To get started with DevSecOps, this page covers the first career stage: the technical foundations to master before tackling any security requirement, and which are also the prerequisites of the DevSecOps course. It is aimed at beginners who can use a terminal but have never administered a server, versioned code as a team or run a container in production. You will find 7 skill blocks (Linux, Git, DevOps culture, containers, scripting, networking, cloud), each described by what you need to be able to do and the guides that teach it, plus a personal project to test what you have learned before the next stage. A career stage is not a level of the course: the programme moves through levels d1 to d4, explained on the course page.
An engineer who masters Linux, Git, containers and DevOps culture can learn any new tool in a few days, because they already understand the underlying mechanisms. Without these foundations, every tool becomes an obstacle to relearn in isolation.
Estimated duration: 60 to 80 hours depending on your starting point.
With these foundations in place, it is time for concrete security requirements: the DevSecOps Socle framework (in French) details 414 of them, from code to cloud, to turn these foundations into auditable evidence. To place DevSecOps in the wider DevOps landscape, the page DevSecOps: security built into development lays down the basic definitions.
What you will learn
- Administer a Debian/Ubuntu or RHEL server in production: users, packages, systemd services, storage, networking, SSH
- Work with Git as a team: branches, merge requests, rebase, hooks, workflows
- Explain DevOps culture and the DORA metrics, and why they matter in practice for a delivery team
- Run an application in Docker containers and compose it with Compose
- Write shell scripts that do not break in production, and use Python for simple automation tasks
- Diagnose a connectivity failure with the right network tools: IP, DNS, ports, TLS
- Place the IaaS/PaaS/SaaS models, the shared responsibility model and the role of IAM before handling a cloud account
Block 1: Linux
Linux is the universal substrate of DevSecOps: containers, CI pipelines, Kubernetes clusters and nearly all production servers run on it. Ignoring Linux means having to guess what happens under each layer of abstraction rather than understanding it.
Goal of this block: be autonomous on a Debian or RHEL server with no graphical interface, able to diagnose a problem without rebooting the machine as a reflex.
The starting point is how the system is organised: the FHS (Filesystem Hierarchy Standard, the convention that puts each type of file in a known directory), processes, permissions and the basic notions, then the structure of a command with its redirections and pipes. Next come the everyday administration tasks: users, groups and sudo, package management with APT and DNF, and service control with systemd.
A server is administered remotely: the SSH client, its keys and its agent must therefore be mastered from this stage. Linux networking and storage with LVM complete the block: they are what you query when a service stops responding or a disk fills up. All of it is taught step by step, with labs, in the Linux course.
Text editors: master at least one of them, it is the tool you use to change a configuration in an emergency on a server with no graphical interface. vim is present on every server, nano is more immediate for a quick intervention.
Data processing commands: they are used every day to analyse logs, configuration files or JSON output without leaving the terminal. grep searches for a pattern, awk splits columns, sed transforms a stream, jq queries JSON, find locates files by precise criteria, and curl queries an HTTP API from the terminal.
Block 2: Git
Git is the starting point of every DevSecOps pipeline: every security scan, every build and every deployment starts from a commit. Mastering team workflows and history is not negotiable, even for a profile aiming at infrastructure rather than development.
Goal of this block: contribute autonomously to a team repository, resolve merge conflicts, understand history and use hooks to automate checks.
The progression starts from the basics (in French) (staging area, commit, history), moves through branches and merging (in French) with conflict resolution, then through advanced operations (in French) such as rebase and cherry-pick that rewrite history cleanly. The hooks (in French) run a check before each commit or push: this is the first automated security building block you will put in place.
Two subjects touch security directly: the choice of a Git platform (in French) (GitHub, GitLab, Gitea, Forgejo) and the storage of credentials (in French) that give access to repositories, over SSH, HTTPS or GPG. The Git course (in French) covers this whole block in order.
Block 3: DevOps culture
Understanding why DevOps exists avoids repeating the same mistakes with different tools. An engineer who knows the Three Ways (the three principles of DevOps: speed up the flow, amplify feedback, learn continuously) and the classic anti-patterns (the bad practices that come back from one team to the next) recognises an organisational silo before it blocks a delivery.
Goal of this block: be able to explain the Three Ways and the DORA metrics, and understand why security fails when it is treated in a silo rather than built into the workflow.
DevOps culture lays down the origin and values of the movement, and the Three Ways and CALMS models give its reading grid. Shift-left explains why testing early costs less, and the DevOps anti-patterns list the traps that make a transformation fail.
The DORA metrics (from the DevOps Research and Assessment research programme: deployment frequency, lead time, change failure rate, time to restore) remain the reference for measuring the performance of a delivery team. The 2024 DORA report added a fifth indicator, the deployment rework rate: the share of deployments that urgently fix a defect already in production. The 2025 report went further by replacing the Elite/High/Medium/Low ranking with seven team profiles, proof that the model keeps evolving. The detail of each metric is covered in the dedicated guide DORA metrics.
Block 4: Containers
Containers have been the standard application delivery format for about ten years. Without mastery of Docker and Compose, you cannot progress in the CI/CD path: nearly all modern pipelines package and test images rather than bare binaries.
Goal of this block: build, run, debug and compose a containerised application, understanding what really happens under the docker run command.
Start with the Docker concepts (in French): images, layers, containers, registries, volumes and networking. After the installation (in French) on Debian, Ubuntu or RHEL, building images (in French) teaches you to write a clean, multi-stage Dockerfile that ships only what the application needs. Docker Compose (in French) then describes an application and its database in a single file, started with one command. The Docker course (in French) covers this block end to end.
Block 5: Scripting
A DevSecOps engineer who cannot script spends their time redoing by hand what should be automated, which makes every intervention slow and error-prone. Shell scripting remains one of the most profitable skills of the foundation: it serves equally well in a CI pipeline and in a production incident at 3 a.m.
Goal of this block: write robust shell scripts, debug pipelines, and use Python for automation when the shell reaches its limits.
Shell scripts lay the basics: variables, conditions, loops, functions and arguments. Robust scripts teach what separates a demo script from a production script: set -euo pipefail, shellcheck, error handling and clean output. When a script grows past a hundred lines or has to handle data structures, Python takes over.
Block 6: Basic networking
Understanding IP, ports, DNS, TLS and firewalls is essential to diagnose connectivity problems in a pipeline or a cluster. Many "it doesn't work" incidents come from a bad DNS resolution, a closed port or an expired certificate rather than from an application bug.
Goal of this block: read a Linux network configuration, diagnose a connectivity failure with the right tools, and understand what happens between a curl request and the server's response.
On the machine side, Linux networking describes interfaces, routes, netplan and NetworkManager, and the ip command is the first-level diagnostic tool (ip addr, ip route, ip link). On the protocol side, the Networking course (in French) covers the OSI model, TCP/IP, DNS, the firewall and TLS, with a diagnostic method.
Block 7: Cloud basics
Even if you are not aiming for a Cloud Engineer job, understanding the core cloud concepts is necessary: IAM (identity and access management), regions, VPC (virtual private network), object storage and virtual machines. These notions come back in most of the following stages, notably security and CI/CD.
Goal of this block: place the IaaS/PaaS/SaaS models, understand the shared responsibility principle, and know what IAM management covers before handling a real cloud account.
The introduction to the cloud (in French) presents the major providers and the shared responsibility model. The XaaS grid (in French) spells out what each service model leaves to you, and the IAM guide (in French) explains who can do what in a cloud account: users, roles and permissions.
Practical deliverable: Foundation project
At the end of this stage, you must be able to complete this personal project: it combines Linux, Git, containers and scripting in one concrete delivery.
No automated check evaluates this project, and the course capstone does not validate it. The notes-api common thread starts in V0 with a test pipeline and assumes Git and Docker are already acquired: it belongs to the next stage, not this one. To know whether you are ready, check that your project runs end to end on a fresh machine.
Key points
- The foundation is not optional: skipping fundamentals you do not master creates gaps that come back in production, often at the worst time.
- Linux and Git are the two base blocks: they are the skills used every day, whatever job you aim for next.
- DevOps culture reads fast (2 to 3 hours) but brings a coherence of reasoning that greatly changes how you approach an incident or a project.
- Containers (Docker) are now the default delivery format: better to master them before tackling Kubernetes.
- Shell scripting is one of the most profitable short-term skills: it eliminates repetitive manual work from the first week.
- The DORA metrics went to five indicators in 2024, then to seven team profiles in 2025: the field keeps taking shape, so you may as well learn the right basics now.
- The personal project (Dockerfile, Compose, pre-commit hook, README) is the test to know whether you are ready for the Operational DevSecOps stage.
- Do not move on to the next stage until this project runs end to end with no manual intervention.