Tutorials

Step-by-step engineering guides

Practical tutorials written by engineers who've done it in production. Follow along, run the commands, and end up with something real.

/

Learning Paths

Beginner

Linux Foundations

Go from zero to confident on the command line — the prerequisite for every other platform engineering skill.

1Linux Commands for Beginners: Your First 30 Commands
2Linux Commands for Intermediate Users: Processes, Pipes & Networking
3Linux Commands for Advanced Engineers: Debugging, systemd & Kernel Internals

Start path

Beginner

Container Foundations

Build, optimise, and orchestrate containers locally — images, multi-stage builds, and Docker Compose multi-service stacks.

1Docker Fundamentals: Images, Containers, Volumes & Networking
2Docker Multi-Stage Builds & Image Optimisation
3Docker Compose for Local Development: Multi-Container Environments

Start path

Intermediate

Kubernetes Foundations

Run containers at scale — the cluster model, workloads, networking, configuration, storage, and security.

1Kubernetes Core Concepts: Pods, Deployments & Services
2Kubernetes Networking & Ingress
3Kubernetes Storage, ConfigMaps & Secrets
4Kubernetes RBAC & Security

Start path

Intermediate

Helm: Kubernetes Package Management

Package, version, and deploy Kubernetes applications with Helm charts and Helmfile.

1Helm Fundamentals: Kubernetes Package Manager
2Helmfile: Managing Multiple Helm Releases

Start path

Intermediate

Ansible Automation

Automate server configuration and application deployment with Ansible playbooks, Jinja2 templates, and roles.

1Ansible Fundamentals: Automating Server Configuration
2Ansible Jinja2 Templates and Roles

Start path

Intermediate

CI/CD Pipelines

Automate build, test, and deploy — conventional commits drive versioning, GitHub Actions handles cloud-native CI/CD, and Jenkins covers self-hosted pipeline needs.

1Semantic Versioning, Conventional Commits, and Release Please
2GitHub Actions: CI/CD for Containers and Kubernetes
3Jenkins Declarative Pipelines: CI/CD with Docker Agents

Start path

Intermediate

GitOps with ArgoCD

Adopt GitOps from first install to production-grade patterns — automated sync, multi-environment promotion, and the App of Apps model.

1Install Argo CD and Deploy Your First Application
2Getting Started with ArgoCD: GitOps in 30 Minutes
3Setting Up ArgoCD with Automated Sync and Rollback
4ArgoCD App-of-Apps: Managing Multi-Environment Clusters

Start path

Advanced

Kubernetes Security

Harden a cluster end-to-end — encrypt secrets at rest, enforce Pod Security Standards, lock down network traffic, and automate policy with Kyverno.

1Encrypting Kubernetes Secrets at Rest
2Pod Security Admission: Replace PodSecurityPolicy the Right Way
3Configuring NetworkPolicies to Isolate Namespaces
4Enforcing Policy with Kyverno: Validate, Mutate, Generate

Start path

Intermediate

Observability Stack

Build full-stack observability — metrics and dashboards with Prometheus and Grafana, distributed tracing with OpenTelemetry, and SLO-based alerting.

1Install Prometheus and Grafana on Kubernetes with kube-prometheus-stack
2Monitoring Kubernetes with Prometheus and Grafana
3Distributed Request Tracing with OpenTelemetry
4Defining SLOs and Writing Burn Rate Alerts in Prometheus

Start path

Advanced

Secrets Management

Keep secrets out of Git — run Vault in Kubernetes, use it for dynamic credentials and pod authentication, then sync external secrets with External Secrets Operator.

1Install HashiCorp Vault on Kubernetes and Inject Secrets into Pods
2HashiCorp Vault: Kubernetes Auth and Dynamic Secrets
3Install External Secrets Operator and Sync AWS Secrets Manager into Kubernetes

Start path

Showing 1–12 of 84 tutorials

Beginner30 min9 min read

Run an LLM Locally with Ollama: From Install to Your Own API

Install Ollama, pull a model, and have a private LLM answering questions on your own machine in about ten minutes — no API key, no per-token bill, no data leaving your laptop. Then point real code at it through the OpenAI-compatible endpoint it exposes on localhost.

Intermediate45 min11 min read

Self-Host Ollama: A Private LLM Server You Can Reach From Anywhere

Move Ollama off your laptop and onto a real server, then reach it from your phone or work machine over a private network — without exposing an unauthenticated LLM API to the internet. Covers systemd tuning, GPU drivers, model preloading, and the one networking mistake that gets people's servers mined for crypto.

Intermediate40 min11 min read

Install the AWS Load Balancer Controller on EKS (v3)

EKS ships without an ingress controller — until you install the AWS Load Balancer Controller, your Ingress manifests do nothing. Set up controller v3 with IRSA, expose a real app through an ALB, provision an NLB the modern way, and learn the teardown order that stops orphaned load balancers from billing you forever.

Beginner25 min9 min read

Run Linux Containers on Your Mac With Apple's container Tool

Apple ships an official, open-source way to run Linux containers on your Mac — no Docker Desktop, no license conversation, and every container gets its own IP address. Install it, run your first container, build an image from a Dockerfile you already have, and learn the day-to-day commands.

Intermediate40 min11 min read

Run a Multi-Service Dev Stack With Apple's container — No Docker Compose Needed

Apple's container tool has no compose command — the most common reason people bounce off it. This tutorial rebuilds a classic docker-compose dev stack (Postgres, Redis, and an app) using per-container IPs, built-in DNS service discovery, named volumes, and a small Makefile that gives you compose-style up/down/logs back.

Beginner30 min9 min read

Set Up Tailscale: Connect All Your Devices Into One Private Network

Tailscale makes every device you own act like it's plugged into the same home network — laptop, phone, cloud server, Raspberry Pi — no port forwarding, no firewall wrestling, no VPN server to babysit. Install it on two devices, get private IPs and magic hostnames, then lock SSH to your private network and route your phone's traffic through your own server.

Intermediate45 min12 min read

Self-Host a WireGuard VPN Server on Ubuntu or Debian

Run your own VPN with nothing but a $5 VPS and about 100 lines of config. WireGuard is the rare piece of security software that's both stronger and simpler than what it replaced — this tutorial builds a full server from scratch: keys, configs, NAT, a laptop client, and a phone connected by QR code, with every line explained in plain language.

Beginner35 min9 min read

Set Up a Firewall with UFW on Ubuntu and Debian

Lock down a Linux server with UFW in about half an hour. Set sane default policies, open only the ports you need, restrict access by source IP, and rate-limit SSH — without accidentally locking yourself out of the box.

Intermediate40 min10 min read

Harden SSH Access on Ubuntu and Debian: Keys, sshd_config, and fail2ban

SSH is the one door you leave open on a server — so make it a good one. Switch to key-only authentication, disable root and password logins, lock down sshd with a drop-in config, and add fail2ban to jail brute-force bots, all without locking yourself out.

Advanced50 min12 min read

fail2ban for Web Services: Protect Nginx from Brute Force and Bad Bots

Take fail2ban past the sshd jail. Learn how jails, filters, and actions actually fit together, enable the built-in Nginx protections, write and test a custom filter with fail2ban-regex, and fix the reverse-proxy trap that silently bans everyone or no one.

Advanced90 min13 min read

Deploy Rook-Ceph on Kubernetes: Block and Object Storage from Scratch

Turn a handful of raw disks into a self-healing storage cluster. Install the Rook operator with Helm, stand up a CephCluster, verify OSDs with the toolbox, then serve both RBD block volumes and S3-compatible object storage — every command runnable, step by step.

Intermediate45 min12 min read

Migrate a Terraform Project to OpenTofu (Safely, with State and CI)

OpenTofu forked from Terraform 1.5.x and is state-compatible, so migrating is mostly a binary swap — but 'mostly' is where projects get burned. This tutorial walks the safe path: back up state, install tofu, gate on a no-change plan, fix provider registry and lock-file differences, and cut CI over deliberately.

OpenTofu

Terraform

Infrastructure as Code

Start tutorial

Need help applying this to your stack?

Our engineers have implemented these patterns across hundreds of production environments. Book a free call.

Book Free Consultation