# CK-X: a Kubernetes certification simulator in Docker

> CK-X is a practice environment for the CKAD, CKA and CKS certifications that reproduces the shape of the real thing, a web interface, a remote desktop for the candidate, pre-configured clusters, a countdown timer and automatic verification of your solution. It installs with one command, and the licence is the part to read carefully, because it is a Business Source License and not an OSI approved one.

**sailor-sh/CK-X** — A mock exams for CKAD, CKA, and CKS featuring timed sessions and hands-on labs with pre-configured clusters.

- Repository: https://github.com/sailor-sh/CK-X
- Website: https://sailor.sh
- Stars: 1,251 · Forks: 213
- Language: Shell
- License: NOASSERTION
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/sailor-sh-ck-x

## A simulator rather than a question bank

CK-X is described as a powerful Kubernetes certification practice environment that provides a realistic exam-like experience, and the repository description says it is a mock exam environment for CKAD, CKA and CKS with timed sessions and hands-on labs on pre-configured clusters.

The feature list makes the difference from a list of practice questions explicit. There is a realistic exam environment with a web-based interface and remote desktop support, comprehensive practice labs for CKAD, CKA and CKS and other Kubernetes certifications, a smart evaluation system with real-time solution verification, Docker-based deployment for easy setup and a consistent environment, and a timed exam mode with real exam-like conditions and a countdown timer.

That combination is the point. A Kubernetes certification is a hands-on exam, and the skill it tests is operating a cluster under time pressure, not recalling a manifest. A question bank prepares you for the wrong thing, and a cluster on your laptop prepares you for the mechanics without the pressure. This project aims at the middle, which means the candidate drives a real cluster through a browser and a remote desktop while a timer runs and the solution is checked when you finish.

The project is by Sailor.sh, the site is sailor.sh, the licence file in the repository is a Business Source License 1.1, and the only published release is v1.0.0 from 2025-04-05, with the last push on 2026-10-09.

## One line to install, and a manual path when that is not enough

The installation section gives a script for each platform and points at a guide for doing it by hand.

On Linux and macOS:

```bash
curl -fsSL https://raw.githubusercontent.com/sailor-sh/CK-X/master/scripts/install.sh | bash
```

On Windows, with WSL2 enabled in Docker Desktop:

```powershell
irm  https://raw.githubusercontent.com/sailor-sh/CK-X/master/scripts/install.ps1 | iex
```

For detailed installation instructions the README refers you to the Deployment Guide at scripts/COMPOSE-DEPLOY.md, which is the path to take if you want to understand what the script does before it does it, or if you need to install into an environment where piping a remote script into a shell is not acceptable.

The Windows note is a useful one. WSL2 has to be enabled in Docker Desktop because the stack is Linux containers, so the Windows installation is really a Linux installation with a PowerShell wrapper around it.

The repository layout shows what the stack is made of. There is docker-compose.yaml as the deployment definition, compose-deploy.sh as the helper, and then a directory per component: app/ for the web application, remote-desktop/ and remote-terminal/ for the candidate's two views, jumphost/ and kind-cluster/ for the Kubernetes side, facilitator/ for the evaluation side, nginx/ for the reverse proxy, scripts/ for the installers, and docs/ for the guides including the Lab Creation Guide at docs/how-to-add-new-labs.md.

The acknowledgements name the technology the project builds on, DIND for Docker in Docker, K3D for the clusters, Node for the application, Nginx for the proxy, and ConSol's headless VNC container for the remote desktop.

## Only nginx is exposed to users

The compose file is the best documentation of the architecture, because the comments in it explain the intent of each service.

The nginx service is annotated as the only service exposed to users, and the webapp service is annotated as not directly exposed to users, with the port 3000 marked as only exposed to the internal network. The remote-desktop service exposes 5901 for VNC and 6901 for web VNC, both marked internal only.

The remote desktop container is the interesting one. It runs Ubuntu, has a hostname of terminal, and sets shm_size to 512m with the comment that Electron and Firefox share memory through /dev/shm. Its resource limits are one CPU and 2G of memory, with the comment that VSCodium, the Electron editor, needs the extra headroom. It also sets the display resolution with VNC_RESOLUTION=1280x800 and allows interaction with VNC_VIEW_ONLY=false, and it has a healthcheck that curls the web VNC endpoint on localhost.

The webapp container is the interface the candidate sees, and its environment is the wiring between the three components. It is told where the VNC service is with VNC_SERVICE_HOST and VNC_SERVICE_PORT, it is given the VNC password, and it is told where the terminal is with SSH_HOST, SSH_PORT, SSH_USER and SSH_PASSWORD. The SSH credentials are what let the web interface drive the terminal where the candidate actually works.

So the topology is a browser talking to a web application, which talks to a VNC service for the desktop and over SSH to the terminal, with the reverse proxy in front and everything else on a private network called ckx-network.

The consequence for a user is that the exam happens in a browser, the work happens in a remote Linux box, and the grading happens somewhere else entirely, and the parts you interact with are not the parts that hold the cluster.

## The default credentials are in the compose file

The compose file ships default passwords, and anyone deploying this needs to notice them before the stack is reachable.

The remote desktop service sets VNC_PW and VNC_PASSWORD to the same literal value, and VNC_VIEW_ONLY to false, which means the candidate can interact with the desktop rather than only watch it. The webapp service passes the same VNC password through to the interface, and for the terminal it sets SSH_USER=candidate with SSH_PASSWORD=password.

None of this is unusual for a demonstration stack, and the compose file is internal, but the whole point of the nginx service is to be the only thing the outside world can reach, and the web interface exposes a remote desktop and a shell. Defaults that are convenient in a local demo are a different matter on a shared host or a laptop connected to a conference network.

The resources are also worth reading. The webapp service is limited to half a CPU and 512M of memory with reservations of 0.2 CPU and 256M, and the remote desktop gets a full CPU and 2G. That ratio says something about where the time goes, and it also means the stack will not run comfortably on a small machine next to other work.

## The Business Source License is the part to read

The README's licence paragraph is short and specific, and it is not an OSI approved open source licence.

The project is licensed under the Business Source License 1.1, BSL 1.1. Personal, educational, research and non-production use is allowed, but commercial and production usage and SaaS monetization require a separate commercial licence from Sailor.sh. The LICENSE file has the full terms.

This matters for a repository that sits in a list of open source projects, because the BSL is source available rather than open source in the sense the OSI means. The usual pattern for a BSL is that the restricted licences lift after a set period, converting the project to an open source licence, but the exact date and the field of use are in the LICENSE file rather than in the README, so if your organisation has a policy on copyleft, source available or non-OSI licences, that file is the one to read.

The disclaimer carries the same honesty. CK-X is an independent tool, not affiliated with CNCF, the Linux Foundation or PSI, and the project does not guarantee exam success. The Privacy Policy and the Terms of Service are in docs/, and the README says they cover data collection, usage and limitations.

The practical reading for a candidate is straightforward: installing and using it to study is inside the permitted range, and running it as a service for paying users is not.

## Conclusion

Adopt CK-X if you are preparing for a Kubernetes certification and you want the exam mechanics, the timer and the automated checking rather than a bare cluster and a list of questions. Do not adopt it in a commercial or production setting, because the Business Source License requires a separate commercial licence for that, and do not adopt it if you want to run it on a shared machine, since the compose file ships default passwords. Verify first that the licence terms in the LICENSE file match how you intend to use the tool, that the default credentials in docker-compose.yaml are changed before you expose the stack, and that the labs available cover the certification version you are sitting.

## FAQ

### How do I install the CK-X simulator?

On Linux and macOS run curl -fsSL https://raw.githubusercontent.com/sailor-sh/CK-X/master/scripts/install.sh | bash, and on Windows with WSL2 enabled in Docker Desktop run the PowerShell equivalent from scripts/install.ps1. The Deployment Guide in scripts/COMPOSE-DEPLOY.md covers manual installation.

### Which Kubernetes certifications does CK-X cover?

The README lists comprehensive practice labs for CKAD, CKA and CKS, and other Kubernetes certifications, with timed exam mode that provides real exam-like conditions and a countdown timer. The environment runs on pre-configured clusters.

### Can I use CK-X commercially?

Not under the repository licence as it stands. The project is licensed under the Business Source License 1.1, which allows personal, educational, research and non-production use, while commercial and production usage and SaaS monetization require a separate commercial licence from Sailor.sh.

### How is the CK-X environment put together?

The docker-compose.yaml defines a remote-desktop service on a VNC connection, a webapp service on port 3000, and an nginx reverse proxy that is the only service exposed to users. The remote desktop runs Ubuntu with 512m of shared memory for Electron and Firefox, and the webapp is wired to the desktop over VNC and to the terminal over SSH.

## Sources

- [Issues](https://github.com/sailor-sh/CK-X/issues)
- [Project website](https://sailor.sh)
- [README](https://github.com/sailor-sh/CK-X/blob/master/README.md)
- [Releases](https://github.com/sailor-sh/CK-X/releases)
- [sailor-sh/CK-X on GitHub](https://github.com/sailor-sh/CK-X)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/sailor-sh-ck-x