Docker & Kubernetes
Containers are easy. Running them for thousands of users, at 3am, when something breaks — that's the job. This course teaches the second part. The foundation of the entire DevOps track, built for fresh IT graduates and working engineers who will be on call.
Most Docker and Kubernetes courses teach a 2021 cluster. This one teaches the platform as it actually ships and behaves now, because that is where the professional value sits. Everything downstream in cloud, platform and SRE work rests on this layer — which is why it is the foundation of the entire DevOps track. The differentiator at hire time is not writing manifests but operating clusters: debugging a live incident, planning an upgrade, enforcing security, controlling cost. So the whole course is weighted toward the part that gets you hired — you will break clusters and fix them.
The urgent item first: the upstream Kubernetes project has retired Ingress NGINX. One of the most widely deployed components in the ecosystem now receives no further releases, bug fixes or security patches — which means a very large number of production clusters are running an unmaintained, internet-facing component and need a migration plan. We teach that migration as first-class, funded work: assessment, alternatives, and a staged cutover — most naturally to the Gateway API, which has reached stable and is the recommended routing standard for new clusters, replacing the older Ingress resource whose limitations forced vendor-specific annotations and lock-in.
Three more things date this syllabus to now. Kubernetes is where AI workloads run: declarative, topology-aware scheduling of GPUs and other accelerators has graduated to stable, replacing opaque integer counts — the mechanism behind serious ML and inference on Kubernetes, and a natural bridge to our MLOps Engineering and AI courses. Operational features have changed daily practice — native sidecar containers with real lifecycle ordering, in-place pod resource resizing without a restart, declarative policy-based admission control, and deprecations that break upgrades if you're not planning for them. And container images are now a supply-chain artefact: multi-stage and distroless builds, non-root by default, scanning, SBOMs, provenance attestations and signing. Most courses stop at "here is a Dockerfile" — the professional standard is everything after it.
Do You Actually Need Kubernetes?
An honest question this course answers before it sells you the cluster. For a handful of services, a managed container platform is usually the better answer, and Kubernetes' operational cost — the people, the upgrades, the on-call — is real and permanent. You will learn to tell the difference, and to justify not reaching for a cluster as confidently as running one. Knowing that boundary is exactly the judgment that separates a platform engineer from someone who installs Kubernetes because it's on the CV.
The Foundation of the DevOps Track
- Docker & Kubernetes (this course) — the substrate almost all modern infrastructure runs on. Every later cloud, platform and SRE skill sits on top of it.
- Bridges directly to MLOps Engineering (GPU-scheduled training and inference run on this exact layer), Golang Development (the language most of this ecosystem is written in) and Apache Kafka (event infrastructure you'll run on the cluster).
- Pairs with Git & GitHub for Developers — GitOps delivery and CI/CD pipelines are how everything you build here reaches the cluster.
Why Learn This When AI Writes Manifests?
AI writes Dockerfiles and Kubernetes manifests fluently — and produces exactly the artefacts that pass review and fail in production: containers running as root, images bloated with build toolchains, missing resource limits, probes that mark a broken pod healthy, and manifests copied from a blog for a different Kubernetes version. None of that fails in a demo; it fails under load, on call. The value is operational judgment, debugging under pressure, and knowing what the cluster will actually do. You'll use AI tooling as an accelerator you review, and learn the failure patterns generated infrastructure code repeats — so you ship its speed without shipping its mistakes.
Course at a Glance
- Duration: 12 weeks | ~90 hours | live + hands-on
- Format: Live online · lab-heavy · you will break clusters and fix them
- Prerequisite: Comfortable on the Linux command line and with basic networking. No container or orchestration experience required. Some scripting ability helps.
- Curriculum: 11 modules, from containers-from-first-principles to operations, scale, cost and capstone
- Certification: Aligned to the CNCF Kubernetes certification path — developer (CKAD), administrator (CKA) and security (CKS)
- Curriculum reviewed: July 2026 — Kubernetes ships continuously and the ecosystem changes fast; this syllabus is checked against official documentation
Course Highlights
- Every module leads with what you build, operate or recover from — not what you "learn about"
- The Ingress NGINX retirement handled as urgent, funded migration work — assessment and staged cutover to the Gateway API
- GPU and accelerator scheduling for AI/ML workloads — declarative, topology-aware allocation
- Container images as a supply-chain artefact: distroless, non-root, scanned, SBOM, signed, provenance
- Break-fix labs under time pressure — crash-looping pods, DNS failures, failed rollouts, node pressure
- GitOps delivery, progressive rollout, and rollbacks that actually work
- Cost engineering on clusters that typically run far below their provisioned capacity
- An honest "do you actually need Kubernetes?" module — and AI tooling used as a reviewed accelerator
Hands-on Projects & Portfolio
A minimal, non-root, scanned image with an SBOM and a provenance attestation.
Proper probes, resource limits, config and secrets.
Move a workload off a retired ingress component onto the Gateway API with zero downtime.
Persistent storage, backup, and a tested restore.
Environment promotion and an automated rollback.
RBAC, network policy, pod security and admission policy on a deliberately open cluster.
Declarative accelerator allocation for an ML workload.
Diagnose a crash-loop, an unschedulable pod, a DNS failure, node memory pressure and a failed rollout — with evidence, under time pressure.
Cut a cluster's provisioned spend with measured before/after.
Production-grade platform: secured, observable, cost-managed and defended.
Tools & Stack
Docker BuildKit containerd Kubernetes kubectl Helm Kustomize Argo CD Gateway API Cilium cert-manager Prometheus Grafana OpenTelemetry Loki Trivy Cosign Falco Kyverno or OPA KEDA Velero Terraform AWS EKS GKE AKS Git
Certification Alignment
- Developer track — Modules 1–6 and 9 map to the CNCF Certified Kubernetes Application Developer (CKAD) scope
- Administrator track — Modules 5–8 and 11 map to the Certified Kubernetes Administrator (CKA) scope
- Security track — Modules 4 and 10 map to the Certified Kubernetes Security Specialist (CKS) scope
- Presented as preparation and alignment — no official partnership or accreditation implied, and no exam outcome guaranteed
Career Outcomes
Containers and Kubernetes are the substrate almost all modern infrastructure runs on, which makes this the highest-leverage foundational skill in the DevOps track — and increasingly in AI infrastructure too, since GPU-backed training and inference are scheduled the same way. The differentiator at hire time is not writing manifests but operating clusters: debugging live incidents, planning upgrades, enforcing security and controlling cost. This course targets:
- DevOps Engineer
- Platform Engineer
- Site Reliability Engineer
- Cloud Engineer
- Kubernetes Administrator
- Infrastructure Engineer
- Cloud Architect (with experience)
- Backend engineer who owns their own deployment
Who This Course Is For
- Final-year students and fresh IT graduates targeting DevOps, cloud or platform roles
- Developers who want to own their applications through to production
- System administrators and infrastructure engineers moving from VMs to containers — a large and motivated group, and this is your path
- Backend, data and ML engineers whose workloads already run on someone else's cluster
- Teams running unmaintained ingress components who need a migration plan — this is urgent, funded work, and the course covers it end to end
- SREs and architects responsible for uptime, security and cloud spend
Material Includes
- Class recordings
- Break-fix lab clusters & incident runbooks
- Migration checklists & cluster hardening templates
- Certificate
Prerequisites
- Comfortable on the Linux command line
- Basic networking
- No container or orchestration experience required; scripting helps
Estimated Time: 8 Hours
You build:- A container assembled by hand from namespaces, cgroups and a filesystem — so the runtime stops being magic and every later debugging session becomes tractable
- What a container actually is: namespaces, cgroups, union filesystems and the container runtime
- Images versus layers; the registry model
- Why understanding this makes every later debugging session tractable rather than magical
Estimated Time: 8 Hours
You ship:- A build pipeline producing minimal, distroless, non-root, multi-architecture images small and fast enough — and clean enough — that you'd be willing to sign them
- Modern build tooling and caching; multi-stage builds; choosing a base image; minimal and distroless images
- Running as non-root; reproducible builds; multi-architecture images
- Image size and startup time; a build pipeline that produces signable artefacts
Estimated Time: 7 Hours
You ship:- A multi-container application running locally with real networking, volumes and health checks — development that matches production closely enough to trust
- Multi-container applications; networking and volumes
- Development versus production parity; debugging inside containers; health checks
- Container-based integration testing
Estimated Time: 8 Hours
You ship:- A hardened supply chain: an image scanned, an SBOM generated, a provenance attestation produced and the artefact signed and verified before it can be deployed
- Vulnerability scanning; SBOM generation; provenance attestations and image signing
- Base image lifecycle and patching; secrets that never belong in an image; registry access control
- The runtime hardening options
Estimated Time: 8 Hours
You build:- A cluster stood up from its components, then read like a practitioner — tracing one request through the API server, scheduler, kubelet and runtime until the reconciliation model is obvious
- The control plane and its components; the declarative reconciliation model that explains everything else
- The API server and resource model; scheduling; kubelet and the container runtime interface; etcd
- Reading cluster state like a practitioner rather than guessing
Estimated Time: 9 Hours
You ship:- A multi-service workload with native sidecars, honest probes, quality-of-service-aware requests and limits, and graceful shutdown that drains cleanly under a rolling update
- Pods and the pod lifecycle; deployments, replica sets, stateful sets, daemon sets, jobs and cron jobs
- Native sidecar containers; init containers; configuration and secrets; resource requests and limits and quality-of-service classes
- Probes that tell the truth; graceful shutdown
Estimated Time: 9 Hours
You ship:- The ingress migration: a workload moved off a retired ingress component onto the Gateway API with zero downtime, TLS managed, and network policy segmenting the namespace
- The cluster networking model; services and their types; DNS; the CNI layer; network policy for segmentation
- The Gateway API as the modern routing standard; TLS and certificate management
- Migrating off retired or unmaintained ingress components — assessment, alternatives and staged cutover
Estimated Time: 7 Hours
You ship:- A stateful workload on persistent storage with a tested backup-and-restore and a safe stateful upgrade — plus a written call on when a database does not belong on the cluster
- Volumes; persistent volumes and claims; storage classes and dynamic provisioning; the container storage interface
- Running databases on Kubernetes and when you genuinely shouldn't
- Backup and restore; stateful upgrade patterns
Estimated Time: 8 Hours
You ship:- A GitOps delivery pipeline: templated config promoted across environments by a reconciliation controller, with a canary rollout and an automated rollback that works when it must
- Templating and configuration management with Helm and Kustomize; environment promotion
- GitOps delivery with a reconciliation controller; progressive delivery including canary and blue/green; rollbacks that work
- Secret management integration; operators and custom resources for extending the platform
Estimated Time: 8 Hours
You ship:- A hardened, multi-tenant cluster: RBAC and workload identity, pod security standards, declarative admission policy and image-provenance enforcement, checked against a hardening checklist
- RBAC done properly; service accounts and workload identity; pod security standards
- Admission control including declarative policy; namespace and tenancy strategy; image provenance enforcement
- Audit logging; the cluster hardening checklist
Estimated Time: 10 Hours
You ship:- Your capstone: a production-grade platform — observable, autoscaled, right-sized, GPU-capable, upgrade-planned, cost-managed and defended — plus a cost exercise cutting provisioned spend with measured before/after
- Observability with metrics, logs and distributed tracing; autoscaling horizontally, vertically and at the node level; in-place resource resizing and right-sizing practice
- GPU and accelerator scheduling for AI/ML workloads; cluster upgrades and deprecation planning; disaster recovery
- Capacity and cost optimisation on clusters that typically run far below provisioned capacity; incident response and debugging under pressure; capstone build and defense
- What's App: +91 73-01-11-21-31 for immediate assistance during business hours.
- Email: Send your inquiries to hello@progmatrix.com, and one of our representatives will get back to you as soon as possible.
- Website: You can also use the contact form on our website to send us a message directly.