Docker

You can run, inspect, stop and remove containers and explain how a container differs from a virtual machine.

1. 1What a container actually isYou can explain why a container starts in milliseconds while a virtual machine takes minutes, in terms of shared kernel versus emulated hardware.12m30xp
2. 2Client, daemon and containerdYou can trace a docker run command from the CLI through the daemon API down to the container runtime.12m30xp
3. 3Running your first containerYou can start a container from a public image and predict whether it will run in the foreground or exit immediately.12m30xp
4. 4Created, running, paused, exitedYou can move a container through every lifecycle state and describe what happens to its filesystem in each one.12m30xp
5. 5Listing and filtering containersYou can find any container on a busy host by status, name, label or exit code.10m25xp
6. 6Reading container logsYou can retrieve the stdout and stderr of a container, including timestamps and only the most recent lines.11m28xp
7. 7Executing commands in a running containerYou can open a shell inside a running container and explain why that process disappears when you exit.11m28xp
8. 8Inspecting container metadataYou can extract a specific field such as IP address, mount source or exit code from a container's JSON metadata.11m28xp
9. 9Restart policiesYou can choose a restart policy that survives a daemon reboot without masking a genuine crash loop.12m30xp
10. 10Cleaning up containers and disk spaceYou can reclaim disk space from stopped containers, dangling images and unused volumes without deleting live data.11m28xp

You can author, build, tag and optimise images and reason about the layer cache.

1. 1Images as stacked layersYou can explain why two images sharing a base occupy far less disk than the sum of their reported sizes.12m30xp
2. 2Copy-on-write and the writable layerYou can predict the performance and persistence consequences of writing large files inside a container's writable layer.11m28xp
3. 3Your first DockerfileYou can write a minimal Dockerfile with FROM, COPY and CMD and build it into a runnable image.13m33xp
4. 4RUN and the build cacheYou can order Dockerfile instructions so a code change does not invalidate the dependency installation layer.13m33xp
5. 5CMD versus ENTRYPOINTYou can choose between CMD and ENTRYPOINT so that runtime arguments either replace or extend the container command.13m33xp
6. 6Shell form, exec form and signalsYou can make a container shut down promptly on SIGTERM instead of waiting for the kill timeout.12m30xp
7. 7ENV and ARGYou can distinguish build-time variables from runtime variables and avoid baking a secret into a layer.12m30xp
8. 8WORKDIR, USER and EXPOSEYou can set a working directory and a non-root runtime user without breaking file permissions.11m28xp
9. 9Tagging and image referencesYou can read a full image reference and explain why the same tag can point to different content over time.11m28xp
10. 10Multi-stage buildsYou can produce a runtime image that contains the compiled artefact but none of the build toolchain.14m35xp
11. 11Choosing a base imageYou can pick between a full distribution, a slim variant, Alpine and distroless based on debuggability and libc requirements.12m30xp
12. 12HEALTHCHECKYou can add a health check that reports unhealthy when the application stops serving, not merely when the process dies.12m30xp

You can keep data alive across container replacement using the right mount type for the job.

1. 1Why container data disappearsYou can demonstrate data loss by recreating a container and explain exactly which layer was discarded.10m25xp
2. 2Named volumesYou can create a named volume and attach it so that data survives removal and recreation of the container.12m30xp
3. 3Bind mountsYou can mount a host directory into a container for live development and predict what happens to files already at that path.12m30xp
4. 4tmpfs mountsYou can place sensitive scratch data in memory so it never touches disk.10m25xp
5. 5The -v shorthand versus --mountYou can express any mount with the explicit --mount syntax and spot the ambiguity in the shorthand form.11m28xp
6. 6Volume ownership and permissionsYou can fix a permission-denied error on a mounted volume when the container runs as a non-root user.12m30xp
7. 7Backing up and restoring volumesYou can produce a portable archive of a volume's contents and restore it into a fresh volume.12m30xp
8. 8Storage driversYou can identify the active storage driver and explain its role in assembling layers into one filesystem.11m28xp

You can connect containers to each other and to the outside world, and debug when they cannot reach one another.

1. 1Network drivers overviewYou can choose between bridge, host, none, overlay and macvlan for a given connectivity requirement.12m30xp
2. 2The default bridge networkYou can explain why containers on the default bridge cannot resolve each other by name.11m28xp
3. 3User-defined bridge networksYou can create a user-defined network so containers resolve each other by container name.12m30xp
4. 4Publishing portsYou can map a host port to a container port and read the direction of a -p mapping correctly.12m30xp
5. 5DNS resolution inside containersYou can diagnose a name resolution failure by checking the container's resolver configuration.11m28xp
6. 6Host and none networking modesYou can decide when removing network isolation is justified and describe the port conflicts it introduces.10m25xp
7. 7Debugging container connectivityYou can locate the cause of a failed connection by checking network membership, listening addresses and firewall rules in order.13m33xp
8. 8Overlay networks across hostsYou can describe how an overlay network carries container traffic between separate hosts using VXLAN encapsulation.12m30xp
9. 9Network segmentation between servicesYou can place a database on a private network so only the application container can reach it.12m30xp

You can declare and operate a multi-service application with Docker Compose.

1. 1Why Compose existsYou can explain what Compose adds over a shell script full of docker run commands.10m25xp
2. 2The Compose file structureYou can write a Compose file defining services, networks and volumes with correct nesting.13m33xp
3. 3Building versus pulling in ComposeYou can make Compose rebuild a service after a source change rather than reusing a stale image.11m28xp
4. 4Service discovery in ComposeYou can connect one service to another using its service name as the hostname.11m28xp
5. 5Startup order and depends_onYou can gate a service's start on another service being genuinely ready, not merely created.12m30xp
6. 6Environment variables and .envYou can supply configuration from an env file and predict which source wins when values conflict.12m30xp
7. 7Volumes in ComposeYou can declare a named volume in Compose and know when docker compose down deletes it.11m28xp
8. 8Scaling servicesYou can run several replicas of a stateless service and explain why a fixed published port blocks scaling.11m28xp
9. 9Override files for dev and prodYou can layer a second Compose file to change settings for one environment without duplicating the base file.12m30xp

You can publish, pull, sign and scan images and manage credentials safely.

1. 1Registries, repositories and manifestsYou can describe what a registry stores and how a pull assembles an image from a manifest.11m28xp
2. 2Authenticating and pushing imagesYou can log in to a registry and push a correctly named image to your own namespace.12m30xp
3. 3Running a private registryYou can push to a self-hosted registry and configure the daemon to trust it.12m30xp
4. 4Pinning by digestYou can pin a deployment to an immutable digest and verify that the pulled content matches.11m28xp
5. 5Multi-architecture imagesYou can explain how one tag serves both amd64 and arm64 clients through a manifest list.12m30xp
6. 6Scanning images for vulnerabilitiesYou can scan an image and prioritise findings by whether the vulnerable package is actually reachable.12m30xp
7. 7SBOM and build provenanceYou can attach a software bill of materials to an image and explain what provenance attestation proves.11m28xp
8. 8Image signing and trustYou can require signature verification so an unsigned or tampered image is refused at pull time.11m28xp

You can constrain what a container may do and how much of the host it may consume.

1. 1Namespaces and cgroups in detailYou can name which namespace provides which isolation and which cgroup controller limits which resource.12m30xp
2. 2Memory limits and OOM killsYou can set a memory limit and recognise an OOM kill from the container's exit code.12m30xp
3. 3CPU limits and sharesYou can distinguish a hard CPU quota from a relative weight and choose the right one under contention.12m30xp
4. 4Dropping root in containersYou can run a container as an unprivileged user and explain why root inside is close to root outside.12m30xp
5. 5Linux capabilitiesYou can drop all capabilities and add back only the specific ones a workload needs.12m30xp
6. 6Privileged mode and its risksYou can articulate exactly what --privileged grants and propose a narrower alternative.11m28xp
7. 7Read-only root filesystemsYou can run a container with an immutable root filesystem plus writable scratch space where needed.11m28xp
8. 8Seccomp and mandatory access controlYou can describe how a seccomp profile blocks dangerous system calls and how to debug a blocked call.12m30xp
9. 9Handling secrets at runtimeYou can deliver a credential to a container without exposing it in image layers, environment listings or process arguments.12m30xp
10. 10Logging drivers and rotationYou can configure log rotation so a chatty container cannot fill the host disk.11m28xp
11. 11Production readiness reviewYou can audit a container specification against limits, health, privilege, logging and persistence before release.13m33xp