CI/CD and Containers

Programme overview

In June 2026, Tallybook replaced deployments by hand with a container pipeline. In this course you take that pipeline apart and measure what it changed. You'll calculate the four DORA measures before and after, read Tallybook's original Dockerfile and write a checker that finds its six problems (including the production database password baked into the image), compare base images by size, build time and vulnerability scans, and load the old GitHub Actions workflow as data to find the six gaps that let any branch deploy to production with a third-party action holding the deploy key. Then you'll measure where pipeline time goes and what caching saved, test the canary rule against every release since June, and compare rolling back with fixing forward. Every number comes from running the code on the course's data.

Curriculum

1. 01Why CI/CD15 min

   • Why CI/CDWhat continuous integration and continuous delivery are, the four DORA measures of software delivery, and how they changed when Tallybook replaced manual deployments with a pipeline.
2. 02Containers and Images15 min

   • Containers and imagesWhat containers and images are and why pipelines build them, how a Dockerfile's instructions become image layers, and what the choice of base image does to size and build time.
3. 03Better Dockerfiles25 min

   • Better DockerfilesCheck a Dockerfile against the rules that matter (pinned base images, cache-friendly order, no secrets, a non-root user, small runtime images) with a small linter you write yourself, then rewrite Tallybook's as a multi-stage build.
4. 04Image Vulnerabilities25 min

   • Image vulnerabilitiesRead container vulnerability scan reports, separate problems in the base image from problems in your own dependencies, and set a scanning rule the pipeline can enforce without blocking every release.
5. 05Pipelines as Code15 min

   • Pipelines as codeRead a CI/CD pipeline defined in YAML (triggers, jobs, steps, dependencies and secrets), load it as data, and map how Tallybook's old GitHub Actions workflow actually ran.
6. 06Securing the Pipeline25 min

   • Securing the pipelineReview a deployment pipeline for the mistakes that let untested or malicious code reach production (broad triggers, missing dependencies, excessive permissions, unpinned third-party actions and leaked secrets), and write the fixed workflow.
7. 07Faster Pipelines15 min

   • Faster pipelinesMeasure where a pipeline's time goes, step by step, see what dependency and image-layer caching saved, and find what to speed up next.
8. 08Canary Releases25 min

   • Canary releasesCompare deployment strategies (all at once, rolling, blue-green and canary), analyse canary checks that compare a new version's errors with the old one's, and tune the rule that decides whether to promote or roll back.
9. 09Rollbacks and Recovery20 min

   • Rollbacks and recoveryCompare rolling back with fixing forward, measure time to restore under the old and new processes, and design releases (feature flags, backwards-compatible changes) that make recovery fast.
10. 10Final Project20 min

    • Final project: Tallybook's delivery reviewPlan your final project, a review of how Tallybook builds, secures and releases software, with DORA measures, fixed Dockerfile and workflow, scanning and canary policies, and the next improvements.

Assessment and certificate

You are assessed with a final assessment (pass mark 60%) and a final project. Your certificate is awarded when you meet those requirements. Paying for the programme does not award it on its own.