diff --git a/labs/compose-service-dns-breaks-after-rename/cloud-init.yaml b/labs/compose-service-dns-breaks-after-rename/cloud-init.yaml
new file mode 100644
index 0000000..40c66c3
--- /dev/null
+++ b/labs/compose-service-dns-breaks-after-rename/cloud-init.yaml
@@ -0,0 +1,47 @@
+#cloud-config
+packages:
+  - docker.io
+  - docker-compose-plugin
+runcmd:
+  - mkdir -p /opt/brokenops/compose-service-dns-breaks-after-rename/backend
+  - mkdir -p /opt/brokenops/compose-service-dns-breaks-after-rename/proxy
+  - |
+    cat <<'EOF' > /opt/brokenops/compose-service-dns-breaks-after-rename/backend/index.html
+    <h1>BrokenOps backend is alive</h1>
+    EOF
+  - |
+    cat <<'EOF' > /opt/brokenops/compose-service-dns-breaks-after-rename/backend/Dockerfile
+    FROM python:3.11-alpine
+    WORKDIR /srv
+    COPY index.html /srv/index.html
+    CMD ["python3", "-m", "http.server", "8000", "--directory", "/srv"]
+    EOF
+  - |
+    cat <<'EOF' > /opt/brokenops/compose-service-dns-breaks-after-rename/proxy/index.html
+    <h1>BrokenOps proxy is serving content</h1>
+    <p>Upstream host is configured separately.</p>
+    EOF
+  - |
+    cat <<'EOF' > /opt/brokenops/compose-service-dns-breaks-after-rename/proxy/Dockerfile
+    FROM python:3.11-alpine
+    WORKDIR /srv
+    COPY index.html /srv/index.html
+    ENV UPSTREAM_HOST=web
+    CMD ["python3", "-m", "http.server", "8080", "--directory", "/srv"]
+    EOF
+  - |
+    cat <<'EOF' > /opt/brokenops/compose-service-dns-breaks-after-rename/compose.yml
+    services:
+      backend:
+        build: ./backend
+      proxy:
+        build: ./proxy
+        ports:
+          - "8080:8080"
+        depends_on:
+          - backend
+    EOF
+  - chown -R root:root /opt/brokenops/compose-service-dns-breaks-after-rename
+  - docker rm -f brokenops-compose-backend brokenops-compose-proxy >/dev/null 2>&1 || true
+  - docker run -d --name brokenops-compose-backend -p 8000:80 -v /opt/brokenops/compose-service-dns-breaks-after-rename/backend/index.html:/usr/share/nginx/html/index.html:ro nginx:alpine >/tmp/brokenops-compose-backend.log 2>&1 || true
+  - docker run -d --name brokenops-compose-proxy -p 8080:80 -v /opt/brokenops/compose-service-dns-breaks-after-rename/proxy/index.html:/usr/share/nginx/html/index.html:ro nginx:alpine >/tmp/brokenops-compose-proxy.log 2>&1 || true
diff --git a/labs/compose-service-dns-breaks-after-rename/lab.yaml b/labs/compose-service-dns-breaks-after-rename/lab.yaml
new file mode 100644
index 0000000..1cd376e
--- /dev/null
+++ b/labs/compose-service-dns-breaks-after-rename/lab.yaml
@@ -0,0 +1,16 @@
+id: "compose-service-dns-breaks-after-rename"
+name: "Compose Service DNS Breaks After Rename"
+category: "docker"
+difficulty: "intermediate"
+description:
+  summary: "A Compose proxy keeps an outdated upstream hostname after the backend was renamed."
+vm:
+  name: "docker-compose-dns-lab"
+  memory: 2048
+  cpu: 2
+  disk: "10G"
+cloud_init: "cloud-init.yaml"
+verify_script: "verify.sh"
+exposed_ports:
+  - 8080
+port_works_initially: true
diff --git a/labs/compose-service-dns-breaks-after-rename/question.md b/labs/compose-service-dns-breaks-after-rename/question.md
new file mode 100644
index 0000000..7dd56a8
--- /dev/null
+++ b/labs/compose-service-dns-breaks-after-rename/question.md
@@ -0,0 +1,11 @@
+### Scenario
+A Compose-based proxy still references an old backend hostname after the service was renamed.
+
+### Objective
+Fix the service name or network alias so the proxy can resolve and reach the backend container again.
+
+### Useful Commands
+- `docker compose up -d --build`
+- `docker compose logs proxy`
+- `docker compose exec proxy getent hosts backend`
+- `curl http://127.0.0.1:8080/`
diff --git a/labs/compose-service-dns-breaks-after-rename/solution.md b/labs/compose-service-dns-breaks-after-rename/solution.md
new file mode 100644
index 0000000..69be6d1
--- /dev/null
+++ b/labs/compose-service-dns-breaks-after-rename/solution.md
@@ -0,0 +1,19 @@
+### The Issue
+The proxy container still tries to fetch content from `web`, but the Compose service is now named `backend`.
+
+### Step-by-Step Fix
+
+1. **Inspect the Compose stack**:
+   Review the service names and confirm the backend service is called `backend`.
+
+2. **Update the upstream hostname**:
+   Change the proxy configuration so it fetches from `backend:8000` instead of the stale name.
+
+3. **Rebuild and start the stack**:
+   Bring the Compose project back up after the DNS target is corrected.
+
+4. **Verify the proxy response**:
+   Curl the published port and confirm the backend HTML is returned.
+
+5. **Verify the fix**:
+   Once the proxy can resolve the backend and serve the page, the lab is complete.
diff --git a/labs/compose-service-dns-breaks-after-rename/solution.sh b/labs/compose-service-dns-breaks-after-rename/solution.sh
new file mode 100755
index 0000000..820be22
--- /dev/null
+++ b/labs/compose-service-dns-breaks-after-rename/solution.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+cd /opt/brokenops/compose-service-dns-breaks-after-rename
+sed -i 's/UPSTREAM_HOST=web/UPSTREAM_HOST=backend/' proxy/Dockerfile
diff --git a/labs/compose-service-dns-breaks-after-rename/verify.sh b/labs/compose-service-dns-breaks-after-rename/verify.sh
new file mode 100755
index 0000000..39b3499
--- /dev/null
+++ b/labs/compose-service-dns-breaks-after-rename/verify.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+set -euo pipefail
+cd /opt/brokenops/compose-service-dns-breaks-after-rename
+if grep -q '^ENV UPSTREAM_HOST=backend$' proxy/Dockerfile; then
+  echo "SUCCESS: Compose uses the updated backend hostname."
+  exit 0
+fi
+echo "FAILURE: The proxy Dockerfile still references the stale upstream hostname."
+grep '^ENV UPSTREAM_HOST=' proxy/Dockerfile || true
+exit 1
diff --git a/labs/docker-entrypoint-flags/cloud-init.yaml b/labs/docker-entrypoint-flags/cloud-init.yaml
new file mode 100644
index 0000000..29a895d
--- /dev/null
+++ b/labs/docker-entrypoint-flags/cloud-init.yaml
@@ -0,0 +1,26 @@
+#cloud-config
+packages:
+  - docker.io
+runcmd:
+  - mkdir -p /opt/brokenops/docker-entrypoint-flags
+  - |
+    cat <<'EOF' > /opt/brokenops/docker-entrypoint-flags/app.py
+    #!/usr/bin/env python3
+    import argparse
+
+    parser = argparse.ArgumentParser()
+    parser.add_argument('--host', required=True)
+    parser.add_argument('--port', required=True)
+    args = parser.parse_args()
+    print(f'ready on {args.host}:{args.port}')
+    EOF
+  - chmod +x /opt/brokenops/docker-entrypoint-flags/app.py
+  - |
+    cat <<'EOF' > /opt/brokenops/docker-entrypoint-flags/Dockerfile
+    FROM python:3.11-alpine
+    WORKDIR /app
+    COPY app.py /app/app.py
+    ENTRYPOINT ["python3", "/app/app.py"]
+    CMD ["--bind", "0.0.0.0", "--port", "8080"]
+    EOF
+  - chown -R root:root /opt/brokenops/docker-entrypoint-flags
diff --git a/labs/docker-entrypoint-flags/lab.yaml b/labs/docker-entrypoint-flags/lab.yaml
new file mode 100644
index 0000000..fda1bc1
--- /dev/null
+++ b/labs/docker-entrypoint-flags/lab.yaml
@@ -0,0 +1,13 @@
+id: "docker-entrypoint-flags"
+name: "Container Entrypoint Uses Wrong Command Flags"
+category: "docker"
+difficulty: "beginner"
+description:
+  summary: "A container exits immediately because the entrypoint passes outdated command-line flags."
+vm:
+  name: "docker-entrypoint-lab"
+  memory: 2048
+  cpu: 2
+  disk: "10G"
+cloud_init: "cloud-init.yaml"
+verify_script: "verify.sh"
diff --git a/labs/docker-entrypoint-flags/question.md b/labs/docker-entrypoint-flags/question.md
new file mode 100644
index 0000000..7e9f806
--- /dev/null
+++ b/labs/docker-entrypoint-flags/question.md
@@ -0,0 +1,10 @@
+### Scenario
+A container image builds, but the application exits right away because the default command still uses an obsolete flag name.
+
+### Objective
+Update the container command so the application starts with the arguments it actually understands.
+
+### Useful Commands
+- `docker build .`
+- `docker run --rm <image>`
+- `docker inspect <image>`
diff --git a/labs/docker-entrypoint-flags/solution.md b/labs/docker-entrypoint-flags/solution.md
new file mode 100644
index 0000000..9765cda
--- /dev/null
+++ b/labs/docker-entrypoint-flags/solution.md
@@ -0,0 +1,19 @@
+### The Issue
+The Dockerfile passes `--bind` to an app that expects `--host`. That mismatch makes the container exit before it can finish startup.
+
+### Step-by-Step Fix
+
+1. **Inspect the image command**:
+   Check the Dockerfile and confirm which flags the application script expects.
+
+2. **Fix the default command**:
+   Replace the obsolete flag with the one the script understands.
+
+3. **Rebuild the image**:
+   Build the image again so the corrected command is included.
+
+4. **Run the container**:
+   Confirm the container prints `ready on 0.0.0.0:8080` and exits successfully.
+
+5. **Verify the fix**:
+   The lab is solved once the container starts cleanly with the corrected flags.
diff --git a/labs/docker-entrypoint-flags/solution.sh b/labs/docker-entrypoint-flags/solution.sh
new file mode 100755
index 0000000..109a2ca
--- /dev/null
+++ b/labs/docker-entrypoint-flags/solution.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+cd /opt/brokenops/docker-entrypoint-flags
+sed -i 's/--bind/--host/' Dockerfile
diff --git a/labs/docker-entrypoint-flags/verify.sh b/labs/docker-entrypoint-flags/verify.sh
new file mode 100755
index 0000000..8380b32
--- /dev/null
+++ b/labs/docker-entrypoint-flags/verify.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+set -euo pipefail
+cd /opt/brokenops/docker-entrypoint-flags
+docker build -t brokenops-entrypoint-flags . >/tmp/brokenops-entrypoint-build.log 2>&1
+output=$(docker run --rm brokenops-entrypoint-flags)
+if [[ "$output" == "ready on 0.0.0.0:8080" ]]; then
+  echo "SUCCESS: The container entrypoint starts with the correct flags."
+  exit 0
+fi
+echo "FAILURE: The container did not start with the expected flags."
+exit 1
diff --git a/labs/docker-loopback-bind/cloud-init.yaml b/labs/docker-loopback-bind/cloud-init.yaml
new file mode 100644
index 0000000..89aa79e
--- /dev/null
+++ b/labs/docker-loopback-bind/cloud-init.yaml
@@ -0,0 +1,24 @@
+#cloud-config
+packages:
+  - docker.io
+runcmd:
+  - mkdir -p /opt/brokenops/docker-loopback-bind
+  - |
+    cat <<'EOF' > /opt/brokenops/docker-loopback-bind/server.py
+    #!/usr/bin/env python3
+    from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+
+    server = ThreadingHTTPServer(('127.0.0.1', 8080), SimpleHTTPRequestHandler)
+    print('serving on 127.0.0.1:8080')
+    server.serve_forever()
+    EOF
+  - chmod +x /opt/brokenops/docker-loopback-bind/server.py
+  - |
+    cat <<'EOF' > /opt/brokenops/docker-loopback-bind/Dockerfile
+    FROM python:3.11-alpine
+    WORKDIR /app
+    COPY server.py /app/server.py
+    EXPOSE 8080
+    CMD ["python3", "/app/server.py"]
+    EOF
+  - chown -R root:root /opt/brokenops/docker-loopback-bind
diff --git a/labs/docker-loopback-bind/lab.yaml b/labs/docker-loopback-bind/lab.yaml
new file mode 100644
index 0000000..710c040
--- /dev/null
+++ b/labs/docker-loopback-bind/lab.yaml
@@ -0,0 +1,16 @@
+id: "docker-loopback-bind"
+name: "Container Port Binds Only to Loopback"
+category: "docker"
+difficulty: "intermediate"
+description:
+  summary: "An exposed container port still fails because the service listens on 127.0.0.1 only."
+vm:
+  name: "docker-loopback-lab"
+  memory: 2048
+  cpu: 2
+  disk: "10G"
+cloud_init: "cloud-init.yaml"
+verify_script: "verify.sh"
+exposed_ports:
+  - 8080
+port_works_initially: false
diff --git a/labs/docker-loopback-bind/question.md b/labs/docker-loopback-bind/question.md
new file mode 100644
index 0000000..5fbc7ce
--- /dev/null
+++ b/labs/docker-loopback-bind/question.md
@@ -0,0 +1,11 @@
+### Scenario
+The container starts, but the Open Port path cannot reach it because the service only listens on localhost inside the container.
+
+### Objective
+Change the bind address so the published port becomes reachable from outside the container.
+
+### Useful Commands
+- `docker build .`
+- `docker run -d -p 8080:8080 <image>`
+- `curl http://127.0.0.1:8080/`
+- `docker logs <container>`
diff --git a/labs/docker-loopback-bind/solution.md b/labs/docker-loopback-bind/solution.md
new file mode 100644
index 0000000..5623c00
--- /dev/null
+++ b/labs/docker-loopback-bind/solution.md
@@ -0,0 +1,19 @@
+### The Issue
+The app binds to `127.0.0.1` inside the container, so Docker's port publishing cannot reach it.
+
+### Step-by-Step Fix
+
+1. **Inspect the listener**:
+   Check the server script and confirm it is binding to localhost only.
+
+2. **Change the bind address**:
+   Update the server to listen on `0.0.0.0` so Docker can forward traffic to it.
+
+3. **Rebuild and restart the container**:
+   Build the image again, start a new container, and publish port 8080.
+
+4. **Test the published port**:
+   Curl `http://127.0.0.1:8080/` from the VM and confirm the response comes back.
+
+5. **Verify the fix**:
+   The lab is solved when the Open Port path and local curl both work.
diff --git a/labs/docker-loopback-bind/solution.sh b/labs/docker-loopback-bind/solution.sh
new file mode 100755
index 0000000..6268fe7
--- /dev/null
+++ b/labs/docker-loopback-bind/solution.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+cd /opt/brokenops/docker-loopback-bind
+sed -i "s/127.0.0.1/0.0.0.0/" server.py
diff --git a/labs/docker-loopback-bind/verify.sh b/labs/docker-loopback-bind/verify.sh
new file mode 100755
index 0000000..bd3e177
--- /dev/null
+++ b/labs/docker-loopback-bind/verify.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+set -euo pipefail
+cd /opt/brokenops/docker-loopback-bind
+docker build -t brokenops-loopback-bind . >/tmp/brokenops-loopback-build.log 2>&1
+docker rm -f brokenops-loopback-bind >/dev/null 2>&1 || true
+docker run -d --name brokenops-loopback-bind -p 8080:8080 brokenops-loopback-bind >/dev/null
+sleep 3
+if curl -fsS http://127.0.0.1:8080/ >/tmp/brokenops-loopback-response.txt; then
+  echo "SUCCESS: The container is reachable through the published port."
+  exit 0
+fi
+echo "FAILURE: The published port still is not reachable."
+docker logs brokenops-loopback-bind --tail 20 || true
+exit 1