config.yml resource types

containersCompute

Docker containers. Lighter and faster than VMs; preferred for workstation hosts.

- name: workstation image: example/shell:latest shell: /bin/bash ports: [5000, 8080] memory: 1024 environment: KEY: value private: true # optional

Note: private: true hides from learners — for backend-only services. entrypoint: bash overrides image default and pairs naturally with shell: /bin/bash.

virtualmachinesCompute

Full Linux or Windows VMs. Required for kernel features, GUIs, nested virtualization.

- name: server image: ubuntu-os-cloud/ubuntu-2404-lts-amd64 machine_type: n2-standard-4 shell: /bin/bash allow_external_ingress: [http, https] nested_virtualization: true provision_ssl_certificate: true

Sizing: default to machine_type: over memory:+cpus:. Canonical sizing knob across most workshop-image families and partner-published custom images.

virtualbrowsersUI

Pre-pointed browser tabs. URL accepts ${_SANDBOX_ID} interpolation, internal hostnames, or external URLs.

- name: console url: https://console.example.com - name: app url: https://server-8080-${_SANDBOX_ID}.env.play.instruqt.com

Pattern: point at a SaaS login page, surface credentials separately via [[ Instruqt-Var ]] in the assignment body.

aws_accountsCloud

Provisioned AWS account. Credentials auto-injected as INSTRUQT_AWS_ACCOUNT_<NAME>_*.

- name: lab services: [ec2, s3, iam] regions: [us-west-2] managed_policies: [arn:...] iam_policy: |- { "Version": "2012-10-17", ... }

Two policies common: learner iam_policy (narrow) plus admin_iam_policy (broad) for setup. secrets: is the BYOC alternative when no provisioned account is needed.

azure_subscriptionsCloud

Provisioned Azure subscription. services: are resource provider namespaces — pre-registered before handoff.

- name: lab services: - Microsoft.Compute - Microsoft.Network - Microsoft.Storage regions: [westus2] roles: [Contributor]

Auto-aliases: on a cloud-client base image, Terraform-style ARM_CLIENT_ID / ARM_CLIENT_SECRET / ARM_TENANT_ID / ARM_SUBSCRIPTION_ID are injected automatically.

gcp_projectsCloud

Provisioned GCP project. services: are API names. SA key arrives base64-encoded.

- name: lab services: - compute.googleapis.com - container.googleapis.com regions: [us-central1] roles: [roles/editor]

Decode pattern: echo $INSTRUQT_GCP_PROJECT_LAB_SERVICE_ACCOUNT_KEY | base64 -d > /tmp/sa.json. Pair with trap “rm -f /tmp/sa.json” EXIT.

secretsCredentials

Named secrets injected as environment variables on every container and VM. Values set in the Instruqt platform UI, never in the source tree.

secrets: - name: GITHUB_TOKEN - name: VAULT_LICENSE - name: API_KEY

Always use this for credentials. Anything in environment: on a resource lives in the source tree forever and appears in the learner’s debug log. SSH keys, API tokens, license keys, registry credentials — all belong here, not in environment: or in lifecycle scripts.