I am Stéphane ROBERT, infrastructure engineer at LINAGORA, working from Yffiniac in Brittany, France.

I spend my days hardening pipelines and my evenings writing about it. Everything I learn ends up in one of two places: a free tutorial on my blog, or a lab you can actually run from one of the repositories below. Nothing here is a demo that only works on my laptop.

Four tools, each one because the existing answer did not hold up.

🎭	feint	the Scaleway, Outscale and Exoscale APIs, on your laptop
🧪	dsoxlab	hands-on DevSecOps labs that grade the machine, not your typing
🛰️	pepin	three sovereign clouds, one axis
🛡️	pavois	Linux compliance that reads the running config, not the files

The problem: testing cloud automation needs a real account, real credentials and a real bill. And a pipeline that needs secrets cannot run on a pull request from a fork, which is where the contributions come from.

feint is a local emulator of three cloud APIs. It is not a mock written against the documentation: the vendors' own official CLIs drive it end to end, and Terraform and OpenTofu drive two of the three. If scw, osc-cli or exo cannot tell the difference, neither can your automation.

• No account, no credentials, nothing billed. It runs offline, on a laptop, in CI, on a plane.
• Driven by the real clients. Conformance is proven by the vendors' CLIs, not by assertions about them.
• Ships where you already are. A GitHub Action and a Homebrew tap whose formula is derived from each release's signed checksums, never written by hand.

feint up                      # three cloud APIs, locally
scw instance server list      # the vendor's own CLI, unmodified
terraform apply               # against the emulator, nothing billed

The problem: most hands-on labs grade you on the commands you typed. Real exams, RHCSA and LFCS, grade the state of the machine, after a reboot. That gap is exactly where candidates fail.

dsoxlab is a domain-agnostic CLI framework driving training labs that live in their own repositories. Each catalog declares itself through a root meta.yml and one lab.yaml per lab, so adding a domain means writing a file, not patching the engine.

• Validation proves, it does not trust. Labs are graded on the actual state of the system with pytest-testinfra, including persistence after reboot.
• Three runtimes. A plain shell, an Incus container, or a full KVM/libvirt virtual machine, chosen per lab.
• Progress that sticks. Scores, hint costs and history persisted in a local SQLite database, XDG-compliant.
• Bilingual by design. Every user-facing string ships in English and French (DSOXLAB_LANG=en|fr).

uv tool install dsoxlab
dsoxlab doctor                # diagnoses (and repairs) the local toolchain
dsoxlab list-labs             # the catalog is detected from the repo's meta.yml

The problem: every provider ships its own posture dashboard, so three clouds means three scores that cannot be compared, and a question nobody can answer: which of them is actually the worst?

pepin evaluates Outscale, Scaleway and Exoscale against one baseline, anchored on SCSL, SecNumCloud, CIS and ISO. One axis, three clouds, so the comparison means something.

• Before it is provisioned, not after it is billed. It reads a Terraform plan, so a misconfiguration is caught at review time.
• Sovereign by construction. No dependency on a US-hosted control plane to tell you how your European cloud is doing.
• One baseline, not a crosswalk. A control is mapped to the texts it really cites, and never invented to fill a table.

pepin scan --provider outscale        # posture of a live account
pepin scan --tf plan.json             # or of a plan, before apply

The problem: /etc/ssh/sshd_config can say PermitRootLogin no while a drop-in read later sets it to yes. Every file-based scanner reports the host compliant. The machine accepts root over SSH.

pavois asks the service instead of reading its files: sshd -T, sysctl, systemctl show, auditctl -l. The effective configuration, which is the only one an attacker meets. 789 controls across 9 Linux targets, graded A to E over CIS, ANSSI-BP-028, NIST, PCI-DSS and DISA STIG.

• It hardens, and proves it. harden apply --reboot compares the kernel boot_id before and after, so a setting that only holds until the next boot cannot pass silently.
• Evidence you can hand to an auditor. A campaign packages into a tamper-evident bundle you sign under your own identity; pavois never holds a key.
• Proven, not asserted. Debian 12 and 13 go through the full campaign on fresh VMs, and the run itself is validated: a control that returned a verdict it never measured fails the campaign.

pavois scan local --sudo              # grade this host, A to E
pavois harden plan admin@server1      # a reviewable plan, nothing applied
pavois bundle before.json after.json  # signable evidence

Free, in French, and updated far more often than this README. Roughly a hundred articles and a full DevOps course live at www.stephane-robert.info.

• Transformer ce site en vraies formations, pas en tas de guides _2026-10-23
• Du site de formations au parcours par compétences : où j'en suis _2026-10-08
• Une roadmap publique pour maintenir mes formations avec vous _2026-09-17
• npm ne lance plus les scripts d'installation : pnpm l'avait fait avant _2026-07-28
• Quand vos dépôts GitHub deviennent l'infrastructure d'attaque d'un autre _2026-07-23

• scankit _Go — Shared Go library: terminal presentation, SARIF, findings and A-E scoring for security tooling
• secure-python-pipeline _{Python ★ 4} — Lab : API Python avec pipeline CI/CD securise (supply chain, SLSA, SBOM, cosign)

17 catalogs, 480 labs. Self-hosted, runnable, no signup wall, no SaaS. Every one of them is driven by dsoxlab and graded the way the real exams grade: on the state of the machine after a reboot, not on the commands you typed.

_{This list is not maintained by hand: build.py calls a repository a catalog when it carries the contract's root meta.yml, and counts its labs/**/lab.yaml. A catalog published today appears here tomorrow, and one that is emptied leaves on its own.}

_{Rendered by build.py from README-TEMPLATE.j2 · refreshed daily by GitHub Actions}