Skip to main content
HybridCloudWorks

Learn any cloudDocker LearnLabs

Docker labs

WorkspacesUnknown

Each lab below opens in VS Code in your browser with az, terraform, kubectl, helm and ansible already installed, or runs on your own machine from the same container image. Nothing here installs anything on your computer beyond Docker, and nothing you do in a lab reaches anything else: the workspaces run on the Hybrid Lab host, a single server whose Azure Arc status is on the live card further down this page.

Open lab opens the lab's own page: its objectives and steps, and the workspace in a pane. The first time, you sign in with GitHub in a new tab that brings you back, approve the workspace, and land in the lab folder. Workspaces stop after an hour of inactivity and are limited to one CPU and two gigabytes of memory, so treat them as scratch space and keep anything you want in your own repository.

How labs work

Lab
A structured exercise on this site: what you will learn, what to have ready, the steps in order, and where a check can confirm your work. Each lab is listed under the provider it teaches.
Desktop
The workspace a lab opens in: VS Code in your browser, running in a container on the Hybrid Lab host with the lab’s tools installed and its folder open. You sign in with GitHub, and the workspace stops on its own after an hour of inactivity.
Agent
The job runner on the same host. It takes a file or folder you submit, runs one fixed check on it (a Terraform validate, an Ansible syntax check) in a sandbox with no network, and returns what the tool printed. Nothing you submit is executed against anything.
15-Min ScenariosBrowser TerminalZero Cloud Account Required

GitHub public identity check only (read:user scope). No repository write access.

Pre-Flight Verification

Hybrid Lab Pre-Flight Briefing

Every lab launches an isolated, sandboxed container workspace in your browser. Review duration, toolchains, and security guarantees below.

15-Min ScenariosBrowser TerminalZero Cloud Account Required
Pre-Installed Toolchain (hcw-lab Image)
terraform
IaC Synthesis & Plan Validation
tflint
AVM Rules & Security Linting
ansible-lint
Playbook Syntax & Hardening
docker
Multi-Stage Container Runtime
az
Enterprise Cloud Management
learner@hcw-lab:~/workspace
SANDBOX READY
$ terraform init && tflint --module
✓ Initialized providers: azurerm, aws, google
✓ Linting complete: 0 issues found (AVM policy passed)
$ ansible-playbook --syntax-check site.yml
playbook: site.yml [PASS - syntax verified]
Privacy & Security DisclosureSign-in checks public GitHub organization membership only (read:user scope). We never request repository access, personal emails, or cloud subscription credentials. Container workspaces run isolated and stop automatically after 60 minutes of inactivity.

Pick a lab

  • Docker Sandboxes & Agent Containment Walkthrough

    Explore and validate rootless container execution, unprivileged user namespaces, read-only rootfs mounts, and network-isolated local AI agent sandboxes.

    Intermediateabout 15 minutesToolsdocker

    Open lab Docker Sandboxes & Agent Containment Walkthrough: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

Run an agent against your landing zone

The Docker Sandboxes recipe has its own page in the Docker hub now: Run an agent in a sandbox.