Your Progress
FastAPI DevSecOps Demo: A Production-Ready Microservice from Zero to Deployment
What Makes This Project Different?
❌ Basic Student Project
✅ Production-Ready Project
✗No project structure
✓Professional folder organization
✗No tests
✓Automated test suite with Pytest
✗No input validation
✓Pydantic models for data validation
✗No logging
✓Comprehensive logging system
✗Manual deployment
✓CI/CD with GitHub Actions
✗No security scanning
✓SAST with Semgrep + Trivy
✗Works on my machine
✓Dockerized for consistency
✗No documentation
✓Auto-generated API docs
✗No project structure
✓Professional folder organization
✗No tests
✓Automated test suite with Pytest
✗No input validation
✓Pydantic models for data validation
✗No logging
✓Comprehensive logging system
✗Manual deployment
✓CI/CD with GitHub Actions
✗No security scanning
✓SAST with Semgrep + Trivy
✗Works on my machine
✓Dockerized for consistency
✗No documentation
✓Auto-generated API docs
View Source Code
Explore the complete source code, documentation, and implementation details on GitHub.
View on GitHubTech Stack
Key Concepts Flashcards
Click any card to flip and reveal the definition.
Key Concepts in this Project
DevOps is a way of working where software developers (Dev) and IT/operations teams (Ops) work together to build, test, release, and run software faster and more reliably. DevOps bridges the gap between these teams by introducing automation, continuous integration, continuous deployment, and shared responsibility, allowing applications to be updated frequently while remaining stable and reliable in production.
Real-life example (Instagram-style app)
Who are Developers:
- Build login page
- Create photo upload feature
- Write recommendation logic
What does it mean by Operations:
- Deploy app on cloud
- Ensure app works 24/7
- Scale servers when traffic increases
- Monitor crashes
- Secure user data
Both are equally important.
Phase 0: Repository Setup and Project Structure
What is Phase 0 About?
Phase 0 is about setting up the foundation of your project before writing any code. In this phase, we create the project folder structure, set up version control with Git, and connect it to GitHub. This might seem basic, but doing it right from the start is what separates professional projects from beginner projects.
Why is This Important?
For Your Career: When recruiters look at your GitHub, the first thing they notice is project organization. A messy project with no structure screams "beginner." A well-organized project with proper Git history shows professionalism.
Project Structure
fastapi-devsecops-demo/ ├── app/ # Your application code will go here ├── tests/ # Your test code will go here ├── .github/ │ └── workflows/ # CI/CD automation will go here └── docs/ # Documentation will go here
Key Takeaway
Phase 0 establishes the foundation. Professional projects start with proper structure, version control, and documentation. Your GitHub organization is the first thing recruiters evaluate.
Click the Play button above to start!
Watch the commands execute step by step
Phase 0 Quiz
What is Git?
Phase 1: Build FastAPI Microservice MVP
What is Phase 1 About?
Phase 1 is where we actually start coding! We build a working REST API using FastAPI - a modern Python web framework. But we're not just building "any" API. We're building it the way professional companies do - with proper configuration, data validation, logging, and error handling from day one.
API Comparison
❌ Basic Student Project
✅ Production-Ready Project
✗No input validation
✓Pydantic models validate all input
✗No logging
✓Comprehensive logging system
✗Crashes on errors
✓Graceful error handling
✗No documentation
✓Auto-generated OpenAPI docs
✗No input validation
✓Pydantic models validate all input
✗No logging
✓Comprehensive logging system
✗Crashes on errors
✓Graceful error handling
✗No documentation
✓Auto-generated OpenAPI docs
What We Built
- app/__init__.py - Package Marker
- app/config.py - Configuration & Logging
- app/models.py - Data Models
- app/main.py - The Actual API
- requirements.txt - Dependencies
- Makefile - Helper Commands
Key Takeaway
Phase 1 isn't just "build an API" - it's "build an API the way professionals do." The foundation of validation + logging + error handling is what companies look for.
Click the Play button above to start!
Watch the commands execute step by step
Phase 2: Add Automated Tests with Pytest
What is Phase 2 About?
Phase 2 adds automated testing to your API. Instead of manually testing your endpoints by running curl commands, you write code that tests your code automatically.
Testing Comparison
❌ Basic Student Project
✅ Production-Ready Project
✗Manual testing takes 30+ minutes
✓Automated tests run in seconds
✗Easy to forget test cases
✓Never forgets a test case
✗Inconsistent testing
✓Runs the same way every time
✗No proof code works
✓Documented test coverage
✗Manual testing takes 30+ minutes
✓Automated tests run in seconds
✗Easy to forget test cases
✓Never forgets a test case
✗Inconsistent testing
✓Runs the same way every time
✗No proof code works
✓Documented test coverage
What is Pytest?
Pytest is Python's most popular testing framework. It's:
- Simple - Write tests as regular functions
- Powerful - Fixtures, parameterization, plugins
- Industry standard - Used by almost every Python project
def test_addition():
result = 1 + 1
assert result == 2 # If true, test passes. If false, test fails.Key Takeaway
No tests = No job offer. Every professional software team requires tests before merging code. Automated testing is non-negotiable in production environments.
Click the Play button above to start!
Watch the commands execute step by step
Phase 3: Add Linting and Code Formatting
What is Phase 3 About?
Phase 3 adds automatic code quality checks. Linting finds bugs and bad practices. Formatting ensures consistent code style across the team.
What is Ruff?
Ruff is a modern Python tool that does BOTH linting and formatting:
- Fast - Written in Rust, 10-100x faster than older tools
- All-in-one - Replaces flake8, isort, black, pyupgrade
- Modern - New standard in Python community
Key Takeaway
Linting catches bugs BEFORE you run the code. Formatting makes code consistent without changing what it does. Ruff combines both into one fast tool.
Click the Play button above to start!
Watch the commands execute step by step
Phase 4: Dockerize the Application
What is Phase 4 About?
Phase 4 packages your application into a Docker container - a portable box that includes your app and everything it needs to run.
Docker Comparison
❌ Basic Student Project
✅ Production-Ready Project
✗"Works on my machine" problems
✓Runs the same everywhere
✗Manual dependency installation
✓All dependencies packaged
✗Environment inconsistencies
✓Identical dev and prod environments
✗Complex deployment
✓Single container to deploy
✗"Works on my machine" problems
✓Runs the same everywhere
✗Manual dependency installation
✓All dependencies packaged
✗Environment inconsistencies
✓Identical dev and prod environments
✗Complex deployment
✓Single container to deploy
Dockerfile
FROM python:3.12-slim WORKDIR /app COPY requirements.txt . RUN pip install --no-cache-dir -r requirements.txt COPY app/ ./app/ EXPOSE 8000 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
Key Takeaway
Docker solves the "works on my machine" problem. The same image runs in development AND production with no surprises.
Docker Workflow
A recipe file that contains instructions on how to build the Docker image - what base image to use, what to install, and how to run the app.
Click the Play button above to start!
Watch the commands execute step by step
Phase 4 Quiz
What is a Docker image?
Phase 5: CI/CD with GitHub Actions
What is Phase 5 About?
Phase 5 sets up CI/CD - a system that automatically tests, checks, and builds your code every time you push to GitHub. No more manual checking.
CI/CD Comparison
❌ Basic Student Project
✅ Production-Ready Project
✗Manually run tests
✓Tests run automatically on push
✗Easy to forget steps
✓Same steps every time
✗Slow releases
✓Fast, confident releases
✗Errors reach production
✓Errors caught in pipeline
✗Manually run tests
✓Tests run automatically on push
✗Easy to forget steps
✓Same steps every time
✗Slow releases
✓Fast, confident releases
✗Errors reach production
✓Errors caught in pipeline
CI/CD in One Line
- CI (Continuous Integration) → Automatically test code when it changes
- CD (Continuous Deployment/Delivery) → Automatically deploy code after it passes tests
Key Takeaway
GitHub Actions automates your entire workflow. Push code → tests run → security scans → Docker builds → deployment. All automatic, every time.
CI/CD Pipeline Flow
Developer pushes code changes to GitHub repository, triggering the CI/CD pipeline automatically.
Click the Play button above to start!
Watch the commands execute step by step
Phase 5 Quiz
What does CI stand for?
Phase 6: SAST Security Scanning with Semgrep
What is SAST?
SAST = Static Application Security Testing - analyzes your source code for security vulnerabilities without running the application. Think of it like a spell checker, but for security flaws.
The Cost of Security Bugs
| When Found | Cost to Fix |
|---|---|
| During coding | $100 |
| During code review | $1,000 |
| During testing | $10,000 |
| In production | $100,000+ |
Key Takeaway
Semgrep scans your source code for security vulnerabilities. Finding bugs early saves money and reputation. The Equifax breach cost $1.4 billion - all from a known, unpatched vulnerability.
Click the Play button above to start!
Watch the commands execute step by step
Phase 7: Container Scanning with Trivy
Semgrep vs Trivy
| Semgrep (Phase 6) | Trivy (Phase 7) |
|---|---|
| Scans your source code | Scans your Docker image |
| Finds bugs you wrote | Finds vulnerabilities in dependencies |
| Catches coding mistakes | Catches outdated packages |
Your Code Can Be Perfect, But Still Vulnerable
You write perfect code, but use an old version of FastAPI with a security bug, or a Python library that got hacked. Your app is now vulnerable - even though YOUR code is fine.
Key Takeaway
You need BOTH: Semgrep ensures your code is secure. Trivy ensures your dependencies are secure. The Log4j disaster proved that even perfect code can be vulnerable through dependencies.
Click the Play button above to start!
Watch the commands execute step by step