dsoxlab

dsoxlab — DevSecOps XL Labs CLI

CI OpenSSF Scorecard Plumber compliance License: Apache 2.0 Python Code style: ruff

Read this in another language: Français

dsoxlab turns declarative exercises into reproducible, runnable and verifiable environments. A catalog states what it offers through a root meta.yml and one lab.yaml per lab; the engine provisions what each lab asks for, opens it, and proves the result with tests that read the state of the system rather than the commands typed into it.

Nothing about a specific domain lives in the engine: it serves Linux, Ansible, Kubernetes or Terraform labs equally well, and any other catalog that honors the declarative contract. It also scores progress and keeps the history locally, per catalog.

Originally built for the tutorials on blog.stephane-robert.info, and usable without them.

dsoxlab in action: list-labs and show

Install and play, in five minutes

Requires Python 3.11+. Nothing to clone, nothing to build.

uv tool install dsoxlab      # or: pipx install dsoxlab
dsoxlab demo                 # installs a one-lab demonstration catalog
cd ~/.local/share/dsoxlab/demo

dsoxlab course premiers-pas     # the lesson
dsoxlab run premiers-pas        # drops you into the lab's work directory
dsoxlab challenge premiers-pas  # the mission
dsoxlab check premiers-pas      # the tests, and the score

The demonstration lab is about dsoxlab itself, and needs no VM, no container and no Docker: it runs anywhere dsoxlab runs.

Documentation

Three readers, three doors. Every page names its audience in its first lines.

I want to… Read
Install dsoxlab, play labs, understand my score For the learner
Write my own catalog of labs For the catalog author, then the v1 contract field by field
Run the machines the labs need For the trainer
Know where dsoxlab writes on my disk Where dsoxlab writes
See every command Command reference, generated from the CLI

In the terminal, dsoxlab fullhelp prints the whole platform guide, in English or in French.

Why dsoxlab

  • One engine, many catalogs. A single CLI drives every training repository. Add a new domain by writing a meta.yml, not by patching the tool.
  • Validation proves, it does not trust. Labs are graded on the actual state of the system (pytest-testinfra) and, when it matters, on persistence after reboot — the trap that fails RHCSA/LFCS candidates.
  • Two runtimes. A lab runs either in a shell on your own machine, or in a vm provisioned for you. Which backend serves that VM (KVM/libvirt, Incus, Outscale) is the catalog's decision, not the lab's.
  • Progress that sticks, per catalog. Scores, hint costs and history are persisted inside the catalog itself, so two catalogs never mix their histories.
  • Bilingual UX. Every user-facing string ships in English and French (DSOXLAB_LANG=en|fr).

Contributing

git clone https://github.com/stephrobert/dsoxlab.git
cd dsoxlab
uv tool install --editable .

See CONTRIBUTING.md for the development setup, the quality gates and the non-negotiable rules (the engine stays domain-agnostic, every user-facing string goes through _() in both languages).

Security

Security posture is enforced, not aspirational — every workflow is scanned by its own tooling on each push and pull request:

  • Hardened GitHub Actions. Every action is pinned to a full commit SHA, the default token has no permissions (jobs opt into least privilege), and checkout never persists credentials.
  • zizmor statically analyzes the workflows on every PR (ci.yml).
  • Plumber validates the CI/CD against a trust policy (.plumber.yaml) at a 100% compliance threshold, and publishes the score badge (plumber.yml).
  • OpenSSF Scorecard tracks the supply-chain posture (scorecard.yml).
  • PyPI Trusted Publishing (OIDC). Releases carry no long-lived token and ship PEP 740 attestations (release.yml).
  • Pre-commit secret scanning. TruffleHog and private-key detection run locally before every commit (see CONTRIBUTING.md).

To report a vulnerability, follow SECURITY.md.

The mark and its files are documented in docs/brand.md; the name and the logo are not covered by the Apache 2.0 licence.

License & attribution

Licensed under the Apache License 2.0 — see LICENSE and NOTICE.

You may use, share and adapt this project, including commercially, provided you give appropriate credit to Stephane Robert and link back to https://blog.stephane-robert.info, and indicate whether changes were made. Apache-2.0 keeps those same two obligations — attribution and stating your changes — and adds an express patent grant.

Up to and including 0.1.12, dsoxlab was distributed under Creative Commons Attribution 4.0 (CC BY 4.0). That grant is irrevocable, so those releases remain available under CC BY 4.0. From 0.1.13 onwards the project is Apache-2.0: Creative Commons licences are not designed for software, and this one left the patent question open while marking the package as Other/NOASSERTION on PyPI.

© 2026 Stephane Robert.

Project links

Data verified by PyPI on Aug 24, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (0.1.84)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for srobert74 from gravatar.com srobert74

Credits

Author: Stéphane Robert

GitHub Statistics

Data verified by PyPI on Aug 24, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

Apache-2.0
View SPDX License List

Requires

Python >=3.11

Tags

ansible devops education kubernetes labs linux training

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

dsoxlab-0.1.71.tar.gz (1.5 MB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

dsoxlab-0.1.71-py3-none-any.whl (339.2 kB view details)

Uploaded Python 3

File details

Details for the file dsoxlab-0.1.71.tar.gz.

File metadata

  • Download URL: dsoxlab-0.1.71.tar.gz
  • Upload date:
  • Size: 1.5 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dsoxlab-0.1.71.tar.gz
Algorithm Hash digest
SHA256 45bbafb6df953795f67484fb617f3319b6eecf85704a29218f9dbf20072bd578
MD5 0d0a1bf9cc7e22351fc4522e88021af3
BLAKE2b-256 61c4a0c2d4438c30501e4d8b94e9e2280280a6431a2a003feab38dec08b837e0

See more details on using hashes here.

Provenance

The following attestation bundles were made for dsoxlab-0.1.71.tar.gz:

Publisher: release.yml on stephrobert/dsoxlab

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file dsoxlab-0.1.71-py3-none-any.whl.

File metadata

  • Download URL: dsoxlab-0.1.71-py3-none-any.whl
  • Upload date:
  • Size: 339.2 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for dsoxlab-0.1.71-py3-none-any.whl
Algorithm Hash digest
SHA256 f96fe85d6c00c240f8939dbaa6212361bebbbd77eba615a85e618ccb1a2e7a8c
MD5 66a08492f28f2f3597e136ee2ec6f77d
BLAKE2b-256 3d6f2bd49fb503439967e443c375492f6ae9d1f8809665bd85f5a32ca65b435b

See more details on using hashes here.

Provenance

The following attestation bundles were made for dsoxlab-0.1.71-py3-none-any.whl:

Publisher: release.yml on stephrobert/dsoxlab

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

0.1.84

2 files

0.1.72

2 files

This release

0.1.71 This release

2 files

0.1.70

2 files

0.1.69

2 files

0.1.68

2 files

0.1.67

2 files

0.1.66

2 files

0.1.65

2 files

0.1.64

2 files

0.1.63

2 files

0.1.62

2 files

0.1.61

2 files

0.1.60

2 files

0.1.59

2 files

0.1.58

2 files

0.1.57

2 files

0.1.56

2 files

0.1.55

2 files

0.1.54

2 files

0.1.53

2 files

0.1.52

2 files

0.1.51

2 files

0.1.50

2 files

0.1.49

2 files

0.1.48

2 files

0.1.47

2 files

0.1.46

2 files

0.1.45

2 files

0.1.44

2 files

0.1.43

2 files

0.1.42

2 files

0.1.41

2 files

0.1.40

2 files

0.1.39

2 files

0.1.38

2 files

0.1.37

2 files

0.1.36

2 files

0.1.35

2 files

0.1.34

2 files

0.1.33

2 files

0.1.32

2 files

0.1.31

2 files

0.1.30

2 files

0.1.29

2 files

0.1.28

2 files

0.1.27

2 files

0.1.26

2 files

0.1.24

2 files

0.1.23

2 files

0.1.21

2 files

0.1.20

2 files

0.1.19

2 files

0.1.18

2 files

0.1.16

2 files

0.1.15

2 files

0.1.14

2 files

0.1.13

2 files

0.1.12

2 files

0.1.11

2 files

0.1.10

2 files

0.1.9

2 files

0.1.8

2 files

0.1.7

2 files

0.1.6

2 files

0.1.5

2 files

0.1.4

2 files

0.1.3

2 files

0.1.2

2 files

0.1.1

2 files

0.1.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page