sidecar reaches its web server on `http://localhost:80` with no network, no DNS and no service.
-
Podman Volumes and Bind Mounts
A named volume is a directory in your rootless store that Podman manages; a bind mount is a path you chose.
-
NetworkPolicy Scope and LimitationsPaid
Two Pods talk in plaintext, a default-deny stops them dead, and one label-based rule lets exactly one caller back in.
-
Container Runtimes and the CRI
The kubelet does not run containers.
-
KCNA Exam Format and Domain Weights
KCNA is broad and shallow on purpose: four domains, one of them nearly half the exam, and no live cluster to fix.
-
The Four Cs of Cloud Native SecurityPaid
Cloud, Cluster, Container, Code.
-
Rootless Podman Image Storage
185 MB of images in `~/.local/share/containers/storage`, on your home filesystem and counted against your quota.
-
Podman Prune Commands and Data Loss
`container prune` and `image prune` reclaim space and lose nothing. `volume prune` removed two volumes here, one of them a Compose volume with data in it - and it is the only one of the three that is irreversible.
-
Prometheus Targets and Control Plane Scraping
Prometheus reports kube-proxy, the scheduler, the controller manager and etcd as down on a healthy cluster.
-
Podman Stop Timeout and PID 1
`podman stop` on a container running `sleep` takes 10.119 seconds and ends in SIGKILL.
-
Podman Image Layers and Build Cache
Rebuilding an unchanged Containerfile produces the same image ID, so `app:1` and `app:2` are one image with two tags.
-
Replica Count and Cluster CapacityPaid
Scale to 8 with a ResourceQuota and an HPA in place and you land on 4.
-
PromQL Query BasicsPaid
Query Prometheus from a Pod instead of a port-forward.
-
Podman Pasta Source Address Behavior
Two curls from the same machine reach the same container and its access log records `::1` for one and `169.254.1.2` for the other.
-
ClusterIP Services and Virtual IPs
A Service gets an IP address that answers HTTP and refuses ping, because nothing owns it.
-
Gateway API and GatewayClass
The Gateway API is not in Kubernetes - it arrives as CRDs you install.
-
Pod Restart Policies and Job Completion
Every other workload object exists to keep something running.
-
Access Modes and Reclaim PoliciesPaid
Ask a node-local provisioner for ReadWriteMany and watch the claim hang.
-
Docker Build Cache Mounts and Secrets
Two BuildKit features that solve problems the layer cache cannot: a package cache that survives --no-cache, and a way to use a private token during a build without it ending up in the image.
-
Docker Buildx and Multi-Platform Images
One tag serving amd64, arm64 and arm/v7.
-
Calico Internals and Policy EnforcementPaid
Pod networking stops being magic once you can see the pieces: a per-node IPAM block, one veth and one host route per Pod, a blackhole for the local block, and Felix rendering policy into the node's packet filter.
-
Choosing and Installing a CNI PluginPaid
Why a fresh kubeadm cluster has no pod network, what a CNI plugin actually installs, how to choose between Calico, Cilium and Flannel, and how to read what Calico did to your nodes: one address block per node, routes to its neighbours, and encapsulation it turns out not to be using.
-
Cluster Triage Order
Under pressure, the order you check things in matters more than knowing every command.
-
Docker Compose Multi-Service Applications
The shape almost every real project takes: an application talking to a database over the project network, with the data on a named volume that survives a teardown.
-
Docker Compose Environment and Secrets
Four different things all called environment, doing four different jobs.
-
Docker Compose Health Checks and Dependencies
Up does not mean ready, and the gap between them is where flaky startups live.
-
Docker Compose Profiles, Overrides and Watch
Three features that turn one Compose file into a workflow: optional services behind profiles, per-machine overrides that merge automatically, and live file sync that updates a running container without a rebuild.
-
ConfigMaps and SecretsPaid
Four ways to hand configuration to a container, and the one difference that catches everyone: patch a ConfigMap and the mounted file updates while the environment variable does not.
-
Docker Container Logs and Rotation
Container logs are files on the host and by default they grow without limit.
-
Container Logs with kubectl logs
A two-container Pod, and the flags that turn kubectl logs from a firehose into an answer: picking a container, all of them at once with prefixes, a time window, timestamps, and selecting by label across Pods.
-
Control Plane and Node ComponentsPaid
Every diagram of Kubernetes architecture shows five boxes.
-
Troubleshooting a Down Control Plane
Take the API server away and every kubectl command dies with it. crictl still answers, because it talks to the runtime rather than the cluster, and it is the only view you have left of a control plane that cannot report on itself.
-
CoreDNS and Service DiscoveryPaid
Resolve one Service four ways, get a headless Service to hand back every Pod IP, and measure the real cost of a short name by counting the queries CoreDNS receives: five for `fleet`, one for the fully qualified name.
-
Troubleshooting CrashLoopBackOff
A container that exits 3 on startup, caught mid-cycle.
-
CSI DriversPaid
Kubernetes has no storage code of its own.
-
Custom Resources and OperatorsPaid
A CRD gives you a real Kubernetes resource with validation, printer columns, RBAC and kubectl support, for the cost of one YAML file.
-
DaemonSetsPaid
A DaemonSet has no replica count.
-
Declarative Versus Imperative Object ManagementPaid
Create the same Deployment twice, once with a command and once with a file, then look at what each left behind on the object.
-
Deployment Rollouts and RollbacksPaid
Write a Deployment, follow the ownership chain down to the Pods, roll an image forward and back, read what a revision records, and push a broken image to watch the rollout stall while the old ReplicaSet keeps serving every request.
-
Troubleshooting DNS Resolution Failures
A name that does not exist answers instantly; a resolver that cannot be reached takes the whole timeout.
-
Docker Compose Fundamentals
One file replaces a page of docker run flags.
-
Endpoints and EndpointSlicesPaid
A Service is a selector; the EndpointSlice is the answer to it.
-
etcd Backup and RestorePaid
Take a snapshot, create something after it, then restore and watch that thing cease to exist.
-
Troubleshooting Unhealthy etcd
Stop etcd and the API server stays up, which changes the symptom completely: requests time out instead of being refused, and livez reports every check ok except one.
-
Events, describe and Object Status
Almost every Kubernetes failure explains itself in one of three places: an event, the Events section of describe, or a status condition.
-
Four-Node kubeadm Cluster SetupPaid
Build a control plane and three workers, then use the third worker to reach the placement features that need it: pod anti-affinity with somewhere to spread to, topology spread constraints, and a drain that leaves two healthy workers behind.
-
Gateway APIPaid
Ingress replaced with three objects owned by three different people, plus weighted splits and header matching without a single annotation.
-
Helm BasicsPaid
Helm templates YAML and remembers what it sent, which is what makes rollback work.
-
Highly Available Control Planes and etcd QuorumPaid
A three-node control plane built from scratch: keepalived and haproxy in front, stacked etcd behind, and a controlPlaneEndpoint that has to exist before the first init.
-
HorizontalPodAutoscalerPaid
Put real load on a Deployment and watch it go from one replica to six.
-
Docker Image Layers and Build Cache
Why instruction order decides whether your build takes one second or ninety.
-
Troubleshooting ImagePullBackOff
Two Pods with the same status and completely different problems: one image tag does not exist, one registry cannot be resolved.
-
Troubleshooting Ingress 404 and 502 Errors
The status code tells you which hop failed, and that is most of the diagnosis. 404 means nothing matched, 503 means matched but no backend, 502 means the backend answered badly.
-
Ingress ControllersPaid
An Ingress is a request that some controller has to answer.
-
Ingress Routing RulesPaid
The obvious path-based Ingress returns 404, and the 404 comes from your application rather than the controller.
-
Init Containers and Startup OrderPaid
Init containers run to completion, one at a time, before any app container starts.
-
Jobs and CronJobsPaid
Every other controller keeps Pods running forever.
-
kube-proxy: iptables and IPVS ModesPaid
Trace one Service from its ClusterIP through three iptables chains to the DNAT rule that rewrites the packet, then switch a cluster to IPVS and read the same routing out of ipvsadm.
-
kubectl debug and Ephemeral Containers
A distroless container refuses every exec because it contains no shell.
-
kubeconfig Contexts and Multi-Cluster AccessPaid
Stop SSH-ing to the control plane to run kubectl.
-
Troubleshooting a Kubelet That Will Not Start
Break the kubelet's config and restart it. systemctl reports activating, which reads like progress and means a restart loop.
-
Kustomize BasicsPaid
One base, one overlay per environment, no templating language.
-
Labels, Selectors and nodeSelectorPaid
Labels are the only way anything in Kubernetes finds anything else.
-
LoadBalancer Services on Bare Metal with MetalLBPaid
A LoadBalancer Service off-cloud sits at Pending forever, because nothing is listening for it.
-
Metrics Server and Resource Pressure
The same node reads 1% CPU in kubectl top and 5% in describe node.
-
Moving Docker Images Without a Registry
Registries are the normal path, but not always an available one.
-
Docker Multi-Stage Builds
Compilers, headers and package managers belong in the build, not in the thing you ship.
-
Namespaces, ResourceQuotas and LimitRangesPaid
A quota caps a namespace in total, a LimitRange constrains each container, and they are enforced at different moments by different code.
-
Troubleshooting NetworkPolicy-Blocked Traffic
A NetworkPolicy denial times out rather than refusing, which makes it look like a dead backend.
-
NetworkPolicy Default DenyPaid
Prove that an empty cluster lets everything talk to everything, close it with a four-line policy, then open exactly one path.
-
NetworkPolicy PatternsPaid
Allow a whole namespace, then restrict egress and watch the Pod lose DNS while still reaching the same backend by IP.
-
Node Affinity: Required and PreferredPaid
nodeSelector is all or nothing.
-
Troubleshooting Node NotReady
Stop a kubelet and watch what happens: the node goes NotReady with Ready=Unknown, two taints appear on their own, containers keep serving, and the Pod still reports Running because nothing is left to say otherwise.
-
Troubleshooting OOMKilled and Exit Code 137
A container asks for 200MB against a 64Mi limit and is killed mid-write.
-
PersistentVolumes and PersistentVolumeClaimsPaid
Create a 1Gi volume by hand, then two claims: one asks for 5Gi and waits forever, the other asks for 500Mi and gets the whole gigabyte.
-
Troubleshooting Pod Pending
The scheduler explains itself precisely and almost nobody reads it.
-
Pods: The Basic Deployment UnitPaid
Kubernetes does not run containers, it runs Pods.
-
PriorityClasses and PreemptionPaid
Fill a node with low-priority Pods, then schedule a high-priority one and watch the scheduler delete a running Pod to make room.
-
Probes and Pod LifecyclePaid
Three probes that look similar and do entirely different things: one gates traffic, one restarts the container, one buys time at startup.
-
Troubleshooting PVC Pending
Three claims, all Pending, and only the event type tells them apart: one is waiting on purpose, one names a class that does not exist, and one asks for something the backend cannot do and does not say so.
-
Troubleshooting RBAC Forbidden Errors
Three Forbidden errors from one ServiceAccount, differing by verb, by resource and by namespace.
-
RBAC Roles and BindingsPaid
Four object kinds, one verb-and-resource model, and a command that answers permission questions without trial and error.
-
ReplicaSetsPaid
Create a ReplicaSet by hand, watch it replace a deleted Pod, then create a Deployment and follow the ownership chain it builds.
-
Resource Requests, Limits and QoS ClassesPaid
Requests are what the scheduler reserves.
-
Resetting and Rejoining a Node with kubeadmPaid
Take a node out of a cluster and put it back, and take a machine all the way back to bare Ubuntu.
-
Docker Restart Policies and Resource Limits
What actually happens when a container dies, and what stops one container taking the host down with it.
-
Rolling Update Strategy: maxSurge and maxUnavailablePaid
Poll a Deployment through two rollouts and read the counts. maxSurge shows up as READY exceeding the replica count; Recreate shows up as AVAILABLE dropping to zero.
-
nodeSelector and Scheduling Constraints
Two Pods with an identical nodeSelector pointing at the same node.
-
securityContext and Non-Root ContainersPaid
Containers run as root unless you say otherwise.
-
Troubleshooting a Service With No Endpoints
Two broken Services with identical symptoms.
-
Services: ClusterIP, NodePort and LoadBalancerPaid
Three Service types that stack on top of each other, one address that nothing owns and that ping cannot reach, and a LoadBalancer that stays Pending forever on bare metal.
-
Single-Node kubeadm Cluster SetupPaid
Take one Ubuntu 26.04 machine from nothing to a working Kubernetes cluster with kubeadm: containerd on the systemd cgroup driver, the kernel settings kubelet needs, Calico for pod networking, the control-plane taint removed, and a workload proving DNS and Service routing both work.
-
StatefulSets: Stable Identity and Ordered StartupPaid
A Deployment's Pods are interchangeable and get random names.
-
Static PodsPaid
Your control plane is four static pods.
-
Storage for StatefulSets: volumeClaimTemplatesPaid
volumeClaimTemplates gives every replica its own claim, named by ordinal.
-
StorageClasses and Dynamic ProvisioningPaid
A claim with no PersistentVolume behind it, deliberately stuck Pending until a Pod appears.
-
Docker Image Tagging and Publishing
How an image name is actually parsed, why :latest is a trap, and a full push and pull against a registry running in a container on your own machine - no account, no credentials, real digests.
-
Taints and TolerationsPaid
A nodeSelector says where a Pod wants to go.
-
Ingress Path Routing and Rewrites
An Ingress object is a routing table that does nothing on its own - a controller has to be running to read it.
-
The Downward APIPaid
Inject a Pod's own name, node and IP as environment variables, mount its labels as files, then find that a 50m CPU request arrives as the number 1 and that the files update while the variables never do.
-
The Kubernetes Network ModelPaid
Three separate address ranges are in play and confusing them causes most Kubernetes networking problems.
-
LimitRange Defaults for Pods
A Pod created with no resources at all comes back holding a CPU request, a memory request and both limits.
-
Reading Pod Status and Container State
Six broken Pods at once.
-
Debugging Containers with Ephemeral Containers
kubectl logs picks a container for you without saying which until you ask.
-
Three-Node kubeadm Cluster SetupPaid
Build a control plane and two workers, then use the second worker for what it is actually for: watch six replicas spread across both, drain one node and see every pod reschedule onto the other while the Service keeps answering.
-
Volume Types and What Each One Loses
An emptyDir shared by two containers, deleted with its Pod.
-
Service Types: ClusterIP, NodePort and LoadBalancer
A NodePort answers on all four nodes, including the ones running nothing.
-
TLS for IngressPaid
Add four lines and a Secret and the Ingress serves HTTPS.
-
Topology Spread ConstraintsPaid
Nine replicas, maxSkew of 1, and only three ever schedule.
-
Two-Node kubeadm Cluster SetupPaid
Add a real worker to a kubeadm cluster.
-
Upgrading a Cluster with kubeadmPaid
A real minor-version upgrade of a two-node cluster, control plane then worker.
-
Volume SnapshotsPaid
A snapshot is three objects with the same shape as PVC, PV and StorageClass.
-
Volumes: emptyDir and hostPathPaid
Two containers share an emptyDir, then the Pod is deleted and the data is gone.
-
What Kubernetes Is and What It DoesPaid
Kubernetes is a database of desired state with programs that keep reality matching it.
-
First kubectl Session: Inspecting a ClusterPaid
Six commands that tell you what cluster you are pointed at, what it can be asked for, and what every field in a manifest means.
-
Docker Volume Backup and Restore
A named volume has no export command.
-
Building Images with Dockerfiles
Write a five-instruction Dockerfile, build it, run it, then build it again and watch the cache turn a 0.6 second build into 0.1.
-
Docker Daemon Configuration
daemon.json changes every container on the host, and a malformed file stops Docker starting at all.
-
Docker User-Defined Networks and DNS
Why containers on the default bridge cannot find each other by name, and how one command fixes it.
-
Docker Containers, Images, Registries and Daemon
The four things every later guide assumes you understand, each demonstrated with a command rather than a diagram: why the client and daemon are separate, how an image differs from a container, what a registry actually stores, and where a digest comes from.
-
Docker Daemon and Container Events
The event stream is the timeline logs do not give you.
-
Docker Contexts and Remote Hosts
Drive a Docker host across the network from your own machine, using SSH rather than an exposed daemon port.
-
Dockerfile Instructions in Practice
ARG versus ENV, ENTRYPOINT versus CMD, and why USER matters - shown with one Dockerfile that exercises all of them and the inspect output proving what each instruction actually recorded.
-
Docker Build Context and .dockerignore
What the trailing dot in docker build actually sends, why a stray 3MB file made the image 6MB bigger, and how one .dockerignore file cut the transfer from 3.00MB to 138B.
-
Essential Docker CLI Commands
The dozen commands that cover most day-to-day container work, grouped by what you are trying to do rather than alphabetically.
-
Inspecting Docker Containers and Processes
How to answer the four questions you ask when something is wrong: what state is it in, what is it printing, what is it running, and what is it consuming.
-
Docker Engine Installation on Ubuntu 26.04
Install Docker Engine from the official apt repository on Ubuntu 26.04, confirm the daemon is running, watch a real multi-layer image pull, and drop the sudo prefix.
-
Docker Network Drivers Beyond Bridge
Bridge is the default, not the only option.
-
Docker Volumes and Bind Mounts
Anything written inside a container dies with it.
-
Docker PID 1, Signals and Graceful Shutdown
Why docker stop takes ten seconds and ends in exit 137, even for a process that should die instantly.
-
Docker Private Registry Authentication
Run a registry that demands credentials, watch an unauthenticated push get refused, log in properly - then look at where Docker actually put your password.
-
Docker Port Publishing and Container Networking
Why -p 8080:80 works, why two containers on the default bridge cannot find each other by name, and why creating your own network fixes it.
-
Running and Managing Docker Containers
Run a throwaway container, then a long-running web server, and drive it through its whole lifecycle - start, stop, restart, remove.
-
Docker Image Vulnerability Scanning
Scan a deliberately old base image, read what comes back, then prove the fix: the same scan against a current base returns zero findings.
-
Docker Engine Upgrade, Pinning and Removal
How to see which versions exist, upgrade safely, pin a version so an unrelated apt upgrade cannot move it, roll back, and remove Docker without destroying the volumes that hold your data.
-
Docker Container Process Model
A container is an ordinary Linux process with a restricted view of the machine.