Break infrastructure.
On purpose.
Before production breaks it for you.
Spin up isolated environments that mirror your stack. Inject failures, trace blast radius, and ship fixes — all without a post-mortem to write afterward.
ALERT: upstream service /api/orders exceeded 30s threshold — 14 dependent services now queued behind a dead lock.
When one slow service takes down twelve healthy ones.
Timeouts don't fail fast — they queue. And queued threads hold connections. And held connections starve your database pool. You've seen this at 2 a.m. Now you can reproduce it in 90 seconds, trace the blast radius, and wire in circuit breakers before it ever touches production.
Timeout Cascade Lab — v2.3
Kubernetes cluster with 6 microservices. Inject latency into the orders service via tc-netem, watch the dependency graph collapse in Grafana, then implement bulkhead + timeout patterns to contain the failure.
CRITICAL: node worker-03 disk at 98.4% — kubelet evicting pods, PVCs detaching, logs vanishing mid-write.
Disk fills. Pods die. Logs disappear at the worst moment.
Disk pressure is invisible until it's catastrophic. Your node hits 95%, kubelet starts evicting low-priority pods, then medium-priority, then your database sidecar. By the time you notice, the logs that would have told you why are gone. This lab teaches you to detect pressure early, set eviction thresholds, and configure log rotation that survives the incident.
Disk Pressure Eviction Lab — v1.8
Single-node k8s with constrained 2GB disk. Fill disk with a log-flooding deployment, observe kubelet eviction order, then implement proper resource quotas, log rotation, and PVC size limits.
ALERT: internal DNS resolving payments.internal to 10.0.4.99 — unknown host, traffic silently redirected for 18 minutes.
Your DNS lied. Traffic went somewhere it shouldn't.
DNS failures are the cruelest kind — they're silent, they're intermittent, and by the time you check DNS you've already ruled it out twice. This lab walks you through a poisoned CoreDNS ConfigMap, traces the packet path with tcpdump, and shows you how to lock down DNS with DNSSEC validation and network policies before your next deploy.
DNS Redirect & Poisoning Lab — v3.1
CoreDNS cluster with manipulated ConfigMap rewriting payments.internal to a honeypot IP. Use dig, tcpdump, and k8s audit logs to detect the redirect, then harden with DNSSEC and admission webhooks.
CRITICAL: TLS cert for api.internal expired 4 hours ago — all HTTPS handshakes failing, health checks timing out, on-call paged at 03:47.
The cert expired. Nobody set a reminder. You know the rest.
Certificate expiry is the most embarrassing production incident because it's 100% preventable. But cert-manager misconfiguration, auto-renewal failures, and Let's Encrypt rate limits have humbled teams at every scale. This lab lets you reproduce a cert expiry mid-traffic, diagnose the TLS handshake failure chain, and build the monitoring that would have paged you 30 days earlier.
TLS Cert Expiry & Rotation Lab — v2.0
NGINX ingress with cert-manager. Artificially expire the TLS certificate, observe the handshake failure cascade, then implement cert-manager ClusterIssuer with 30-day pre-expiry alerts and automated rotation.
The lab that would have
prevented it is live now.
No credit card. No setup. GitHub SSO gets you into a running environment in under 90 seconds. 47 labs online right now.