dsoxlab

dsoxlab — DevSecOps XL Labs CLI

CI OpenSSF Scorecard Plumber compliance License: Apache 2.0 Python Code style: ruff

Read this in another language: Français

dsoxlab turns declarative exercises into reproducible, runnable and verifiable environments. A catalog states what it offers through a root meta.yml and one lab.yaml per lab; the engine provisions what each lab asks for, opens it, and proves the result with tests that read the state of the system rather than the commands typed into it.

Nothing about a specific domain lives in the engine: it serves Linux, Ansible, Kubernetes or Terraform labs equally well, and any other catalog that honors the declarative contract. It also scores progress and keeps the history locally, per catalog.

Originally built for the tutorials on blog.stephane-robert.info, and usable without them.

dsoxlab in action: list-labs and show

Install and play, in five minutes

Requires Python 3.11+. Nothing to clone, nothing to build.

uv tool install dsoxlab      # or: pipx install dsoxlab
dsoxlab demo                 # installs a one-lab demonstration catalog
cd ~/.local/share/dsoxlab/demo

dsoxlab course premiers-pas     # the lesson
dsoxlab run premiers-pas        # drops you into the lab's work directory
dsoxlab challenge premiers-pas  # the mission
dsoxlab check premiers-pas      # the tests, and the score

The demonstration lab is about dsoxlab itself, and needs no VM, no container and no Docker: it runs anywhere dsoxlab runs.

Documentation

Three readers, three doors. Every page names its audience in its first lines.

I want to… Read
Install dsoxlab, play labs, understand my score For the learner
Write my own catalog of labs For the catalog author, then the v1 contract field by field
Run the machines the labs need For the trainer
Know where dsoxlab writes on my disk Where dsoxlab writes
See every command Command reference, generated from the CLI

In the terminal, dsoxlab fullhelp prints the whole platform guide, in English or in French.

Why dsoxlab

  • One engine, many catalogs. A single CLI drives every training repository. Add a new domain by writing a meta.yml, not by patching the tool.
  • Validation proves, it does not trust. Labs are graded on the actual state of the system (pytest-testinfra) and, when it matters, on persistence after reboot — the trap that fails RHCSA/LFCS candidates.
  • Two runtimes. A lab runs either in a shell on your own machine, or in a vm provisioned for you. Which backend serves that VM (KVM/libvirt, Incus, Outscale) is the catalog's decision, not the lab's.
  • Progress that sticks, per catalog. Scores, hint costs and history are persisted inside the catalog itself, so two catalogs never mix their histories.
  • Bilingual UX. Every user-facing string ships in English and French (DSOXLAB_LANG=en|fr).

Contributing

git clone https://github.com/stephrobert/dsoxlab.git
cd dsoxlab
uv tool install --editable .

See CONTRIBUTING.md for the development setup, the quality gates and the non-negotiable rules (the engine stays domain-agnostic, every user-facing string goes through _() in both languages).

Security

Security posture is enforced, not aspirational — every workflow is scanned by its own tooling on each push and pull request:

  • Hardened GitHub Actions. Every action is pinned to a full commit SHA, the default token has no permissions (jobs opt into least privilege), and checkout never persists credentials.
  • zizmor statically analyzes the workflows on every PR (ci.yml).
  • Plumber validates the CI/CD against a trust policy (.plumber.yaml) at a 100% compliance threshold, and publishes the score badge (plumber.yml).
  • OpenSSF Scorecard tracks the supply-chain posture (scorecard.yml).
  • PyPI Trusted Publishing (OIDC). Releases carry no long-lived token and ship PEP 740 attestations (release.yml).
  • Pre-commit secret scanning. TruffleHog and private-key detection run locally before every commit (see CONTRIBUTING.md).

To report a vulnerability, follow SECURITY.md.

The mark and its files are documented in docs/brand.md; the name and the logo are not covered by the Apache 2.0 licence.

License & attribution

Licensed under the Apache License 2.0 — see LICENSE and NOTICE.

You may use, share and adapt this project, including commercially, provided you give appropriate credit to Stephane Robert and link back to https://blog.stephane-robert.info, and indicate whether changes were made. Apache-2.0 keeps those same two obligations — attribution and stating your changes — and adds an express patent grant.

Up to and including 0.1.12, dsoxlab was distributed under Creative Commons Attribution 4.0 (CC BY 4.0). That grant is irrevocable, so those releases remain available under CC BY 4.0. From 0.1.13 onwards the project is Apache-2.0: Creative Commons licences are not designed for software, and this one left the patent question open while marking the package as Other/NOASSERTION on PyPI.

© 2026 Stephane Robert.

Project links

Data verified by PyPI on Aug 24, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.84)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for srobert74 from gravatar.com srobert74

Credits

Author: Stéphane Robert

GitHub Statistics

Data verified by PyPI on Aug 24, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.11

Tags

ansible devops education kubernetes labs linux training

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dsoxlab-0.1.67.tar.gz (1.5 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

dsoxlab-0.1.67-py3-none-any.whl (305.4 kB view details)

Uploaded Python 3

File details

Details for the file dsoxlab-0.1.67.tar.gz.

File metadata

  • Download URL: dsoxlab-0.1.67.tar.gz
  • Upload date:
  • Size: 1.5 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dsoxlab-0.1.67.tar.gz
Algorithm Hash digest
SHA256 e05719a4b07b148849246b96a5dea6cc8c24e2a35da6c529210bdf0d853c2f86
MD5 e01e580f14e1ae68be43174052945c0c
BLAKE2b-256 68192f1cee05605cc72267687b8483e447c245ac1257dd01d8415b92ff2fcb0d

See more details on using hashes here.

Provenance

The following attestation bundles were made for dsoxlab-0.1.67.tar.gz:

Publisher: release.yml on stephrobert/dsoxlab

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dsoxlab-0.1.67-py3-none-any.whl.

File metadata

  • Download URL: dsoxlab-0.1.67-py3-none-any.whl
  • Upload date:
  • Size: 305.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dsoxlab-0.1.67-py3-none-any.whl
Algorithm Hash digest
SHA256 427d4560227e250e795aa1322139dd6f6e8a8d94a92527816beee30f17a24c74
MD5 93a862d09044f65c9e40bd44a07fa7d2
BLAKE2b-256 6b6c07dea646521b14d9fe01120675e94d4ac3efe62918efd43cb26296dad898

See more details on using hashes here.

Provenance

The following attestation bundles were made for dsoxlab-0.1.67-py3-none-any.whl:

Publisher: release.yml on stephrobert/dsoxlab

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.84

2 files

0.1.72

2 files

0.1.71

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

This release

0.1.67 This release

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.24

2 files

0.1.23

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page