8 homelab projects for your resume: what to build and how to list it

New to this?Ping explains the 3 hardest parts in plain words.

Open all explanations

Time to clean the dust off your old computer, because we've got some homework for you: 8 homelab projects you're going to want experience with to put on your resume.

Proxmox VE is a good place to run them: a virtualization platform with no license cost that's open source under the AGPL and runs both full VMs and lightweight Linux containers on the same machine.

#Why homelab projects work on a resume

ISC2 surveyed 929 cybersecurity hiring managers for its 2025 hiring trends study, and 90% said they'd consider candidates whose only background is previous IT work, while most also run skills tests on entry and junior applicants. A homelab is how you walk into that test having already done the work once, with a story ready when an interviewer asks about a time something broke.

It matters even more without a degree. CompTIA's report on May 2026 job postings found that 72% of tech support roles, and an even larger share of network support roles, didn't require a four-year degree, and our guide on whether you need a degree for IT digs into what the government's data says.

#1. Backups with a restore drill

Almost every IT job touches backups sooner or later, but a backup nobody has restored is only a guess that it works. This project is about removing the guess: back up a server on a schedule, keep a copy on a second machine, then delete the original and bring it back while timing yourself. The restore is the part worth putting on a resume, because it's the part most people skip.

#2. An Active Directory domain

Active Directory is how most companies manage who can log in to what, and resetting passwords, adding people to groups and untangling permissions makes up a big part of help desk and junior sysadmin work. Building a small domain yourself means those tickets won't be the first time you've seen the screens.

1. Install Windows Server 2025 and promote it to a domain controller
2. Join a Windows client VM to the domain and log in with a domain account
3. Create users and role-based groups (HR, IT and Sales, say) and share folders by group
4. Set a password policy and a few Group Policy settings, like a mapped drive
5. Break something on purpose, like a disabled account or a user in the wrong group, then fix it the way a ticket would ask you to

On a resume this reads as Windows Server and Active Directory administration, which is among the first skills worth highlighting when you apply for sysadmin roles, and it gives every later project a realistic network of users and machines to work with.

#3. A SIEM that catches you

A SIEM collects logs from every machine on a network and raises an alert when something looks wrong. Wazuh is a free and open source security platform with SIEM features, made up of 3 central components plus a single agent you install on each machine you want to watch, so you can run the same kind of setup a security team uses without paying for a license.

ELI5: explain it simply▾

Ping explainsNo experience needed.

THE WORDS

SIEM

A tool that gathers logs from many machines in one place and raises alerts when something looks suspicious.

Log

A running record a computer keeps of what happened, like logins, errors and changes.

Agent

A small program installed on each machine that sends its logs back to the SIEM.

THE IDEA

Think of a building's security desk with a screen for every camera. The agents are the cameras, the SIEM is the desk, and an alert is the guard noticing someone trying every door handle. This project has you play the person trying the doors, then sit at the desk and spot yourself.

Working through alerts is day-to-day SOC analyst work. In ISC2's survey of hiring managers, alert and event management was the second most common task given to entry-level cybersecurity staff (35%), behind documentation.

#4. Scan, patch, rescan

Vulnerability management is the loop of finding weaknesses, fixing the worst ones first and proving they're gone, and it's a regular part of security operations and sysadmin work. OpenVAS gives you that loop at home: it's the scanner in Greenbone Community Edition, which Greenbone provides to the public free of charge and which installs on most current Linux systems.

#5. A segmented network

Most companies don't let every device talk to every other device, so guest Wi-Fi, servers and staff laptops sit on separate networks with a firewall deciding what's allowed to cross between them. This project builds that at a small scale, and it lines up directly with network admin and network security roles.

• VLANs and subnets: split the lab into at least 3 networks, such as servers, clients and an untrusted zone, each with its own subnet
• Firewall rules: run a firewall VM like OPNsense or pfSense between them, allow only the traffic each network needs and block the rest
• VPN: add a VPN like WireGuard so you can reach the lab from outside without opening it up to the internet
• A diagram: draw the networks, addresses and rules, since you'll want it for the write-up and the interview

ELI5: explain it simply▾

Ping explainsNo experience needed.

THE WORDS

VLAN

A way to split one physical network into separate virtual networks.

Subnet

A block of IP addresses that belongs to one network.

Firewall rule

An instruction saying which traffic may pass between networks and which gets blocked.

VPN

An encrypted tunnel that lets you join a network from somewhere else.

THE IDEA

Think of an office building where each floor has its own keycard. VLANs are the floors, the firewall is the security desk that decides who can take the elevator between floors, and the VPN is a secure side entrance only you have a key to.

#6. Infrastructure as code

Infrastructure as code means writing your setup down as files a tool can run, so a server gets rebuilt by one command instead of an afternoon of clicking through menus. Pick something you've already built by hand, like the monitoring server from project 7 or a simple web server, and rebuild it from scratch with Ansible or Terraform, keeping every file in Git.

The proof is the rebuild: delete the VM, run the playbook and get the same server back. Treating servers as replaceable like this is the habit DevOps and cloud teams look for, and the Git history shows how your setup changed over time, which gives an interviewer something to scroll through.

Practice infrastructure as code

Write and run infrastructure as code in a simulated terminal in DevOps Pro.

Open ›

#7. Monitoring and alerting

Monitoring is how you find out something broke before a user tells you. Prometheus collects metrics like CPU, memory and free disk space from a small exporter you run on each machine (node_exporter on Linux), Grafana turns them into dashboards, and alerting happens in 2 parts: rules in Prometheus fire alerts, and a separate Alertmanager decides who gets notified and how, whether by email, chat or an on-call system.

Dashboards on their own look nice but prove little, so the resume line here is the alert that fired and what you did about it, which is the kind of on-call thinking DevOps and site reliability teams hire for.

#8. A small Kubernetes cluster

Kubernetes runs containers across a group of machines and keeps them running, restarting or moving them when something fails. Full Kubernetes is heavy for a home lab, but K3s is a lightweight, fully compliant version that ships as a single binary under 100 MB and uses about half the memory, and its own docs list homelab as one of the things it's built for.

ELI5: explain it simply▾

Ping explainsNo experience needed.

THE WORDS

Container

A packaged app with everything it needs to run, lighter than a full virtual machine.

Cluster

A group of machines that work together as one system.

Rolling update

Replacing an app's copies one at a time, so it stays up while the new version goes out.

THE IDEA

Think of a restaurant manager with several cooks. The manager (Kubernetes) decides which cook makes which dish, and if a cook goes home sick, the dishes move to someone else. Changing the menu happens one cook at a time, so the kitchen never closes.

1. Run a K3s cluster across 2 or 3 VMs
2. Deploy a small app with at least 2 copies running
3. Push a new version and watch it roll out without the app going down
4. Point the monitoring from project 7 at the cluster

Kubernetes comes last because it builds on the rest. With the infrastructure as code and monitoring projects alongside it, you have a small version of what a platform team runs, and that combination makes a better interview story than a cluster on its own.

#Bonus: a local AI assistant with DLP controls

This is the most involved project here, so save it for after you've built 2 or 3 of the others. Lots of companies want their staff using AI without customer data ending up in a chatbot, and this project builds both halves of that at home: a private AI assistant, and DLP (data loss prevention) rules that stop sensitive data from reaching it. Ollama runs open models on your own machine on macOS, Windows or Linux and answers on a local API at port 11434, and Open WebUI gives it a ChatGPT-style interface that's self-hosted, can run entirely offline and supports user groups with their own permissions.

In that config, a prompt with a card number gets rejected outright, while emails and names are swapped for placeholders like <PERSON> before the model sees them. LiteLLM's guardrail runs on Microsoft Presidio, a free, MIT-licensed tool that finds things like credit card numbers, names, locations and Social Security numbers using named entity recognition, pattern matching, rules and checksums, and it needs Presidio's analyzer and anonymizer running alongside it.

Rolling out AI without leaking data is a problem security and IT teams are being handed right now, so this project gives you something current to talk about, whether you're aiming at security, sysadmin or AI-focused roles. Use only made-up test data, never real customer or personal information.

#How to put a homelab on your resume

Give the lab its own Projects or Technical Projects section instead of tucking it under hobbies, and move that section above work experience if you're changing careers and your past jobs aren't in IT. Each bullet should lead with an action verb, name the specific tool and say what it solved, and the same lab can be reworded to match each job posting you apply to.

#What to leave off

A media server or game server on its own shows that you can follow a setup guide, which is a fine start but rarely what a posting asks for, so either leave it off or describe the IT work around it, like the reverse proxy, certificates and backups. Skip anything you couldn't explain in detail if asked, and leave out hardware specs and costs unless a tight budget forced a clever solution worth talking about.

#Where to start

Match the projects to the job you want next. For help desk or sysadmin roles, start with the backup drill and the Active Directory domain; for security, add the SIEM and the scan-patch-rescan loop; for networking, build the segmented network; and for DevOps or cloud, infrastructure as code, monitoring and Kubernetes build on each other in that order. The bonus AI project fits on top of any of these, and it's a strong add for security roles.

Certifications and labs work best together: IT and cybersecurity certifications were the attribute ISC2's hiring managers most often called critical (47%, just ahead of IT experience at 44% and relevant education at 43%), and CompTIA's Security+ was among the certs they most often required for entry and junior roles. CertPrep+ has practice for 12 certs from CompTIA, AWS, Microsoft and ISC2, including Network+ and Security+, so you can prep for the one your lab lines up with.

opnF.sh

Hands-on guides from the team that builds the labs you practice in.