Build it. Automate it. Scale it for everyone.
Journey • Get Started • Outputs • Roadmap • Contribute • Glossary
200+ hands-on lessons across 20 phases. From Linux fundamentals to production Internal Developer Platforms. Terraform, Kubernetes, ArgoCD, Backstage, OpenTelemetry, eBPF. Every lesson produces something reusable: runbooks, Terraform modules, Helm charts, dashboards, and platform tooling.
You learn Platform Engineering. You build real things. You ship platforms others can use.
| Other Courses | This Course | |
|---|---|---|
| Scope | One tool (just K8s, or just Terraform) | Everything: Linux, networking, IaC, containers, orchestration, GitOps, observability, IDP |
| Output | "I watched a video" | A portfolio of Terraform modules, Helm charts, runbooks, and a full IDP |
| Depth | Click-through demos | Build from scratch first, then production-harden it |
| Format | Slides or docs | Runnable code + configs + architecture diagrams + live labs |
| Audience | Ops people or Dev people | Platform Engineers bridging both |
The bedrock. Everything runs on Linux. Everything talks over a network.
| # | Lesson | Type |
|---|---|---|
| 01 | Linux File System & Permissions | Build |
| 02 | Processes, Signals & systemd | Build |
| 03 | Networking Basics: IP, DNS, TCP/UDP | Learn |
| 04 | Firewalls, iptables & nftables | Build |
| 05 | SSH, TLS & PKI | Build |
| 06 | Load Balancing Concepts | Learn |
| 07 | DNS Deep Dive | Build |
| 08 | Storage: Disks, LVM, NFS, Ceph | Build |
| 09 | Kernel Tuning & Performance | Build |
| 10 | Bash Scripting for Platform Work | Build |
| 11 | Package Management & Repos | Build |
| 12 | System Observability: top, strace, perf | Build |
Public cloud is the platform under your platform.
| # | Lesson | Type |
|---|---|---|
| 01 | Cloud Mental Models: Regions, AZs, VPCs | Learn |
| 02 | IAM: Identities, Policies, Roles | Build |
| 03 | Compute: VMs, Autoscaling, Spot | Build |
| 04 | Networking: VPC, Subnets, Peering, TGW | Build |
| 05 | Storage: S3, EBS, EFS, Glacier | Build |
| 06 | Managed Databases: RDS, Aurora, DynamoDB | Build |
| 07 | DNS & CDN: Route53, CloudFront | Build |
| 08 | Secrets Management: SSM, Secrets Manager, Vault | Build |
| 09 | Cost Management & FinOps Basics | Learn |
| 10 | Cloud Security Fundamentals | Build |
| 11 | Multi-Cloud & Hybrid Architectures | Learn |
| 12 | Landing Zones & Account Structures | Build |
Manual is the enemy. Code is truth.
| # | Lesson | Type |
|---|---|---|
| 01 | What Is IaC & Why It Matters | Learn |
| 02 | Terraform: State, Providers, Resources | Build |
| 03 | Terraform Modules: Reusable Building Blocks | Build |
| 04 | Terraform Workspaces & Environments | Build |
| 05 | Remote State: S3 + DynamoDB Locking | Build |
| 06 | Terraform at Scale: Terragrunt | Build |
| 07 | OpenTofu: The OSS Fork | Build |
| 08 | Pulumi: IaC in Real Languages | Build |
| 09 | CDK for Terraform (CDKTF) | Build |
| 10 | Ansible: Configuration Management | Build |
| 11 | Policy as Code: OPA & Sentinel | Build |
| 12 | Drift Detection & Remediation | Build |
| 13 | IaC Testing: Terratest, Kitchen-Terraform | Build |
| 14 | Cost Estimation: Infracost | Build |
| 15 | Build a Reusable Module Library | Build |
The atom of modern infrastructure.
| # | Lesson | Type |
|---|---|---|
| 01 | Linux Namespaces & cgroups from Scratch | Build |
| 02 | Container Images: Layers, OCI, Registries | Build |
| 03 | Writing Efficient Dockerfiles | Build |
| 04 | BuildKit, Buildah & Multi-Stage Builds | Build |
| 05 | Container Runtimes: runc, containerd, CRI-O | Learn |
| 06 | Image Scanning: Trivy, Grype | Build |
| 07 | Container Signing: Cosign & Sigstore | Build |
| 08 | Private Registries: Harbor, ECR, GCR | Build |
| 09 | Compose for Local Dev Environments | Build |
| 10 | Rootless Containers & Security Hardening | Build |
| 11 | SBOMs: Software Bill of Materials | Build |
| 12 | Build a Golden Image Pipeline | Build |
The operating system of the cloud.
| # | Lesson | Type |
|---|---|---|
| 01 | Kubernetes Architecture: API Server to etcd | Learn |
| 02 | Pods, ReplicaSets & Deployments | Build |
| 03 | Services, Endpoints & kube-proxy | Build |
| 04 | ConfigMaps, Secrets & Environment Management | Build |
| 05 | Persistent Volumes & Storage Classes | Build |
| 06 | Namespaces, RBAC & Multi-Tenancy | Build |
| 07 | Resource Requests, Limits & QoS | Build |
| 08 | Health Checks: Liveness, Readiness, Startup | Build |
| 09 | Scheduling: Affinity, Taints, Tolerations | Build |
| 10 | Ingress Controllers: NGINX, Traefik, Gateway API | Build |
| 11 | StatefulSets & Headless Services | Build |
| 12 | Jobs, CronJobs & Batch Workloads | Build |
| 13 | Kubernetes Networking Deep Dive: CNI | Learn |
| 14 | Network Policies | Build |
| 15 | Cluster Autoscaler & Karpenter | Build |
| 16 | kubeadm: Build a Cluster from Scratch | Build |
Extend Kubernetes. Make it do your bidding.
| # | Lesson | Type |
|---|---|---|
| 01 | Custom Resource Definitions (CRDs) | Build |
| 02 | Admission Webhooks: Mutating & Validating | Build |
| 03 | Building a Kubernetes Operator with kubebuilder | Build |
| 04 | Operator SDK: Go & Helm Operators | Build |
| 05 | controller-runtime Deep Dive | Build |
| 06 | etcd: Backup, Restore & Performance | Build |
| 07 | API Aggregation Layer | Build |
| 08 | Virtual Clusters: vCluster | Build |
| 09 | Multi-Cluster Management: Cluster API | Build |
| 10 | Fleet Management: Fleet, Rancher | Build |
| 11 | Kubernetes Security: Falco, AppArmor, Seccomp | Build |
| 12 | Chaos Engineering: LitmusChaos, Chaos Mesh | Build |
| 13 | Build a Database Operator | Build |
Ship applications like a platform team, not a sysadmin.
| # | Lesson | Type |
|---|---|---|
| 01 | Helm Architecture: Charts, Templates, Values | Build |
| 02 | Writing Your First Helm Chart | Build |
| 03 | Helm Templating: Sprig, Conditionals, Loops | Build |
| 04 | Helm Library Charts & Subcharts | Build |
| 05 | Helm Hooks & Post-Install Jobs | Build |
| 06 | OCI Registries for Helm Charts | Build |
| 07 | Helmfile: Managing Multiple Releases | Build |
| 08 | Testing Helm Charts: helm unittest, ct | Build |
| 09 | Kustomize: Patch Without Templates | Build |
| 10 | Build & Publish a Public Helm Chart | Build |
Speed to production. Safely.
| # | Lesson | Type |
|---|---|---|
| 01 | CI/CD Principles: DORA Metrics, Shift Left | Learn |
| 02 | GitHub Actions from Scratch | Build |
| 03 | Reusable Workflows & Composite Actions | Build |
| 04 | GitLab CI: Pipelines, Runners, Caching | Build |
| 05 | Jenkins: Declarative Pipelines | Build |
| 06 | Tekton: Cloud-Native CI on Kubernetes | Build |
| 07 | Artifact Management: Nexus, JFrog, OCI | Build |
| 08 | SAST & DAST in Pipelines | Build |
| 09 | Dependency Scanning: Dependabot, Renovate | Build |
| 10 | Secret Scanning in CI | Build |
| 11 | Pipeline as Code: DRY Principles | Build |
| 12 | Self-Hosted Runners & Build Caching | Build |
| 13 | Release Automation: semantic-release, GoReleaser | Build |
| 14 | Build a Golden CI Template Library | Build |
Git is the source of truth. Always.
| # | Lesson | Type |
|---|---|---|
| 01 | GitOps Principles: Why It Changes Everything | Learn |
| 02 | ArgoCD: Installation & Core Concepts | Build |
| 03 | ArgoCD ApplicationSets & Multi-Cluster | Build |
| 04 | ArgoCD Rollouts: Canary & Blue/Green | Build |
| 05 | Flux CD: Kustomization & HelmRelease | Build |
| 06 | GitOps Repo Structure: Monorepo vs Polyrepo | Learn |
| 07 | Image Automation with Flux | Build |
| 08 | Secret Management in GitOps: Sealed Secrets, ESO | Build |
| 09 | Progressive Delivery: Feature Flags & Argo Rollouts | Build |
| 10 | GitOps for Infrastructure (Terraform + ArgoCD) | Build |
| 11 | Build a Full GitOps Platform | Build |
Solve networking for every service, once.
| # | Lesson | Type |
|---|---|---|
| 01 | Why Service Mesh: The Problems It Solves | Learn |
| 02 | Istio: Architecture & Data Plane | Build |
| 03 | Istio Traffic Management: VirtualServices, DestinationRules | Build |
| 04 | mTLS & Istio Security Policies | Build |
| 05 | Linkerd: Simpler, Faster, Rust-Based | Build |
| 06 | Cilium Service Mesh: eBPF-Powered | Build |
| 07 | Envoy Proxy Deep Dive | Build |
| 08 | Observability with Service Mesh: Kiali, Jaeger | Build |
| 09 | Multi-Cluster Service Mesh | Build |
| 10 | Choosing a Mesh: Decision Framework | Learn |
If you can't see it, you can't operate it.
| # | Lesson | Type |
|---|---|---|
| 01 | Observability vs Monitoring: The Three Pillars | Learn |
| 02 | Metrics: Prometheus from Scratch | Build |
| 03 | PromQL: Writing Real Queries | Build |
| 04 | Alerting: Alertmanager, Routes & Silences | Build |
| 05 | Grafana: Dashboards, Variables, Panels | Build |
| 06 | Logs: Loki + Promtail Stack | Build |
| 07 | Logs: ELK Stack (Elasticsearch, Logstash, Kibana) | Build |
| 08 | Distributed Tracing: Jaeger & Zipkin | Build |
| 09 | OpenTelemetry: The Universal Standard | Build |
| 10 | Auto-Instrumentation & OTEL Collectors | Build |
| 11 | SLOs, SLIs & Error Budgets | Build |
| 12 | eBPF for Observability: Pixie, Hubble | Build |
| 13 | Continuous Profiling: Phlare, Pyroscope | Build |
| 14 | Cost-Efficient Observability at Scale | Build |
| 15 | On-Call & Incident Response Integration | Build |
| 16 | Build a Full Observability Stack | Build |
Shift security left. Bake it in, don't bolt it on.
| # | Lesson | Type |
|---|---|---|
| 01 | Zero Trust Architecture | Learn |
| 02 | Secret Rotation & Dynamic Secrets: Vault | Build |
| 03 | PKI at Scale: cert-manager | Build |
| 04 | Identity: OIDC, SAML, SPIFFE/SPIRE | Build |
| 05 | Pod Security Standards & OPA/Gatekeeper | Build |
| 06 | Supply Chain Security: SLSA, SBOM, Sigstore | Build |
| 07 | Runtime Security: Falco & eBPF | Build |
| 08 | Network Security: Cilium & NetworkPolicy | Build |
| 09 | Compliance as Code: OpenSCAP, Kyverno | Build |
| 10 | Vulnerability Management Pipeline | Build |
| 11 | Penetration Testing for Platform Teams | Build |
| 12 | Security Dashboards & Posture Management | Build |
| 13 | Build a Secure Platform Baseline | Build |
Build the platform that empowers developers.
| # | Lesson | Type |
|---|---|---|
| 01 | What Is an IDP: Principles & Trade-offs | Learn |
| 02 | Backstage: Architecture & Installation | Build |
| 03 | Software Catalog: Entities, Relations, Metadata | Build |
| 04 | Backstage Plugins: Core & Custom | Build |
| 05 | TechDocs: Living Documentation | Build |
| 06 | Software Templates: Self-Service Scaffolding | Build |
| 07 | Scaffolding: Cookiecutter, Yeoman, custom | Build |
| 08 | Golden Paths: Paved Roads for Developers | Build |
| 09 | Service Catalog & API Discovery | Build |
| 10 | Developer Portals: Port, Cortex, OpsLevel | Build |
| 11 | Measuring Developer Experience: DORA, SPACE | Build |
| 12 | Self-Service Infrastructure Requests | Build |
| 13 | Environment-as-a-Service | Build |
| 14 | Build a Production-Ready IDP | Build |
Own every packet from developer laptop to production.
| # | Lesson | Type |
|---|---|---|
| 01 | Kubernetes Networking: Pod-to-Pod | Learn |
| 02 | CNI Plugins: Cilium, Calico, Flannel | Build |
| 03 | eBPF Networking: Cilium Deep Dive | Build |
| 04 | Ingress: NGINX, Traefik, Gateway API | Build |
| 05 | Kubernetes Gateway API | Build |
| 06 | External DNS & Cert-Manager Automation | Build |
| 07 | Multi-Cluster Networking: Submariner, Skupper | Build |
| 08 | Service Discovery: CoreDNS Deep Dive | Build |
| 09 | Network Performance Testing: iperf, k6 | Build |
| 10 | IPv6 in Kubernetes | Build |
| 11 | Build a Multi-Region Networking Architecture | Build |
Data outlives code. Treat it accordingly.
| # | Lesson | Type |
|---|---|---|
| 01 | Kubernetes Storage: CSI Drivers & Architecture | Learn |
| 02 | Rook-Ceph: Distributed Storage on Kubernetes | Build |
| 03 | Longhorn: Lightweight Replicated Storage | Build |
| 04 | OpenEBS: Local & Replicated Volumes | Build |
| 05 | Object Storage: MinIO on Kubernetes | Build |
| 06 | Backup & DR: Velero | Build |
| 07 | Database Operators: CloudNativePG, Vitess | Build |
| 08 | Data Replication & Geo-Distribution | Build |
| 09 | Storage Classes & Tiering Strategies | Learn |
| 10 | Build a Storage Platform for a Multi-Tenant Cluster | Build |
Performance without cost awareness is just waste at speed.
| # | Lesson | Type |
|---|---|---|
| 01 | FinOps Principles & Cloud Cost Models | Learn |
| 02 | Kubernetes Cost Allocation: Kubecost, OpenCost | Build |
| 03 | Right-Sizing Workloads: VPA, Goldilocks | Build |
| 04 | Spot & Preemptible Instances at Scale | Build |
| 05 | Reserved Capacity Planning | Learn |
| 06 | Chargeback & Showback Models | Build |
| 07 | Idle Resource Detection & Cleanup | Build |
| 08 | Cost Anomaly Detection | Build |
| 09 | Build a FinOps Dashboard | Build |
AI is the new junior platform engineer. Lead it well.
| # | Lesson | Type |
|---|---|---|
| 01 | AI in Platform Engineering: Use Cases & Limits | Learn |
| 02 | LLMs for Runbook Generation | Build |
| 03 | AI-Powered Infrastructure Code Generation | Build |
| 04 | MCP Servers for Platform Tooling | Build |
| 05 | AI-Assisted Incident Analysis | Build |
| 06 | AI Cost Analysis & Optimization | Build |
| 07 | Building AI Agents for Platform Tasks | Build |
| 08 | AI-Powered Security Review | Build |
| 09 | Prompt Engineering for DevOps | Build |
| 10 | Build an AI Ops Assistant for Your Platform | Build |
Reliability is a feature. Build it like one.
| # | Lesson | Type |
|---|---|---|
| 01 | SRE vs DevOps vs Platform Engineering | Learn |
| 02 | SLOs, SLIs, Error Budgets in Practice | Build |
| 03 | On-Call Runbooks & Escalation Policies | Build |
| 04 | Incident Management: PagerDuty, OpsGenie | Build |
| 05 | Postmortem Culture: Blameless & Actionable | Learn |
| 06 | Capacity Planning | Build |
| 07 | Toil Reduction Strategies | Build |
| 08 | Chaos Engineering: GameDays & Fire Drills | Build |
| 09 | Disaster Recovery Planning & Testing | Build |
| 10 | Platform SRE Dashboards & Runbook Automation | Build |
| 11 | Build an On-Call Readiness Program | Build |
The hardest part of Platform Engineering is people, not tech.
| # | Lesson | Type |
|---|---|---|
| 01 | Team Topologies for Platform Teams | Learn |
| 02 | Treating Platform as a Product | Learn |
| 03 | Internal Developer Advocacy | Learn |
| 04 | Platform Roadmaps & Prioritization | Build |
| 05 | Managing Upstream Contributions | Learn |
| 06 | Writing RFCs & ADRs | Build |
| 07 | Platform Engineering Maturity Model | Learn |
| 08 | Building the Business Case for Platform Investment | Build |
Prove everything you learned.
| # | Project | Combines |
|---|---|---|
| 01 | Build a Production Kubernetes Platform on AWS | Phases 1, 2, 4, 5, 10 |
| 02 | Full GitOps Pipeline with Progressive Delivery | Phases 7, 8, 6, 10 |
| 03 | Internal Developer Platform with Backstage | Phases 12, 4, 7, 11 |
| 04 | Multi-Cloud Observability Stack | Phases 10, 9, 1, 13 |
| 05 | End-to-End Secure Platform: Zero Trust to Delivery | All phases |
Every lesson produces something reusable. By the end you have:
outputs/
├── runbooks/ Runbooks for every platform scenario
├── tools/ CLI tools and scripts for platform work
├── dashboards/ Grafana dashboards as code
└── configs/ Reusable Helm charts, Terraform modules, YAML configs
phases/XX-phase-name/NN-lesson-name/
├── terraform/ Terraform configs for this lesson
├── k8s/ Kubernetes manifests and Helm charts
├── docs/
│ └── en.md Lesson documentation with diagrams
└── outputs/ Runbooks, configs, tools produced by this lesson
Every lesson follows 6 steps:
- Why – the problem this solves in production
- Concept – architecture diagrams and mental models
- Build It – implement from scratch or first principles
- Harden It – production-ready configurations
- Automate It – make it self-service or automated
- Ship It – the runbook, module, or tool this lesson produces
git clone https://github.com/neelshah2409/platform-engineering-from-scratch.git
cd platform-engineering-from-scratch
# Verify prerequisites
./scripts/check-prerequisites.sh
# Start with Phase 0
cd phases/00-linux-and-networking/01-linux-filesystem
cat docs/en.md- You can write shell scripts and basic code
- You want to understand how modern infrastructure actually works
- A Linux/macOS machine or cloud VM (all labs tested on Ubuntu 22.04)
| Category | Tools |
|---|---|
| IaC | Terraform, OpenTofu, Pulumi, Ansible, Terragrunt |
| Containers | Docker, Podman, BuildKit, containerd |
| Orchestration | Kubernetes, k3s, kind, EKS, GKE, AKS |
| GitOps | ArgoCD, Flux, Argo Rollouts |
| Observability | Prometheus, Grafana, Loki, Jaeger, OpenTelemetry |
| Security | Vault, Falco, OPA, Trivy, Cosign, cert-manager |
| Service Mesh | Istio, Linkerd, Cilium, Envoy |
| IDP | Backstage, Port, Cortex |
| CI/CD | GitHub Actions, GitLab CI, Tekton, Jenkins |
| Networking | Cilium, Calico, CoreDNS, Gateway API |
See CONTRIBUTING.md for how to add lessons, translations, and outputs.
Want to fork this for your team or company platform team onboarding? See FORKING.md.
See ROADMAP.md for progress tracking.
MIT License. Build your platform.