grceng.academy
YAML lab 40 bonus XP

Make a disposable worker auditable

Start labRead the room

Objectives

Halcyon Clinics is replacing intake workers with ordinary containers on shared hosts. The migration memo incorrectly calls them separate-kernel VMs. Author the runtime and evidence plan using the supplied fields; this is a configuration exercise, not a request to implement the application.

Use the approved immutable reference exactly, disable privileged execution, and apply the stated replica bounds. The owner proposes local-only evidence because workers live less than ten minutes. Reject that shortcut: lifecycle export must survive termination and meet the clinic's retention floor.

Approved rollout requirements

Runtime: ordinary containers, no separate guest kernel.
Approved image reference: intake@sha256:7777777777777777777777777777777777777777777777777777777777777777
Privilege policy: privileged execution forbidden.
Autoscaling bounds: minimum 2 replicas, maximum 8 replicas.
Evidence: export lifecycle records outside the worker lifecycle.
Retention: at least 90 days.
Correlation: use workload_id, not a reusable display name.

Checks the server runs (6)

  • Describe the actual kernel boundary
  • Bind the worker to approved image content
  • Disallow privileged execution
  • Apply the approved replica limits
  • Keep lifecycle evidence outside the worker
  • Retain and correlate terminated-worker evidence

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Locate isolation

    Describe which operating-system component remains common to these processes; do not copy the memo's VM claim.

    Describe the actual kernel boundary

  2. Step 2

    Bind and constrain execution

    Copy the approved immutable reference without substituting a movable label. Express the privilege policy as a boolean switch.

    Bind the worker to approved image contentDisallow privileged execution

  3. Step 3

    Set capacity bounds

    Translate both limits from the requirements into numeric fields. Do not confuse a lower bound with a desired count.

    Apply the approved replica limits

  4. Step 4

    Outlive the worker

    Choose a destination outside the disposable execution environment and enable the required event stream.

    Keep lifecycle evidence outside the worker

  5. Step 5

    Make records joinable

    Meet the retention floor and use the fixture's non-reusable correlation field so investigators can join records after deletion.

    Retain and correlate terminated-worker evidence

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.