INTERLAB
How to build · 07

DevOps, Testing & Security

Linux, Docker, Nginx, deployment, CI/CD, monitoring, the testing pyramid, OWASP and secrets.

Read: 0 / 12LinuxDockerNginxHostingDeploymentCI/CDMonitoring & LoggingTestingE2E TestingApplication SecuritySecrets Management

Linux

  1. Tutorial✓

    Linux for developers: files, permissions, processes, SSH

    To work confidently on a Linux server, a developer needs five skills: logging in with an SSH key, working as a regular user with sudo, understanding file owners and permissions, finding processes and busy ports, and running the app as a systemd service with logs in journalctl. Below is the whole initial setup of an Ubuntu 24.04 LTS VPS with real command output and a final checklist.

    Beginner · 12 min read · practice ~45–90 min

Docker

  1. Tutorial✓

    Docker from scratch: image, container, Dockerfile

    A Docker image is an immutable template made of layers: the OS, the runtime, dependencies and the app code. A container is an isolated process started from an image, with its own writable layer. Images are described in a Dockerfile; for Node.js a good Dockerfile is multi-stage, with .dockerignore, a non-privileged user and HEALTHCHECK, and data lives in volumes, not inside the container.

    Beginner · 9 min read · practice ~45–90 min
  2. Tutorial✓

    Docker Compose: app and database locally with one command

    Docker Compose describes several containers in one compose.yaml file — services, ports, volumes, network and environment variables — and starts them with docker compose up. To keep the API from starting before the database, PostgreSQL and Redis get a healthcheck and the API gets depends_on with condition: service_healthy. Secrets come from .env, and data lives in named volumes that survive docker compose down unless you add -v.

    Intermediate · 7 min read · practice ~1.5–3 h

Nginx

  1. How-to✓

    Nginx as a reverse proxy: HTTPS, static files, headers

    A reverse proxy is a server that accepts client requests on behalf of an application: Nginx listens on ports 80 and 443, terminates HTTPS, serves static files itself and passes everything else to Node.js via proxy_pass, adding the Host and X-Forwarded-* headers. Below is a working config for Nginx 1.30 with an HTTPS redirect, static caching, gzip, a body size limit, timeouts and security headers, tested with nginx -t and curl in Docker.

    Intermediate · 9 min read · practice ~1–2 h

Hosting

  1. Fundamentals✓

    Domain, hosting, DNS and SSL: what they are and what must belong to you

    A domain is the site’s name, DNS is the address book linking that name to a server, hosting is where the site physically runs, and an SSL certificate turns on HTTPS and encrypts the connection. A domain isn’t bought forever — it is registered for a term and renewed. That’s why the domain, DNS, hosting and every related account must be registered to your company with your email — otherwise the site depends on the contractor and on someone paying the renewal on time.

    Beginner · 6 min read

Deployment

  1. Comparison✓

    Deployment: VPS, PaaS or containers, and zero-downtime releases

    A VPS gives you full control of the server, but updates, HTTPS, monitoring and zero-downtime releases are on you; a PaaS such as Vercel, Render or Fly.io takes that over in exchange for the platform’s constraints; Kubernetes pays off when there are many services and instances to orchestrate automatically. Zero-downtime releases work the same way in every model: the new version starts next to the old one, passes a health check, receives traffic, and the old one gracefully finishes its in-flight requests. Database migrations are kept backward compatible so that rolling back the code stays possible.

    Intermediate · 10 min read

CI/CD

  1. Tutorial✓

    CI/CD with GitHub Actions: checks on every pull request

    CI on GitHub Actions is a YAML file in .github/workflows/ that, on every pull request, installs dependencies with npm ci and runs the linter, type checking, tests and the build on a clean GitHub machine. To keep broken code out of main, you make the final check required in branch protection, and move publishing and deployment into a separate tag-triggered workflow — with a least-privilege token, actions pinned to a SHA and secrets stored in the production environment.

    Intermediate · 14 min read · practice ~1.5–3 h

Monitoring & Logging

  1. Fundamentals✓

    Monitoring and logging: what to collect and how to react

    A service needs three kinds of telemetry: structured logs to investigate a specific request, metrics to see trends and drive alerts, and traces to follow a request across several services. The minimal metric set is the four golden signals from the Google SRE book: latency, traffic, errors and saturation. An alert should fire on a symptom users can see, with a threshold and a hold duration, not on anything that merely looks odd.

    Intermediate · 14 min read

Testing

  1. Fundamentals✓

    The testing pyramid: unit, integration, e2e

    The testing pyramid is a rule for distributing automated tests: many fast unit tests at the bottom, fewer integration tests in the middle and only a handful of end-to-end tests at the top. The higher the level, the closer a test is to a real user, but the slower, costlier and more prone to failing for no reason it becomes. E2E tests are needed to confirm the key journeys work as a whole, but anything that can be checked a level lower is checked lower.

    Intermediate · 13 min read

E2E Testing

  1. Tutorial✓

    E2E tests with Playwright

    An e2e (end-to-end) test launches a real browser, opens the running application and walks through a scenario the way a person would: fills in a form, clicks a button and checks the result on screen. In Playwright Test such a test relies on role- and label-based locators, auto-waiting before actions and web-first assertions that retry until the condition holds. Failures are investigated with a trace — a recording of every step with the DOM, network and console.

    Intermediate · 13 min read · practice ~1.5–3 h

Application Security

  1. Fundamentals✓

    OWASP Top 10 for developers

    The OWASP Top 10 is OWASP's document on the ten most critical risk categories for web applications; the current published edition is from 2025. Broken access control is still number one, security misconfiguration has climbed to second, and new categories cover the software supply chain and the handling of exceptional conditions. Each category is a group of weaknesses (CWEs) closed by concrete techniques in code: server-side record ownership checks, parameterized queries, output encoding, slow password hashing and failing closed.

    Intermediate · 13 min read

Secrets Management

  1. How-to✓

    Secrets and environment variables: how not to leak your keys

    Secrets — passwords, API keys, tokens and connection strings — do not belong in code: the app reads them from environment variables, locally from a .env file covered by .gitignore, while the repository holds only an .env.example template. In CI and on hosting, values live in their secret stores, and nothing reaches the browser bundle except variables with a public prefix such as NEXT_PUBLIC_. If a key does leak, you first revoke and reissue it, and only then decide whether the Git history needs rewriting.

    Intermediate · 11 min read · practice ~30–60 min

Learning paths with this direction

Docker and deployment · 8 →← All directions
Tell us about your task — we'll review your request and get back to you

Got a project?
We'll scope and estimate it — for free.

Tell us about the product or the problem. After reviewing the task we'll come back with an architecture, a timeline and a price for the first version.

  • Scope and risks estimated before we start
  • NDA — yours or ours
  • Work starts within a week
Message on WhatsApp

Please do not send passwords, access keys or source code through this form — we will agree a safe way to share access separately.

By clicking the button you agree to the processing of your personal data.