Full Stack DevOps Trainer

Before any tool, the map. What actually happens between a commit and a serving request in your organisation today, where the manual steps and approvals sit, and how long each stage takes. DevOps as a set of feedback loops rather than a job title, the four delivery metrics that make the argument measurable, and an honest look at where DevOps practice is the wrong investment.

Topics: From waterfall to continuous delivery — what actually changed · DevOps, SRE, platform engineering and DevSecOps: the real distinctions · Value stream mapping a real delivery path · Lead time, deployment frequency, change failure rate and MTTR · Feedback loops and where they break · Anatomy of the modern toolchain, layer by layer · Where DevOps investment does not pay back

• Assignments: (1) Value-stream-map your team's current path from commit to production; (2) Measure or estimate the four delivery metrics for one real service
• Capstone: Produce a current-state and target-state delivery diagram with the three highest-cost gaps named and costed

The substrate everything else runs on, taught at the depth a pipeline engineer needs rather than as a sysadmin course. Processes, systemd, filesystems and permissions; the networking that explains half of all container and cluster failures; and enough shell and Python to automate without reaching for a tool.

Topics: Processes, signals, systemd units and journald · Filesystems, permissions, users and sudo policy · Package management and repository hygiene · TCP/IP, DNS, routing, NAT and firewalls as they affect containers · TLS, certificates and the errors they produce · Shell scripting for automation: exit codes, traps, set -euo pipefail · Python for glue: HTTP APIs, JSON/YAML handling, subprocess · SSH keys, agents and jump hosts

• Assignments: (1) Diagnose three broken services using only journald, ss and systemctl; (2) Write an idempotent shell script that provisions a host from bare install
• Capstone: Build the Linux lab environment used for the rest of the programme, provisioned by script rather than by hand

Git as the input to automation, not as a file-sharing habit. The object model that explains merge, rebase and reset; branching strategies compared by what they cost a build server; and the repository conventions — tagging, semantic versioning, conventional commits, protected branches, code owners — that let a pipeline make decisions without asking a human.

Topics: The Git object model: blobs, trees, commits, refs · Merge vs rebase, and recovering from both going wrong · Trunk-based development, GitFlow and GitHub Flow compared by CI cost · Monorepo vs polyrepo: build triggers, ownership and blast radius · Tagging, semantic versioning and conventional commits · Protected branches, required checks, code owners and review policy · Pull request automation and merge queues · Pre-commit hooks and keeping secrets out of history · Removing a committed secret from history properly

• Assignments: (1) Convert a long-lived-branch repository to a trunk-based model with required checks; (2) Recover a repository from a bad force-push and a leaked credential
• Capstone: Define and enforce a repository standard — branching, versioning, protection rules and hooks — across three repositories

The stage that decides whether the rest of the pipeline is honest. Reproducible builds with Maven, Gradle or npm; dependency resolution, lock files and transitive risk; and the central idea of the programme — one artifact, built once, versioned, stored with provenance, and promoted unchanged. Then artifact repositories: layout, retention, proxying and cleanup.

Topics: Build tools: Maven, Gradle, npm/yarn, and language-agnostic Make · Dependency resolution, lock files and transitive dependencies · Reproducible and hermetic builds · Build once, promote many — and why rebuilding per environment is a defect · Semantic versioning and build metadata · Artifact repositories: Nexus and Artifactory layout and retention · Proxying public registries and why you should · Software bill of materials and dependency provenance · Build caching and pipeline duration

• Assignments: (1) Make a non-reproducible build reproducible and prove it with two identical checksums; (2) Set up a proxied repository and cut external registry calls from a build
• Capstone: Deliver a build that emits one versioned, checksummed artifact with an SBOM, stored in a repository with a retention policy

Turning the build into an automatic, trustworthy gate. Pipeline as code in Jenkins, GitLab CI and GitHub Actions; agents, runners and executors; the test pyramid and what belongs at each stage; parallelism, caching and pipeline duration as a product decision; and quality gates — coverage, static analysis, licence policy — that block rather than warn.

Topics: Pipeline as code: Jenkinsfile, .gitlab-ci.yml, GitHub Actions workflows · Agents, runners, executors and ephemeral build environments · Triggering: push, merge request, tag, schedule, upstream · The test pyramid: unit, integration, contract, end-to-end · Parallel stages, matrix builds and fan-in · Caching dependencies and layers without poisoning the cache · Quality gates with SonarQube: coverage, duplication, new-code conditions · Pipeline secrets and credential scoping · Flaky tests, quarantine policy and build trust · Notifications, dashboards and who owns a red build

• Assignments: (1) Build a multi-stage pipeline with parallel test stages and a blocking quality gate; (2) Cut a slow pipeline's duration by half using caching and parallelism, with measurements
• Capstone: Deliver a CI pipeline that takes a commit to a published, scanned, versioned artifact with no manual step

Docker and the OCI ecosystem at the depth needed to run images in production, not just to start one. Namespaces, cgroups and layers; multi-stage builds and image size; the base image and non-root questions; registries, tagging discipline and immutability; and vulnerability scanning wired into the pipeline so a bad image never reaches a cluster.

Topics: Namespaces, cgroups, union filesystems and what a container actually is · Images, layers, caching and multi-stage builds · Base image selection: distroless, Alpine, UBI, and the trade-offs · Non-root containers, capabilities and read-only root filesystems · Dockerfile patterns and anti-patterns · Registries: layout, authentication, tagging and immutable tags · Why `latest` is a production incident waiting to happen · Image scanning with Trivy and equivalents, wired into CI · Image signing, attestation and provenance · Docker Compose for local parity · Podman, containerd and the runtime landscape

• Assignments: (1) Reduce an image from hundreds of megabytes to a minimal multi-stage build; (2) Fail a pipeline on a critical CVE, then remediate and pass it
• Capstone: Publish a signed, scanned, non-root, immutably tagged image from CI with a documented base image policy

Running those images at scale. Control plane and node components, the objects that matter day to day, and the operational surface: configuration and secrets, resource requests and limits, probes, rollout and rollback strategies, services and ingress, and persistent storage. Then packaging with Helm or Kustomize so environments differ by values rather than by copies.

Topics: Control plane and node components, and the reconciliation loop · Pods, ReplicaSets, Deployments, StatefulSets, DaemonSets, Jobs · Services, Ingress and the gateway landscape · ConfigMaps, Secrets and configuration injection · Requests, limits, QoS classes and eviction · Liveness, readiness and startup probes · Rolling updates, surge and rollback · Namespaces, RBAC and service accounts · Persistent volumes, claims and storage classes · Helm charts and Kustomize overlays for environment variation · Autoscaling: HPA, VPA and cluster autoscaling · Debugging a failing workload: events, logs, exec, describe

• Assignments: (1) Deploy a multi-service application with config, secrets, probes and limits; (2) Diagnose five deliberately broken workloads from cluster evidence alone
• Capstone: Package one application for three environments using a single chart and per-environment values only

The environment underneath the cluster, declared rather than clicked. Terraform's plan and apply lifecycle, remote state with locking, modules and workspaces, and the lifecycle rules that decide in-place update versus destroy-and-recreate. Then Ansible for the configuration layer that Terraform does not own, and Packer for baked images. Finally: drift, and what to do about it.

Topics: Declarative infrastructure and the plan/apply lifecycle · Terraform state, remote backends and state locking · Modules, variables, outputs and composition · Workspaces, environments and directory layouts compared · Lifecycle meta-arguments and in-place vs destroy-and-recreate · Importing existing infrastructure · Ansible for configuration: inventory, roles, idempotency · Packer for immutable machine images · Detecting and reconciling drift · Running IaC from CI: plan on PR, apply on merge · Policy as code with OPA and pre-apply checks · Secrets in IaC and the Vault integration path

• Assignments: (1) Refactor a monolithic Terraform configuration into versioned modules with remote state; (2) Introduce drift deliberately, detect it from CI, and reconcile it
• Capstone: Provision a complete environment — network, cluster, database, DNS — from code, with a plan gate in the pipeline

Getting the promoted artifact into an environment safely and repeatedly. Pipeline-push delivery compared with GitOps reconciliation using Argo CD or Flux; environment promotion and approvals; and the release strategies that separate deploy from release — blue-green, canary, rolling and feature flags — with the rollback plan that makes each of them defensible.

Topics: Continuous delivery vs continuous deployment · Push-based delivery from a pipeline · GitOps: reconciliation, desired state and drift correction · Argo CD and Flux: applications, sync policy, health and pruning · Environment promotion: branches, folders and image tag propagation · Approvals, change records and audit evidence · Blue-green, canary and rolling releases · Progressive delivery and automated rollback on metrics · Feature flags and decoupling deploy from release · Database migrations in a continuously delivered service · Rollback: what is actually reversible, and what is not

• Assignments: (1) Deliver the same artifact to three environments by GitOps with no pipeline write access to the cluster; (2) Run a canary release with an automated rollback triggered by an error-rate metric
• Capstone: Design and demonstrate a promotion path from merge to production with approvals, canary and a proven rollback

Closing the loop. Metrics with Prometheus and Grafana, logs with the Elastic Stack, traces with OpenTelemetry, and alerts tied to SLOs rather than to raw thresholds. Then the security work that belongs inside the pipeline — SAST, SCA, secret detection, image scanning, policy as code and secret management — and the operational practice that keeps the whole thing honest: on-call, incident review and cost.

Topics: Metrics: Prometheus, exporters, PromQL, RED and USE methods · Dashboards that answer questions, with Grafana · Centralised logging with the Elastic Stack, and structured logs · Distributed tracing with OpenTelemetry and Jaeger · SLIs, SLOs, error budgets and alerting on symptoms · Incident response, on-call rotation and blameless postmortems · Shift-left security: SAST, SCA, secret scanning, image scanning · Policy as code and admission control · Secret management with Vault and the paths out of CI variables · Supply chain: SBOM, signing and provenance verification · Cost visibility and the FinOps feedback loop · Platform thinking: golden paths and self-service

• Assignments: (1) Instrument a service with metrics, structured logs and traces, then diagnose a seeded incident from telemetry alone; (2) Add four security gates to an existing pipeline and demonstrate each one blocking a real defect
• Capstone: Deliver a complete pipeline for one application — commit to production, observable, gated and rollback-tested — and defend every tool choice