Skip to main content
HybridCloudWorks

Learn any cloudLabs

Browser labs

WorkspacesUnknown

Each lab below opens in VS Code in your browser with az, terraform, kubectl, helm and ansible already installed, or runs on your own machine from the same container image. Nothing here installs anything on your computer beyond Docker, and nothing you do in a lab reaches anything else: the workspaces run on the Hybrid Lab host, a single server whose Azure Arc status is on the live card further down this page.

Open lab opens the lab's own page: its objectives and steps, and the workspace in a pane. The first time, you sign in with GitHub in a new tab that brings you back, approve the workspace, and land in the lab folder. Workspaces stop after an hour of inactivity and are limited to one CPU and two gigabytes of memory, so treat them as scratch space and keep anything you want in your own repository.

How labs work

Lab
A structured exercise on this site: what you will learn, what to have ready, the steps in order, and where a check can confirm your work. Each lab is listed under the provider it teaches.
Desktop
The workspace a lab opens in: VS Code in your browser, running in a container on the Hybrid Lab host with the lab’s tools installed and its folder open. You sign in with GitHub, and the workspace stops on its own after an hour of inactivity.
Agent
The job runner on the same host. It takes a file or folder you submit, runs one fixed check on it (a Terraform validate, an Ansible syntax check) in a sandbox with no network, and returns what the tool printed. Nothing you submit is executed against anything.
15-Min ScenariosBrowser TerminalZero Cloud Account Required

GitHub public identity check only (read:user scope). No repository write access.

Pre-Flight Verification

Hybrid Lab Pre-Flight Briefing

Every lab launches an isolated, sandboxed container workspace in your browser. Review duration, toolchains, and security guarantees below.

15-Min ScenariosBrowser TerminalZero Cloud Account Required
Pre-Installed Toolchain (hcw-lab Image)
terraform
IaC Synthesis & Plan Validation
tflint
AVM Rules & Security Linting
ansible-lint
Playbook Syntax & Hardening
docker
Multi-Stage Container Runtime
az
Enterprise Cloud Management
learner@hcw-lab:~/workspace
SANDBOX READY
$ terraform init && tflint --module
✓ Initialized providers: azurerm, aws, google
✓ Linting complete: 0 issues found (AVM policy passed)
$ ansible-playbook --syntax-check site.yml
playbook: site.yml [PASS - syntax verified]
Privacy & Security DisclosureSign-in checks public GitHub organization membership only (read:user scope). We never request repository access, personal emails, or cloud subscription credentials. Container workspaces run isolated and stop automatically after 60 minutes of inactivity.

Pick a lab

AzureAll Azure labs

  • Validate a Landing Zone Builder download

    Take the zip the Landing Zone Builder at /tools/landing-zone hands you, unpack it in the workspace, and run terraform init, fmt and validate against the Azure Verified Modules it declares — the same checks the lab runner applies before anything is planned.

    Intermediateabout 25 minutesToolsterraform, az

    Open lab Validate a Landing Zone Builder download: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

  • WSL2 Container Sandbox for Coding Agents

    Supplementary Linux container simulation (no Windows 11 Azure VM): step into a rootless Linux container workspace that models a WSL2 Ubuntu distribution, inspect Dockerfile.agentic-wslc and /etc/wsl.conf isolation, and validate the Terraform harness offline.

    Intermediateabout 25 minutesToolsaz, terraform

    Open lab WSL2 Container Sandbox for Coding Agents: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

  • Defender for Endpoint WSL2 Plug-in & Hunting Walkthrough

    Supplementary Linux container simulation (no Windows 11 Azure VM): explore how Microsoft Defender for Endpoint monitors WSL2 Linux distributions (`<HostName>-wslc`), inspect simulated healthcheck and EDR telemetry, practise the three Advanced Hunting KQL queries, and validate the Azure policy baseline.

    Intermediateabout 30 minutesToolsaz, terraform

    Open lab Defender for Endpoint WSL2 Plug-in & Hunting Walkthrough: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

AWSAll AWS labs

  • AWS Multi-Account Transit Gateway Walkthrough

    Inspect and validate an enterprise AWS multi-account architecture with AWS Organizations, Service Control Policies, and Transit Gateway routing in an ephemeral container sandbox.

    Intermediateabout 15 minutesToolsterraform

    Open lab AWS Multi-Account Transit Gateway Walkthrough: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

Google CloudAll Google Cloud labs

  • Google Cloud Shared VPC & Org Policies Walkthrough

    Explore and validate Google Cloud Foundation Fabric Resource Manager folders, Organization Policies, and Shared VPC Host networking in a browser container workspace.

    Intermediateabout 15 minutesToolsterraform

    Open lab Google Cloud Shared VPC & Org Policies Walkthrough: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

VMwareAll VMware labs

  • VMware HCX Hybrid Interconnect & Migration Walkthrough

    Inspect and validate VMware Cloud Foundation (VCF) and Azure VMware Solution (AVS) hybrid interconnect topology, L2 stretched network extensions, and HCX migration policies.

    Intermediateabout 20 minutesToolsterraform

    Open lab VMware HCX Hybrid Interconnect & Migration Walkthrough: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

TerraformAll Terraform labs

  • Terraform validate, step by step

    Start from a small root that passes, see what terraform init -backend=false, terraform fmt -check and terraform validate each check, break it three different ways to learn which command catches which mistake, and find out why init works here with no registry at all.

    Introductoryabout 20 minutesToolsterraform

    Open lab Terraform validate, step by step: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

AnsibleAll Ansible labs

  • Ansible syntax check, step by step

    Run ansible-playbook --syntax-check over the playbook that configures the Hybrid Lab host itself, see it fail until the collections it needs are installed, break a play and read what the check reports, and learn what a syntax check is not — with no host in reach and nothing executed.

    Introductoryabout 20 minutesToolsansible

    Open lab Ansible syntax check, step by step: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

DockerAll Docker labs

  • Docker Sandboxes & Agent Containment Walkthrough

    Explore and validate rootless container execution, unprivileged user namespaces, read-only rootfs mounts, and network-isolated local AI agent sandboxes.

    Intermediateabout 15 minutesToolsdocker

    Open lab Docker Sandboxes & Agent Containment Walkthrough: steps, and the workspace; GitHub sign-in required for the workspace
    Run it locally

    Change into the folder that holds your files first; the container mounts it at /workspace. Pick the line for the shell you are in.

    PowerShell
    docker run --rm -it -v ${PWD}:/workspace hybridcloudworks/hcw-lab:latest
    bash
    docker run --rm -it -v "$PWD":/workspace hybridcloudworks/hcw-lab:latest

The Hybrid Lab right now

This card shows what Azure Arc reports for the lab host right now: its connection, its Arc agent and its policy compliance, and whether the lab's job runner is answering.

Reading the lab host status…

Coder status

Coder is where you sign in with GitHub and open a lab workspace. This card shows whether it is up and how many workspaces are running, at most a minute old; your browser does not contact Coder until you open a workspace.

Reading Coder status…

Run an agent against your landing zone

The Docker Sandboxes recipe has its own page in the Docker hub now: Run an agent in a sandbox.

Articles for these labs