Supported Lab Environments

Tom Labs operates a modular image ecosystem. Whether you are teaching standard web development, setting up complex networking challenges, or hosting CTF (Capture The Flag) competitions, the orchestration engine supports pre-built, instantly deployable Docker containers. Every environment is completely sandboxed and communicates securely through our WireGuard VPN overlay.

Browser-first experience. All standard development labs come pre-installed with VS Code Server. Students can write, execute, and debug code entirely from their browser without downloading any IDEs or configuring SSH keys locally.

Available Images & Environments

The following images are officially supported and maintained within the Tom Labs registry. They can be deployed using the `labsctl build` and `labsctl deploy` commands.

Image Tag	Category	Pre-installed Services	Root Access	VS Code Access
`essentials:lab`	Web Development	PHP, Apache, MySQL, Redis	✅ Yes	✅ Built-in
`node_lts:lab`	Backend / Frontend	Node.js (NVM), Express, MongoDB	✅ Yes	✅ Built-in
`sql_injection:lab`	CTF Challenge	Vulnerable MySQL schema	❌ No (Restricted)	❌ CLI Only
`networking:lab`	DevOps & Routing	Traefik, iptables, Nginx	✅ Yes	✅ Built-in

Known limitations — what Tom Labs won't do

To keep the orchestration engine lightweight and highly secure, Tom Labs enforces specific architectural constraints. If your curriculum depends on the following features natively inside the student sandbox, you may need a bare-metal VPS rather than a Tom Labs container.

Feature	Why / Status	Workaround
Nested Virtualization (e.g., running VirtualBox inside the lab)	⚠ Containers do not support kernel-level virtualization securely.	Use Docker-in-Docker (DinD) flags if container orchestration is required.
Exposed Public Ports	⚠ For security, all labs are hidden behind the WireGuard VPN mesh or routed via Traefik.	Access labs securely via `172.30.0.X` IP addresses once connected to the VPN.
Windows Containers	⚠ Tom Labs orchestrates Linux environments only.	Cross-compile Windows binaries from a Linux environment using MinGW.

Ergonomics & Deployment

Deploying a supported lab is designed to be frictionless for educators. Instead of writing complex Kubernetes manifests, labsctl handles the lifecycle, user provisioning, and VPN routing in one command.

Standard Deployment

# Deploy the essentials lab for a student
$ labsctl deploy essentials:lab --user=sathish --hash=HASH

# 1. Traefik domain dynamically generated
# 2. Virtual IP assigned on 172.30.0.X
# 3. Lab boots up instantly

CTF Challenge Deployment

# Deploy a restricted challenge environment
$ labsctl challenge deploy --user=sathish \
  --hash=HASH --challenge=sql_injection

# Root privileges dropped
# Read-only filesystem flags active