teach.cloudguard.rocks

Teach

Short, hands-on courses that build a real mental model of the systems you already touch — not recipes to copy-paste, but the why underneath. Pick a track and start with Lesson 01.

Track

Kubernetes Web-Hosting

Build a small web-hosting service on a single-node microk8s cluster you fully control — and be able to explain every object in the request path.

  1. 01 Stand up the cluster Create the VM, install microk8s, and point your Mac's kubectl at it — understanding the kubeconfig handshake.
  2. 02 Deploy your first site Put a real website on the cluster and reach it from a browser — tracing Pod → Deployment → Service → Ingress.
  3. 03 Expose with a LoadBalancer (MetalLB) The other front door: give your Pods a real external IP with a type: LoadBalancer Service, using MetalLB.
Glossary ↗ Shared vocabulary every lesson leans on.
Track

MCP Protocol Internals

Wire-level literacy in the Model Context Protocol over Streamable HTTP — drive a real session by hand with curl and name every header, status code, and field.

  1. 01 The Handshake How an MCP session is born over Streamable HTTP — every byte, from a real local trace.
  2. 02 Listing & Calling Tools The two methods the whole agent economy runs on — tools/list and tools/call, on the wire.
  3. 03 HTTP Transport Authentication How a server gates tool access — OAuth 2.1, decoded from a real 401 challenge against a production MCP server.
Cheat Sheet ↗ One-page reference · spec revision 2025-11-25.
Track

Chrome DevTools Protocol

Wire-level literacy in the protocol behind Puppeteer, Playwright, and Chrome's own MCP server — launch a real Chrome, open its debugging socket, and drive it by hand with raw {id, method, params} messages.

  1. 01 Connect & Command Launch Chrome, find a tab over /json, open the WebSocket, and send your first CDP command — every byte from a live trace.
  2. 02 Domains, Commands & Events Enable a domain and watch its events stream — the Network request lifecycle and a console.log, captured live.
  3. 03 Targets & Sessions One WebSocket, many tabs — attach with flatten:true and route every command by a top-level sessionId.
  4. 04 The Bridge: chrome-devtools-mcp Chrome's own MCP server is CDP in an MCP coat — drive it by hand and watch one tools/call move a tab on your raw debugging port.
Cheat Sheet ↗ Discovery, message shapes, core domains & commands.
Track

WebMCP

The browser's tool API for AI agents — the third side of the triangle after MCP and CDP. A web page registers structured tools on document.modelContext; an in-browser agent discovers and calls them. Both points of view, plus the Chrome flag and the recommended inspector extension.

  1. 01 The Third Side of the Triangle Where WebMCP sits next to MCP and CDP — where tools live, who the host is, and both points of view in one diagram.
  2. 02 Website PoV — Register a Tool Call document.modelContext.registerTool field by field — name, description, inputSchema, execute — and unregister with an AbortSignal.
  3. 03 Consumer PoV — Discover & Call Enable chrome://flags/#enable-webmcp-testing, use the Model Context Tool Inspector, and call tools with getTools / executeTool.
Cheat Sheet ↗ Entry point, author & consumer APIs, tooling, and the vs-MCP-vs-CDP table.
Track

BlueField-3 & AI Factory Firewall

The NVIDIA BlueField-3 DPU — the data center's "third socket" — and how Check Point AI Factory Firewall runs on it via DOCA to secure AI factories inline, with zero GPU/CPU impact. Diagram-first, grounded in Check Point docs and SecureKnowledge.

  1. 01 The Third Socket — BlueField-3 Anatomy What a DPU is and why it exists: CPU vs GPU vs DPU, where it sits on the data path, and the parts inside BlueField-3 (Arm, ConnectX-7 400G, accelerators).
  2. 02 DOCA & the Isolation Model How you program the DPU (DOCA), why a guard outside the host resists tampering, and how DOCA Argus sees every host process over direct memory access.
  3. 03 Check Point AI Factory Firewall The integration end to end: two layers (network-inline + host via Argus), the AI-specific threats it stops, and how it's deployed and managed.
Cheat Sheet ↗ DPU specs, DOCA/Argus, the two AIFF layers, and the threat table.
Track

NVIDIA DOCA

The SDK behind BlueField — "CUDA for the network." Its layered architecture, the five-object Core programming model and its libraries, and a precise, honest answer to the question you actually care about: can you enjoy DOCA on a DGX Spark? Diagram-first, grounded in NVIDIA's official docs.

  1. 01 The Layered Stack DOCA's four layers — Core → Libraries → Services/Apps/Tools, plus the DPA subsystem — and where your code sits among them.
  2. 02 Core Objects & the API Model The five DOCA Core objects — device, memory, context, task/event, progress engine — and the universal "submit & poll" loop every library shares.
  3. 03 Can I Enjoy DOCA on DGX Spark? Yes as a DOCA-Host + ConnectX-7 box (incl. GPUNetIO with CPU proxy), no for the BlueField-only half — and exactly why.
Cheat Sheet ↗ Layers, the five Core objects, the libraries, and the DGX Spark verdict.
Track

NVIDIA OpenShell

Run Claude Code, Copilot CLI and OpenCode with more autonomy and less risk. You put them inside NVIDIA's open-source agent sandbox: deny-by-default network, binary-scoped rules, and API keys the agent can't read. Hands-on labs on OpenShell 0.1.x.

  1. 01 Your First Sandboxed Claude Code Gateway, supervisor and sandbox. Build the image, attach a provider, run Claude, then prove the fence: placeholder key, denied curl, logged proposals.
  2. 02 OpenShell and Check Point "Permitted" vs "fits the task": the boundary, Check Point semantic monitoring (beta) at the middleware hook, and AI Defense Plane across the fleet.
Cheat Sheet ↗ Lifecycle, providers per agent, policy sections, and the always-true rules.
Track

Public No-Auth URLs

Expose a local web port to the public internet in seconds — no login wall, no VPN, no custom domain. Write lab-guide steps that just work for everyone in the room, on free tiers only.

  1. 01 A public Codespaces port The zero-install win: turn a port running inside a GitHub Codespace into a public https:// URL anyone can open.
  2. 02 The Cloudflare quick tunnel No account, anywhere: run cloudflared to get an instant public https:// URL to a local port — from any machine.
Cheat Sheet ↗ Three tools for public URLs, side by side.