Cost, requirements and the real safety boundary

The lab is free and open source under the MIT licence. Running it locally has no lab fee. GitHub Free personal accounts currently include 120 Codespaces core-hours and 15 GB-month of storage, which is about 60 hours on the requested 2-core machine. Stop the Codespace when you pause and delete it when you are finished so retained storage does not keep accumulating.

You need Git, Docker Engine or Docker Desktop, Docker Compose 2.20 or later, and about 3 GB of free disk space. macOS and Linux use the Bash wrapper. Windows can use the matching PowerShell wrapper. A GitHub account is enough for the Codespaces route.

The teaching host runs real systemd, which needs privileged operation and the host cgroup namespace in this Docker design. A privileged container is not a security boundary and can potentially affect its Docker host. Inspect the Compose file and do not run an untrusted fork.

It does not mount the Docker socket, your home directory, SSH keys or host filesystem. It bind-mounts only the repository's public runtime, drills and checks directories as read-only, and the learner-image build context allow-lists only the docker directory. Its web service binds only to 127.0.0.1:8100, and its wrappers act on the labelled lsr Compose project. Docker Desktop adds a VM boundary, while native Linux Docker runs the privileged container against the host kernel.

No. Incident 02 fills a size-limited 16 MiB tmpfs inside the lab container. It does not mount or write filler data to the host filesystem, and the tmpfs disappears with the container.

Yes, after the selected learner image and pinned companion image have been built or pulled. The incidents, hints, verification and reset loop do not depend on a live service on the internet.

Yes. Down keeps the small incident-state volume for the selected distribution, and up restores that active fault when the same distribution starts again. Each distribution has separate state. Reset removes the saved state and rebuilds a healthy lab.

Incident 05 runs one deliberately busy worker inside the learner container under a 20% CPU quota, a 32 MiB memory limit and low scheduling priority. Incident 08 adds an unprivileged internal companion with all capabilities dropped, a read-only root filesystem, no host port and explicit resource limits. Incident 09 starts a debug listener as the unprivileged lab user on the existing container port, with no extra host exposure. Incident 10 runs a bounded systemd timer that touches only the lab application's runtime state. Incidents 11 and 12 each use a 16 MiB tmpfs inside the container, the second capped at 64 inodes and filled with empty files. Incident 13 uses a 24 MiB tmpfs and a systemd timer that creates real local tar archives inside the container. Everything lives in the disposable learner container, writes no host path and exposes no port, and reset removes it.

Not in the current Docker track. It teaches service, log, process, filesystem, permission, DNS, configuration and networking diagnosis in real Linux user spaces, but containers share the Docker host kernel. GRUB, initramfs, kernel selection and physical block devices require a later VM-backed track.

No. Those names are used only to identify the software and compatible user spaces being practised. The project is not affiliated with or endorsed by Canonical, the Debian Project, the Rocky Enterprise Software Foundation, Red Hat or Docker.