# Shared disposable Vault lab

This Compose project supports all runtime chapters. It binds Vault only to
127.0.0.1, stores generated material under ignored learn-vault/.runtime, and
creates no AWS or Kubernetes resources.

Start:

    ./preflight.sh
    ./setup.sh
    source ../../.runtime/learner.env
    ./status.sh

setup.sh is safe to run again. It converges mounts, policies, and roles, then
mints new short-lived learner and AppRole credentials.

Stop and erase:

    ./cleanup.sh

Cleanup removes this Compose project's containers, volumes, and the exact
course runtime directory.

This teaching lab deliberately uses Vault dev mode and loopback HTTP. A real
deployment needs TLS, durable HA storage, controlled initialization and unseal,
audit devices, backups, recovery drills, monitoring, and separate operator
credentials.