Private corporate batches, live online cohorts and 1-on-1 mentoring in a policy-enforcing OCI registry — projects, RBAC, scanning, signing, retention and replication — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Harbor as a control point rather than a storage service — project structure and the role model, robot accounts scoped for CI, and the policies that actually enforce something: Trivy severity gates that block a pull, signature verification with Cosign, immutability rules and tag retention, and per-project quotas. Sessions cover the architecture underneath, core, jobservice, registry, PostgreSQL and Redis, so failures are diagnosable, and work through the replication and proxy-cache topologies used for air-gapped and multi-region distribution, plus the storage, backup and upgrade work that keeps a registry running.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Harbor that means a trainer who has run it in production — a policy-enforcing OCI registry — projects, RBAC, scanning, signing, retention and replication — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Harbor batchHarbor is an open-source registry for OCI artifacts — container images, Helm charts published as OCI, and any other conformant artifact type — that wraps the plain distribution registry in the governance layer an organisation actually needs. A bare registry stores and serves blobs. Harbor adds identity, per-project permissions, vulnerability scanning, signature verification, retention and replication on top of that storage, and enforces them at the point of push and pull rather than in a pipeline that can be skipped.
The unit of organisation is the project. A project is public or private, carries members with roles from limited guest through developer and maintainer to project administrator, and holds its own policy: a vulnerability severity threshold that blocks pulls of affected artifacts, a requirement that artifacts be signed before deployment, immutability rules that prevent a tag being overwritten once published, tag retention rules that keep a defined number of recent artifacts per repository, and a storage quota. Robot accounts give CI systems scoped, revocable credentials that are not tied to a person.
Architecturally Harbor is several services: a core API, a jobservice for asynchronous work such as scanning and replication, the upstream distribution registry with its controller, PostgreSQL for metadata, Redis for caching and job state, and a pluggable scanner, usually Trivy. Replication rules move artifacts to and from other registries — Harbor, Docker Hub, ECR, ACR, GCR, Quay, Artifactory — on a push or pull trigger, which is what makes air-gapped mirroring and geo-distribution practical. Proxy cache projects act as a pull-through cache for an upstream registry, which is also the usual answer to rate limits.
Software supply chain attacks moved registry governance from a nice-to-have to an audit requirement. The questions being asked now — which images are running, where did they come from, who signed them, what vulnerabilities do they carry, and can an unsigned artifact reach production — are all registry questions, and a bare distribution registry cannot answer any of them.
There is a simpler operational driver too. Pulling directly from public registries at scale is fragile: rate limits, upstream deletions and network egress all fail at inconvenient moments, and regulated or air-gapped environments cannot do it at all. A private registry with proxy caching and replication rules turns that into a solved problem, and Harbor is the most widely deployed open-source option for it.
What teams actually need to learn is the policy design rather than the installation. Which severity gate is enforceable without stopping every deployment, how retention interacts with immutability, how to structure projects so permissions map to teams, how robot accounts are scoped and rotated, and how replication behaves in an air-gapped topology. Those decisions determine whether the registry is a control or an obstacle.
The gap between a distribution registry and a controlled one. What supply chain requirements actually ask for, what a bare registry cannot answer, and where Harbor sits against Artifactory, Nexus and the cloud-managed registries.
Topics: OCI distribution versus a governed registry · Supply chain requirements in plain terms · Harbor against Artifactory, Nexus, ECR, ACR and GCR · Public registry rate limits and egress risk · Air-gapped and regulated constraints · Where Harbor is the wrong answer
The moving parts and how to install them properly. Core, jobservice, registry and registryctl, PostgreSQL, Redis and the scanner — then the online and offline installers, the Helm chart on Kubernetes, TLS, and what a highly available deployment requires.
Topics: Component map: core, jobservice, registry, portal · PostgreSQL and Redis dependencies · Online and offline installers and harbor.yml · Deploying with the Helm chart on Kubernetes · TLS certificates and ingress · External PostgreSQL and Redis for HA · Sizing and resource planning · Reading logs across components
Making one registry safe for many teams. Projects as the permission boundary, the role model and what each role can actually do, authentication against LDAP, Active Directory or OIDC, and robot accounts for machines.
Topics: Projects: public, private and their defaults · Roles: limited guest, guest, developer, maintainer, project admin · System administrators and the audit log · Database, LDAP/AD and OIDC authentication · Group-to-role mapping · Robot accounts: system and project scope · Robot permissions, expiry and rotation · CLI secrets and OIDC users
Beyond container images. The OCI artifact model, tags versus digests, multi-architecture indexes, Helm charts as OCI artifacts, artifact references and accessories, plus labels and the API for automation.
Topics: OCI image manifest, index and layers · Tags, digests and why digests matter · Multi-architecture images · Helm charts as OCI artifacts · Artifact references, accessories and SBOM attachments · Labels and metadata · The Harbor API and CLI-driven workflows · Webhooks into CI/CD
Turning scan results into enforcement. Trivy as the default scanner, on-push and scheduled scans, the CVE allowlist, and the project-level threshold that actually prevents a vulnerable artifact being pulled.
Topics: Scanner integration and Trivy configuration · Scan on push and scheduled scan-all · Reading a scan report: severity, fixable, layer attribution · Severity threshold that blocks pulls · CVE allowlists, system and project scope · Offline and air-gapped vulnerability database updates · Scanning cadence and database freshness · Handling unfixable and disputed CVEs
The policies that make a registry trustworthy and affordable. Cosign signing and verification, immutability rules that prevent tag reuse, retention rules that bound storage, and per-project quotas — plus how these three interact.
Topics: Signing with Cosign and verifying at deploy time · Deployment security policy and unsigned artifact blocking · Notation and the signature landscape · Immutability rules and tag reuse · Tag retention rules: count, age and repository scope · Retention dry runs before enforcement · Project quotas and storage accounting · How retention, immutability and quota interact
Moving artifacts between registries and environments. Replication endpoints and rules with filters and triggers, push versus pull direction, air-gapped mirroring, proxy cache projects for upstream registries, and P2P preheat for large-scale pulls.
Topics: Replication endpoints: Harbor, Docker Hub, ECR, ACR, GCR, Quay, Artifactory · Rule filters, triggers and modes · Push-based versus pull-based replication · Air-gapped mirroring workflows · Migrating from another registry · Proxy cache projects and rate-limit avoidance · Cache behaviour, expiry and quota interaction · P2P preheat with Dragonfly or Kraken
Keeping the registry alive. Storage backend choices and their trade-offs, garbage collection and why deleted tags do not free space on their own, backup and restore of database and blobs, upgrades, monitoring and the failures that actually happen.
Topics: Storage backends: filesystem, S3, Azure, GCS, Swift · Why deletion does not reclaim storage · Garbage collection, read-only mode and scheduling · Backing up PostgreSQL, Redis and blob storage · Restore and disaster recovery testing · Upgrade procedure and database migration · Metrics, Prometheus exporter and alerting · Common failures: full disk, jobservice backlog, scanner failure
We rebuild the agenda around the tools you actually run.
Request a custom agendaDeploy Harbor with the offline installer and again with the Helm chart on Kubernetes, then trace a push through every component in both.
Wire OIDC group mapping, then issue scoped robot accounts for push and pull and prove each cannot exceed its project.
Scan a deliberately outdated image, set a severity threshold, prove the pull is refused, then allowlist one unfixable CVE with justification.
Sign artifacts with Cosign, enable the deployment security policy, and demonstrate an unsigned image being refused at pull time.
Build filtered replication between two Harbor instances, then move a curated artifact set into an isolated environment and verify integrity.
Fill a registry, apply retention, run garbage collection and measure reclaimed space, then restore the whole instance from backup and upgrade it.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
The Rundeck developer session was excellent and highly engaging. I appreciated how well the session was structured, with the theoretical concepts explained clearly and in simple terms. What stood out most to me was the demo — it was both informative and enjoyable. I especially liked how Rajesh walked us through not only the happy path but also the sad path, showcasing common issues and sharing practical troubleshooting tips.
Rajesh's experience and knowledge are exceptional and we learnt invaluable practical knowledge which we can apply in our production environment. Incredibly friendly and gave us a fantastic insight both in-depth and at a high level of the Rundeck product.
Great learning experience from a very knowledgeable instructor with well-prepared course notes. The lab exercises on AWS instance work well to learn the hands-on side of the course.
Rajesh is a very good trainer I have experienced in DevSecOps training. The number of contents in different topics he has posted on the DevOpsSchool public website are amazing and user friendly for beginners and experienced professionals.
The trainer (Rajesh) provided very good sessions on SRE profession. Not only hands-on learning on the tools but also SRE mindset.
Very good training session. Well explained from the basics to the complex concepts. Also tried to cover practicals and demos within the 3 hour sessions. The learning content and videos are of a great deal of help.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.