Month 1 Bare-Metal Linux Hardening, Kernel Optimization & Zero-Trust Security Weeks 1–4 • 8 Live Sessions
  • Session 1-2: Production Linux foundation: Linux filesystem hierarchy, systemd service management, process scheduling, and SSH key authentication hardening.
  • Session 3-4: Network layer defense: UFW & iptables custom rules, Fail2ban intrusion prevention, rate-limiting SSH/HTTP ports, and automated security audit scanning.
  • Session 5-6: Kernel tuning for high-concurrency: Modifying sysctl.conf (file descriptors, TCP backlog limits, ephemeral ports, and swappiness) under heavy traffic loads.
  • Session 7-8 (Live Hand-Holding): Bare-Metal VPS Hardening Lab — Taking a freshly provisioned Ubuntu/Debian VPS and transforming it into a battle-tested, automated bastion server with zero root attack surfaces.
Month 2 Production Docker Engine, Distroless Images & Container Networking Weeks 5–8 • 8 Live Sessions
  • Session 9-10: Linux container primitives under the hood: Namespaces, cgroups, chroot, and container runtime mechanics (containerd/runc).
  • Session 11-12: Enterprise multi-stage Docker builds: Layer caching optimizations, multi-architecture compiling (ARM64/AMD64), and sub-50MB Google Distroless/Alpine images.
  • Session 13-14: Deep dive into Docker networking: Bridge vs Host vs Overlay networks, DNS resolution mechanics, and secure secret injection without baking tokens into image history.
  • Session 15-16 (Live Hand-Holding): Multi-Service Production Cluster Lab — Orchestrating an isolated microservice compose stack with automated volume backups, non-root execution, and health-check healing.
Month 3 Kubernetes Cluster Architecture, Traefik Ingress & Storage Orchestration Weeks 9–12 • 8 Live Sessions
  • Session 17-18: Kubernetes control plane & worker node anatomy: API Server, etcd distributed consensus, kube-scheduler, kubelet, and CRI/CNI layers.
  • Session 19-20: Deploying bare-metal clusters (K3s/kubeadm): Node joining, taint/toleration scheduling, node affinity, and resilient cluster networking with Flannel/Calico.
  • Session 21-22: Traffic management: Traefik Ingress Controller, automatic Let's Encrypt wildcard SSL issuance with cert-manager, middlewares, and path-based routing.
  • Session 23-24 (Live Hand-Holding): Live Kubernetes Provisioning Lab — Bootstrapping a multi-node Kubernetes cluster across distinct VPS instances, configuring ingress routing, and securing live SSL domains.
Month 4 GitOps CI/CD Pipelines, Prometheus Telemetry & Live Infrastructure Defense Weeks 13–16 • 8 Live Sessions
  • Session 25-26: GitOps deployment pipelines: GitHub Actions continuous integration, automated semantic versioning, container registry publishing, and zero-downtime rolling updates.
  • Session 27-28: Cloud-native stateful workloads: Persistent Volumes (PV), Persistent Volume Claims (PVC), Longhorn/local storage classes, and automated volume snapshots to S3/Cloudflare R2.
  • Session 29-30: Observability stack: Prometheus metric scraping, Node Exporter host telemetry, Grafana alert dashboarding, and Loki centralized log collection.
  • Session 31-32 (Final Capstone & Architecture Defense): Chaos Engineering & Live Cluster Defense — Conducting live pod evictions, node failure recovery, and defending a self-healing production microservice cluster under simulated DDoS traffic.