Containers, orchestration & IaC
Write or fix Dockerfiles, Compose/Kubernetes manifests and Terraform to a working deployment.
20 project-authored proposals · taxonomy v1.1 · 0 new benchmark runs. Verifiers and partial-credit rules below are designs, not executed results.
- Typical applications
- Docker · kubectl · Terraform
- Class GUI-need label
CL· CLI-sufficient
Task proposals · 20
Expand to inspect the complete original wording and proposed checks. Original proposal text remains English in both interfaces.
R03.04.01.01-T01 Write a small, non-root multi-stage Dockerfile for a Node app
Original instruction
Containerize app/ (Node 20 + TypeScript API) with a multi-stage Dockerfile: build stage compiles, runtime stage contains only production dependencies and dist/, runs as a non-root user, exposes 8080 and defines a HEALTHCHECK on /healthz. Final image must be under 150 MB.
- Platforms
lin· Linuxmac· macOSwin· Windows- Applications
- Docker
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Grader builds the image: size <150 MB; docker inspect User non-root; HEALTHCHECK present and container becomes healthy; GET /api/items returns 200 with expected JSON; no devDependencies in the image (npm ls --prod check).
Proposed partial credit
25% builds and serves; 25% size; 20% non-root; 30% healthcheck and no dev deps
R03.04.01.01-T02 Compose a four-service stack with health-gated startup
Original instruction
Write compose.yaml for the app in stack/: web (build from ./web), api (build ./api), Postgres 16 with a named volume and init SQL, and Redis. api starts only after Postgres and Redis are healthy; web only after api is healthy; secrets come from .env.
- Platforms
lin· Linuxmac· macOSwin· Windows- Applications
- Docker Compose
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Grader runs docker compose up -d --wait: all 4 healthy; GET web /status shows db and cache OK; restart of postgres preserves data (volume); depends_on uses condition service_healthy (YAML check); no secrets inline.
Proposed partial credit
40% stack healthy and working; 25% health-gated ordering; 20% persistence; 15% secrets from env
R03.04.01.01-T03 Deploy an app to Kubernetes from a written spec
Original instruction
Write manifests in k8s/ for the 'orders' service per spec/orders.md: Deployment (3 replicas, resources, probes), Service, Ingress at orders.local, ConfigMap for settings and a Secret for DB credentials. Apply to the provided kind cluster so the service is reachable through the ingress.
- Platforms
lin· Linuxmac· macOS- Applications
- kubectl · kind
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader: kubectl get shows 3 ready pods; curl via ingress returns 200 with config value from the ConfigMap; env var from Secret (not literal); resources and probe settings match spec (kubeconform + YAML assertions).
Proposed partial credit
40% workload ready and reachable; 20% config/secret wiring; 25% spec fields; 15% schema valid
R03.04.01.01-T04 Fix a CrashLoopBackOff caused by a bad secret reference
Original instruction
In the kind cluster, deployment 'billing' in namespace payments is in CrashLoopBackOff. Diagnose it with kubectl, fix the manifests in k8s/billing/ (not by editing live objects only), and re-apply so all pods run.
- Platforms
lin· Linuxmac· macOS- Applications
- kubectl · kind
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 2 / 5
Proposed verifier
Seeded cause: secretKeyRef key name mismatch plus a missing ConfigMap key. Grader: pods Running and Ready for 5 min with 0 restarts after fix; manifests in repo contain the fix (re-apply on a fresh cluster works).
Proposed partial credit
40% root cause fixed in manifests; 40% pods healthy; 20% reproducible on fresh cluster
R03.04.01.01-T05 Author a Helm chart with a values schema and tests
Original instruction
Package the 'notify' service as a Helm chart in charts/notify/: templated Deployment, Service, optional Ingress and HPA toggled by values, values.schema.json validation, NOTES.txt, and a helm test pod that calls /healthz.
- Platforms
lin· Linuxmac· macOS- Applications
- Helm · kubectl
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader: helm lint clean; helm template with 4 value sets matches expected objects; invalid values rejected by schema; helm install on kind succeeds and helm test passes.
Proposed partial credit
30% templates per value sets; 25% schema rejects invalid; 25% install + test; 20% lint/NOTES
R03.04.01.01-T06 Provision a VPC and load balancer with Terraform on LocalStack
Original instruction
Write Terraform in infra/ that creates on LocalStack: a VPC with 2 public and 2 private subnets across 2 AZs, NAT gateway, an ALB in the public subnets with an HTTPS listener (self-signed cert from certs/), and a target group. It must pass terraform validate, plan cleanly and satisfy policies/*.rego.
- Platforms
lin· Linuxmac· macOS- Applications
- Terraform · LocalStack · OPA
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Grader: terraform apply against LocalStack succeeds; describe calls show subnets/AZs/routes as specified; conftest on the plan JSON passes all policies (no 0.0.0.0/0 on private SGs, tags required); second plan shows no changes.
Proposed partial credit
35% resources correct; 30% policies pass; 20% idempotent re-plan; 15% validate/fmt
R03.04.01.01-T07 Refactor Terraform into modules without destroying anything
Original instruction
infra/legacy/ manages 34 resources (LocalStack) in one flat main.tf. Refactor into modules network/, compute/ and storage/ using moved blocks so that terraform plan after the refactor shows zero destroys and zero creates.
- Platforms
lin· Linuxmac· macOS- Applications
- Terraform · LocalStack
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
risk· Irreversible/risky- Proposed difficulty
- 4 / 5
Proposed verifier
Grader runs plan on the refactored code against the existing state: 0 to add, 0 to destroy (moves only); module structure present; resource IDs in LocalStack unchanged after apply.
Proposed partial credit
50% plan has no add/destroy; 30% module structure; 20% resource IDs unchanged
R03.04.01.01-T08 Build Kustomize overlays for three environments
Original instruction
Create a Kustomize base and overlays dev, staging and prod for the app in k8s/app/ per spec/envs.md: replica counts, image tags, resource limits, an extra sidecar only in prod, environment-specific ConfigMap generators, and a namespace per overlay.
- Platforms
lin· Linuxmac· macOS- Applications
- Kustomize · kubectl
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader runs kustomize build for each overlay and compares normalized output to expected manifests; prod includes the sidecar, others do not; generated ConfigMap name hashes referenced correctly.
Proposed partial credit
60% three overlays match (20 pts each); 20% sidecar patch; 20% config generators
R03.04.01.01-T09 Migrate a docker-compose app to Kubernetes with Helm and Terraform
Original instruction
Migrate the 6-service compose app in legacy/ to Kubernetes: Terraform creates the kind cluster, namespaces and an S3 bucket (LocalStack); Helm charts deploy the services with probes, resources and secrets. All images must have no CRITICAL vulnerabilities in Trivy scans.
- Platforms
lin· Linux- Applications
- Terraform · Helm · kubectl · Trivy
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
Grader runs terraform apply and helm install from scratch: all services ready; end-to-end smoke test (scripts/smoke.sh) passes; trivy image reports 0 CRITICAL for every image; no plaintext secrets in charts.
Proposed partial credit
20% Terraform infra; 35% services deployed and healthy; 25% smoke test; 20% Trivy clean
R03.04.01.01-T10 Autoscale a deployment under load with an HPA
Original instruction
Configure resource requests and an HPA (CPU 60%, 2–10 replicas, scale-down stabilization 120 s) for deployment 'search' in the kind cluster with metrics-server, so that under the provided load test p95 latency stays below 300 ms.
- Platforms
lin· Linuxmac· macOS- Applications
- kubectl · kind
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Grader runs the 10-minute load profile: replicas scale up to ≥5 then back down after load stops (after ≥120 s); p95 latency <300 ms during the load; HPA spec matches.
Proposed partial credit
30% HPA spec; 35% scaling behavior; 35% latency target
R03.04.01.01-T11 Restrict pod traffic with NetworkPolicies
Original instruction
In namespace shop on the kind cluster (Calico), write NetworkPolicies so only: frontend → api on 8080, api → db on 5432, api → redis on 6379, all pods → kube-dns, and ingress-nginx → frontend. Everything else must be denied.
- Platforms
lin· Linuxmac· macOS- Applications
- kubectl · Calico
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader runs a connectivity matrix (20 source/destination/port probes): allowed paths succeed, all others time out; DNS resolution works; default-deny policy present.
Proposed partial credit
70% connectivity matrix correct; 15% DNS works; 15% default deny
R03.04.01.01-T12 Configure three hosts with an idempotent Ansible playbook
Original instruction
Write an Ansible playbook and roles in ansible/ that configure the three provided VMs: nginx reverse proxy with TLS (certs in files/), a systemd service for the app binary, ufw allowing only 22/443, and logrotate. A second run must report zero changes.
- Platforms
lin· Linux- Applications
- Ansible
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader runs the playbook twice: second run changed=0; on each host curl https://host/health returns 200 via nginx; ufw status shows only 22/443; service enabled; ansible-lint clean.
Proposed partial credit
40% hosts configured correctly; 25% idempotent; 20% firewall; 15% lint
R03.04.01.01-T13 Deploy a serverless API with Pulumi on LocalStack
Original instruction
Using Pulumi (Python), deploy to LocalStack an S3 bucket, a Lambda (Python 3.12) that writes uploaded JSON to DynamoDB, an S3 event trigger, and an API Gateway GET /items/{id} reading from DynamoDB.
- Platforms
lin· Linuxmac· macOS- Applications
- Pulumi · LocalStack
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader runs pulumi up: uploading a JSON object results in a DynamoDB item; GET via API Gateway returns it; pulumi preview afterwards shows no changes; IAM policy scoped to the specific table ARN.
Proposed partial credit
30% resources; 35% end-to-end flow; 20% least-privilege IAM; 15% idempotent
R03.04.01.01-T14 Achieve zero-downtime rolling updates
Original instruction
Deployment 'checkout' drops requests during rollouts. Add readiness and startup probes, a preStop hook with graceful shutdown, maxUnavailable 0/maxSurge 25%, and a PodDisruptionBudget so that a rollout and a node drain under constant traffic cause zero failed requests.
- Platforms
lin· Linuxmac· macOS- Applications
- kubectl · kind
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Grader generates 200 rps while performing a rollout to a new image tag and then draining a node: failed requests must be 0; PDB minAvailable honored; probe settings present.
Proposed partial credit
45% zero errors during rollout; 35% zero errors during drain; 20% manifests per spec
R03.04.01.01-T15 Harden and sign a container image
Original instruction
Rebuild the 'api' image on a distroless base, generate an SPDX SBOM with syft, sign the image and attach the SBOM attestation with cosign (key pair in keys/), push to the local registry at localhost:5000, and add a Kyverno policy that only admits images signed with that key.
- Platforms
lin· Linuxmac· macOS- Applications
- Docker · cosign · syft · Kyverno
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader: cosign verify and verify-attestation succeed; SBOM lists the app's dependencies; image has no shell (exec sh fails); Kyverno admits the signed image and rejects an unsigned one in the cluster.
Proposed partial credit
25% distroless image works; 25% signature; 20% SBOM attestation; 30% admission policy
R03.04.01.01-T16 Run Postgres as a StatefulSet with tested backups
Original instruction
Deploy Postgres 16 as a StatefulSet with a PVC per pod, a headless Service, and a CronJob that runs pg_dump nightly to a backup PVC keeping 7 copies. Prove restore works by restoring the latest backup into a fresh namespace.
- Platforms
lin· Linuxmac· macOS- Applications
- kubectl · kind · PostgreSQL
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Grader writes data, triggers the CronJob manually, deletes the StatefulSet pods (data persists), then runs the agent's restore script into a new namespace: data equal. Retention: after 9 triggered runs only 7 dumps remain.
Proposed partial credit
25% StatefulSet with persistence; 25% backup job; 30% restore verified; 20% retention
R03.04.01.01-T17 Set up a GitOps deployment with Argo CD sync waves
Original instruction
Install the provided Argo CD manifests in the kind cluster and create an Application pointing to the local Gitea repo 'platform' path apps/shop, with automated sync, self-heal, prune, and sync waves so the database migrations Job runs before the API Deployment.
- Platforms
lin· Linuxmac· macOS- Applications
- Argo CD · kubectl · Gitea
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Grader: Application Synced/Healthy; Job completes before Deployment pods start (event timestamps); manual kubectl edit is reverted by self-heal within 3 min; deleting a manifest in git prunes the object.
Proposed partial credit
30% app synced/healthy; 30% wave ordering; 20% self-heal; 20% prune
R03.04.01.01-T18 Import existing cloud resources into Terraform with zero diff
Original instruction
Twelve resources (S3 buckets, IAM roles, an SQS queue, a DynamoDB table) were created by hand in LocalStack. Write Terraform code and import blocks so terraform plan shows no changes after import, without recreating anything.
- Platforms
lin· Linuxmac· macOS- Applications
- Terraform · LocalStack
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP06· Code/engineering- Conditions
- None declared
- Proposed difficulty
- 4 / 5
Proposed verifier
Grader: terraform plan after import → 'No changes'; state lists all 12 resources; resource ARNs/creation times unchanged; no lifecycle ignore_changes on core attributes (static check).
Proposed partial credit
40% all 12 imported; 40% zero-diff plan; 20% no ignore_changes shortcuts
R03.04.01.01-T19 Enforce CIS pod-security controls with admission policies
Original instruction
Write Kyverno policies enforcing: no privileged containers, runAsNonRoot, read-only root filesystem, dropped ALL capabilities, and required resource limits, in Enforce mode for namespaces labeled env=prod, with an exception for the 'monitoring' namespace's node-exporter.
- Platforms
lin· Linuxmac· macOS- Applications
- Kyverno · kubectl
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
- None declared
- Proposed difficulty
- 3 / 5
Proposed verifier
Grader applies 12 test manifests: violating ones rejected in prod namespaces, accepted elsewhere; node-exporter accepted via the exception only; Kyverno policy reports show expected results.
Proposed partial credit
60% admission matrix correct; 20% exception scoped; 20% policy reports
R03.04.01.01-T20 Deploy one app across two clusters with automatic failover
Original instruction
Deploy the 'catalog' service to two kind clusters (east, west) with identical Helm releases, and configure the provided global proxy (Envoy) so traffic prefers east and fails over to west within 10 s when east's deployment is scaled to zero, and back when it recovers.
- Platforms
lin· Linux- Applications
- kubectl · Helm · kind · Envoy
- Interfaces
term· Terminal- GUI need · task setting
CL· CLI-sufficient- GUI need · ordinary access
CL· CLI-sufficient- Interaction primitives
code· Code & commands- Work product
WP08· App/system state- Conditions
long· Long-horizon- Proposed difficulty
- 5 / 5
Proposed verifier
Grader runs constant traffic, scales east to 0, then restores it: error rate ≤1% overall, failover ≤10 s and failback ≤30 s measured from response headers; both releases healthy.
Proposed partial credit
30% both clusters deployed; 40% failover behavior; 20% failback; 10% error budget
Mapped research references
Existing benchmark-to-class links from the research catalog. They are not record-level annotations, executions or product endorsements.