dsoxlab

dsoxlab — DevSecOps XL Labs CLI

CI OpenSSF Scorecard Plumber compliance License: Apache 2.0 Python Code style: ruff

Read this in another language: Français

dsoxlab turns declarative exercises into reproducible, runnable and verifiable environments. A catalog states what it offers through a root meta.yml and one lab.yaml per lab; the engine provisions what each lab asks for, opens it, and proves the result with tests that read the state of the system rather than the commands typed into it.

Nothing about a specific domain lives in the engine: it serves Linux, Ansible, Kubernetes or Terraform labs equally well, and any other catalog that honors the declarative contract. It also scores progress and keeps the history locally, per catalog.

Originally built for the tutorials on blog.stephane-robert.info, and usable without them.

dsoxlab in action: list-labs and show

Install and play, in five minutes

Requires Python 3.11+. Nothing to clone, nothing to build.

uv tool install dsoxlab      # or: pipx install dsoxlab
dsoxlab demo                 # installs a one-lab demonstration catalog
cd ~/.local/share/dsoxlab/demo

dsoxlab course premiers-pas     # the lesson
dsoxlab run premiers-pas        # drops you into the lab's work directory
dsoxlab challenge premiers-pas  # the mission
dsoxlab check premiers-pas      # the tests, and the score

The demonstration lab is about dsoxlab itself, and needs no VM, no container and no Docker: it runs anywhere dsoxlab runs.

Documentation

Three readers, three doors. Every page names its audience in its first lines.

I want to… Read
Install dsoxlab, play labs, understand my score For the learner
Write my own catalog of labs For the catalog author, then the v1 contract field by field
Run the machines the labs need For the trainer
Know where dsoxlab writes on my disk Where dsoxlab writes
See every command Command reference, generated from the CLI

In the terminal, dsoxlab fullhelp prints the whole platform guide, in English or in French.

Why dsoxlab

  • One engine, many catalogs. A single CLI drives every training repository. Add a new domain by writing a meta.yml, not by patching the tool.
  • Validation proves, it does not trust. Labs are graded on the actual state of the system (pytest-testinfra) and, when it matters, on persistence after reboot — the trap that fails RHCSA/LFCS candidates.
  • Two runtimes. A lab runs either in a shell on your own machine, or in a vm provisioned for you. Which backend serves that VM (KVM/libvirt, Incus, Outscale) is the catalog's decision, not the lab's.
  • Progress that sticks, per catalog. Scores, hint costs and history are persisted inside the catalog itself, so two catalogs never mix their histories.
  • Bilingual UX. Every user-facing string ships in English and French (DSOXLAB_LANG=en|fr).

Contributing

git clone https://github.com/stephrobert/dsoxlab.git
cd dsoxlab
uv tool install --editable .

See CONTRIBUTING.md for the development setup, the quality gates and the non-negotiable rules (the engine stays domain-agnostic, every user-facing string goes through _() in both languages).

Security

Security posture is enforced, not aspirational — every workflow is scanned by its own tooling on each push and pull request:

  • Hardened GitHub Actions. Every action is pinned to a full commit SHA, the default token has no permissions (jobs opt into least privilege), and checkout never persists credentials.
  • zizmor statically analyzes the workflows on every PR (ci.yml).
  • Plumber validates the CI/CD against a trust policy (.plumber.yaml) at a 100% compliance threshold, and publishes the score badge (plumber.yml).
  • OpenSSF Scorecard tracks the supply-chain posture (scorecard.yml).
  • PyPI Trusted Publishing (OIDC). Releases carry no long-lived token and ship PEP 740 attestations (release.yml).
  • Pre-commit secret scanning. TruffleHog and private-key detection run locally before every commit (see CONTRIBUTING.md).

To report a vulnerability, follow SECURITY.md.

The mark and its files are documented in docs/brand.md; the name and the logo are not covered by the Apache 2.0 licence.

License & attribution

Licensed under the Apache License 2.0 — see LICENSE and NOTICE.

You may use, share and adapt this project, including commercially, provided you give appropriate credit to Stephane Robert and link back to https://blog.stephane-robert.info, and indicate whether changes were made. Apache-2.0 keeps those same two obligations — attribution and stating your changes — and adds an express patent grant.

Up to and including 0.1.12, dsoxlab was distributed under Creative Commons Attribution 4.0 (CC BY 4.0). That grant is irrevocable, so those releases remain available under CC BY 4.0. From 0.1.13 onwards the project is Apache-2.0: Creative Commons licences are not designed for software, and this one left the patent question open while marking the package as Other/NOASSERTION on PyPI.

© 2026 Stephane Robert.

Project links

Data verified by PyPI on Aug 24, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.84)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for srobert74 from gravatar.com srobert74

Credits

Author: Stéphane Robert

GitHub Statistics

Data verified by PyPI on Aug 24, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.11

Tags

ansible devops education kubernetes labs linux training

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dsoxlab-0.1.66.tar.gz (1.5 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

dsoxlab-0.1.66-py3-none-any.whl (297.3 kB view details)

Uploaded Python 3

File details

Details for the file dsoxlab-0.1.66.tar.gz.

File metadata

  • Download URL: dsoxlab-0.1.66.tar.gz
  • Upload date:
  • Size: 1.5 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dsoxlab-0.1.66.tar.gz
Algorithm Hash digest
SHA256 8aa1210aab97a7b991a14717690ea4e6782a54a5d07c97f6e20649eaf4ab3076
MD5 ccade804d9ccd54676f8cfd52f0699c9
BLAKE2b-256 7ac7494463047ecd874a817633544665256d0187e6ce2147fe4cd4e03414c5e3

See more details on using hashes here.

Provenance

The following attestation bundles were made for dsoxlab-0.1.66.tar.gz:

Publisher: release.yml on stephrobert/dsoxlab

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dsoxlab-0.1.66-py3-none-any.whl.

File metadata

  • Download URL: dsoxlab-0.1.66-py3-none-any.whl
  • Upload date:
  • Size: 297.3 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dsoxlab-0.1.66-py3-none-any.whl
Algorithm Hash digest
SHA256 c3a2e06a3a4d8aeed7e5b28a2a6cc38edecddcf097b98a1045f0e6e4de613cff
MD5 28c5490795b2995318d85225d6b898a7
BLAKE2b-256 62007af19b892ab7af5e6622cf12a679d6baff4c5ec1744734290883d548feb1

See more details on using hashes here.

Provenance

The following attestation bundles were made for dsoxlab-0.1.66-py3-none-any.whl:

Publisher: release.yml on stephrobert/dsoxlab

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.84

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

This release

0.1.66 This release

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.24

2 files

0.1.23

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page