Docker — From Zero to Production

You can explain what problem containers solve, how they differ from virtual machines, and when a container is the wrong answer.

1. The works-on-my-machine problem1 hr
   • environment drift
   • dependency hell
   • undeclared dependencies
   • onboarding cost
   • reproducibility
2. Virtual machines versus containers1 hr
   • hypervisor model
   • shared kernel
   • boot time
   • resource overhead
   • isolation strength
3. Where containers are the wrong tool1 hr
   • stateful legacy apps
   • GUI desktop software
   • kernel modules
   • hard real-time
   • licensing limits
4. The container ecosystem and standards1 hr
   • OCI image spec
   • OCI runtime spec
   • containerd
   • runc
   • Docker's place in it
5. Installing Docker and first run1 hr
   • Docker Desktop
   • Engine on Linux
   • rootless mode
   • hello-world
   • daemon check
6. The vocabulary, used precisely1 hr
   • image vs container
   • registry vs repository
   • tag vs digest
   • engine vs runtime
   • orchestrator

Hands-on project: Take an application that only runs on one developer's laptop, document every undeclared dependency, and write the case for containerising it.

You can explain what a container actually is at the kernel level, which is what lets you debug one when it misbehaves.

1. Namespaces: the isolation primitive1 hr
   • PID namespace
   • network namespace
   • mount namespace
   • UTS and IPC
   • user namespace
2. Control groups and resource limits1 hr
   • cgroup v2
   • CPU quota
   • memory limits
   • IO throttling
   • pid limits
3. Union filesystems and copy-on-write1 hr
   • overlayfs
   • lower and upper layers
   • copy-on-write
   • whiteout files
   • storage drivers
4. Capabilities and the root question1 hr
   • Linux capabilities
   • dropping capabilities
   • setuid binaries
   • rootless containers
   • user remapping
5. Building a container by hand1 hr
   • unshare
   • chroot and pivot_root
   • cgroup assignment
   • network setup
   • what Docker automates
6. Seccomp, AppArmor and SELinux1 hr
   • syscall filtering
   • default profiles
   • custom profiles
   • denial debugging
   • hardening trade-offs

Hands-on project: Build a minimal container by hand using namespaces and cgroups, with no Docker involved, and document what each step isolates.

You can describe what happens between typing docker run and a process starting, and use that to diagnose a container that will not start.

1. Client, daemon and the API1 hr
   • Docker CLI
   • dockerd
   • REST API
   • containerd handoff
   • socket security
2. The container lifecycle1 hr
   • created
   • running
   • paused
   • stopped
   • removed
3. Running containers: the flags that matter1 hr
   • detached mode
   • interactive tty
   • restart policies
   • entrypoint override
   • environment variables
4. PID 1, signals and graceful shutdown1 hr
   • PID 1 responsibilities
   • signal handling
   • zombie reaping
   • init processes
   • stop timeout
5. Inspecting and debugging a running container1 hr
   • docker inspect
   • exec vs attach
   • logs and drivers
   • events stream
   • stats
6. Exit codes and what they tell you1 hr
   • exit 0
   • exit 1 application error
   • exit 125 126 127
   • exit 137 OOM kill
   • exit 143 SIGTERM

Hands-on project: Diagnose five containers that fail to start for five different reasons, documenting the signal that identified each.

You can read an image's layer history and explain why a build took four minutes when it should have taken four seconds.

1. Image anatomy and layer stacking1 hr
   • manifest
   • config blob
   • layer digests
   • content addressing
   • image ID vs tag
2. How the build cache decides1 hr
   • cache key rules
   • instruction order
   • COPY invalidation
   • ARG effects
   • cache busting
3. Build context and dockerignore1 hr
   • context transfer cost
   • dockerignore patterns
   • accidental secret inclusion
   • large file traps
   • context size
4. Inspecting layers and finding bloat1 hr
   • docker history
   • dive tool
   • layer size attribution
   • deleted-but-present files
   • squashing myths
5. BuildKit and modern build features1 hr
   • BuildKit enablement
   • parallel stages
   • cache mounts
   • secret mounts
   • SSH forwarding
6. Reproducible builds1 hr
   • pinned base digests
   • deterministic ordering
   • build timestamps
   • dependency lockfiles
   • verification

Hands-on project: Take a slow, bloated build and cut both build time and image size by at least seventy percent, documenting each change's effect.

You can write a Dockerfile another engineer can read, that builds fast, and that does not run your application as root.

1. Instruction reference and ordering1 hr
   • FROM
   • RUN and layer cost
   • COPY vs ADD
   • WORKDIR
   • shell vs exec form
2. ENTRYPOINT and CMD together1 hr
   • entrypoint semantics
   • CMD as arguments
   • override behaviour
   • exec form necessity
   • wrapper scripts
3. Users, permissions and non-root1 hr
   • USER instruction
   • uid selection
   • file ownership
   • writable paths
   • rootless compatibility
4. Health checks and readiness1 hr
   • HEALTHCHECK syntax
   • interval and retries
   • start period
   • orchestrator integration
   • failing correctly
5. Build arguments and environment variables1 hr
   • ARG scope
   • ENV persistence
   • defaults
   • secrets must not be ARGs
   • precedence
6. Language-specific patterns1 hr
   • Node dependency caching
   • Python wheels and venv
   • Go static binaries
   • JVM layering
   • frontend asset builds

Hands-on project: Write production Dockerfiles for a Node service, a Python service and a Go binary, each non-root with a health check and a pinned base.

You can ship an image containing your application and nothing else, and explain the attack surface you removed.

1. Multi-stage build mechanics1 hr
   • named stages
   • COPY from stage
   • target builds
   • external stage sources
   • stage parallelism
2. Choosing a base image1 hr
   • full distro
   • slim variants
   • Alpine and musl caveats
   • distroless
   • scratch
3. Static binaries and scratch images1 hr
   • static linking
   • CA certificates
   • timezone data
   • user entries
   • debugging without a shell
4. Multi-architecture builds1 hr
   • buildx
   • platform flags
   • emulation cost
   • manifest lists
   • arm64 parity
5. Measuring what you removed1 hr
   • size comparison
   • package count
   • CVE count delta
   • attack surface
   • startup time
6. Build targets for dev, test and production1 hr
   • target stages
   • test stage in CI
   • dev stage with tooling
   • shared base stage
   • one Dockerfile many outputs

Hands-on project: Reduce a 1.2 GB image to under 60 MB using multi-stage builds and a distroless base, with the application still fully functional.

You can explain how a container reaches the internet and how two containers reach each other, and fix it when they cannot.

1. Network drivers and when each applies1 hr
   • bridge
   • host
   • none
   • overlay
   • macvlan
2. The default bridge and user-defined networks1 hr
   • embedded DNS
   • container name resolution
   • network isolation
   • legacy links
   • subnet configuration
3. Port publishing and NAT1 hr
   • publish syntax
   • host port binding
   • iptables rules
   • localhost vs 0.0.0.0
   • port conflicts
4. Service discovery between containers1 hr
   • DNS-based discovery
   • aliases
   • multiple networks
   • connection retries
   • startup ordering
5. Diagnosing container network failures1 hr
   • exec and curl
   • nsenter
   • tcpdump in a namespace
   • DNS resolution checks
   • firewall interference
6. Reverse proxies and ingress1 hr
   • NGINX as a front door
   • Traefik dynamic config
   • TLS termination
   • host routing
   • upstream health

Hands-on project: Build a three-tier application across isolated networks where the database is unreachable from outside, and prove the isolation.

You can keep data alive across container restarts and upgrades, and take a backup you have actually tested restoring.

1. Why container filesystems are ephemeral1 hr
   • writable layer
   • data loss on removal
   • copy-on-write cost
   • anti-patterns
   • when ephemeral is fine
2. Named volumes versus bind mounts1 hr
   • volume lifecycle
   • bind mount semantics
   • permission mismatches
   • SELinux labels
   • development workflow
3. Volume drivers and remote storage1 hr
   • local driver
   • NFS volumes
   • cloud volume plugins
   • performance characteristics
   • portability
4. Running stateful services in containers1 hr
   • database containers
   • write durability
   • fsync behaviour
   • upgrade procedure
   • when not to
5. Backup, restore and migration1 hr
   • volume backup patterns
   • consistent snapshots
   • restore rehearsal
   • cross-host migration
   • retention
6. tmpfs mounts and in-memory storage1 hr
   • tmpfs mount syntax
   • size limits
   • secrets in tmpfs
   • read-only root companion
   • performance effect

Hands-on project: Run a database in a container with a named volume, perform a backup, destroy everything, and restore from the backup.

You can describe a whole application stack in one file that a new developer can start with a single command.

1. Compose file structure and versioning1 hr
   • services
   • networks
   • volumes
   • the version field today
   • compose spec
2. Dependencies and startup ordering1 hr
   • depends_on
   • condition service_healthy
   • wait-for patterns
   • restart policies
   • race conditions
3. Environment, env files and overrides1 hr
   • environment vs env_file
   • variable substitution
   • override files
   • profiles
   • precedence rules
4. Development workflow with Compose1 hr
   • bind mounts for hot reload
   • watch mode
   • debugger attachment
   • seed data
   • teardown
5. Scaling and resource constraints1 hr
   • scale flag
   • deploy resources
   • cpu and memory limits
   • port conflicts on scale
   • load balancing
6. Compose in CI and production caveats1 hr
   • CI usage
   • single-host limits
   • when to move to orchestration
   • secret handling
   • config drift

Hands-on project: Write a Compose stack for a five-service application with health-gated startup ordering, profiles and environment overrides.

You can produce an image that passes a security scan and explain each remaining finding rather than ignoring it.

1. Common image vulnerabilities1 hr
   • outdated base packages
   • embedded secrets
   • running as root
   • unnecessary tooling
   • world-writable paths
2. Scanning with Trivy and friends1 hr
   • image scanning
   • severity triage
   • false positives
   • ignore files
   • CI gating
3. Secrets: what never goes in an image1 hr
   • layer history exposure
   • build secrets
   • runtime injection
   • secret stores
   • rotation
4. Runtime hardening flags1 hr
   • read-only root
   • no-new-privileges
   • dropped capabilities
   • tmpfs mounts
   • user namespaces
5. Supply chain: SBOMs, signing and provenance1 hr
   • SBOM generation
   • image signing
   • attestations
   • verification policy
   • base image updates
6. Policy enforcement in pipelines1 hr
   • admission policy
   • registry policy
   • blocking criteria
   • exception process
   • evidence trail

Hands-on project: Harden a deliberately insecure image until a Trivy scan reports no high or critical findings, documenting each fix and each accepted risk.

You can run your own registry, push to it securely, and stop it filling up with images nobody will ever pull again.

1. Registry fundamentals and the pull flow1 hr
   • manifest resolution
   • blob download
   • digest verification
   • layer reuse
   • pull rate limits
2. Tagging strategy and immutability1 hr
   • semantic tags
   • digest pinning
   • latest considered harmful
   • immutable tags
   • promotion between environments
3. Running a private registry1 hr
   • registry deployment
   • TLS setup
   • authentication
   • storage backend
   • pull-through cache
4. Air-gapped distribution1 hr
   • save and load
   • image bundles
   • checksum verification
   • offline mirrors
   • update cadence
5. Retention, garbage collection and cost1 hr
   • retention policy
   • untagged manifests
   • garbage collection
   • storage cost
   • cleanup automation
6. Authentication and credential helpers1 hr
   • docker login
   • credential stores
   • registry tokens
   • CI service accounts
   • rotating registry credentials

Hands-on project: Stand up a private registry with authentication and TLS, push a signed multi-architecture image, and implement a retention policy.

You can work out why a container is slow or being killed, using signals rather than guesswork.

1. Logging drivers and log management1 hr
   • json-file driver
   • log rotation
   • syslog and fluentd drivers
   • structured logs
   • stdout discipline
2. Container metrics and resource accounting1 hr
   • docker stats
   • cgroup metrics
   • cAdvisor
   • memory working set
   • CPU throttling
3. Diagnosing OOM kills1 hr
   • exit code 137
   • dmesg evidence
   • memory limit vs usage
   • JVM and container limits
   • right-sizing
4. CPU throttling and performance1 hr
   • cpu quota mechanics
   • throttled periods
   • latency impact
   • limit vs request
   • tuning
5. Debugging without a shell1 hr
   • ephemeral debug containers
   • nsenter
   • copying files out
   • core dumps
   • distroless debugging
6. Wiring containers into Prometheus and Grafana1 hr
   • exporter deployment
   • scrape config
   • container labels
   • dashboard basics
   • alerting

Hands-on project: Diagnose a container being OOM-killed and another silently throttled on CPU, proving each diagnosis from metrics before fixing it.

You can set limits that protect the host without strangling the application, from measurement rather than a round number.

1. Setting memory and CPU limits from evidence1 hr
   • baseline measurement
   • headroom choice
   • limit vs reservation
   • burst behaviour
   • OOM risk
2. Build performance and cache strategy1 hr
   • cache mounts
   • layer ordering
   • parallel stages
   • remote cache
   • CI cache persistence
3. Startup time and image pull cost1 hr
   • image size impact
   • layer reuse
   • lazy pulling
   • warm caches
   • cold start budget
4. Storage driver and IO performance1 hr
   • overlay2 behaviour
   • write amplification
   • volume vs layer writes
   • IO limits
   • benchmarking
5. Host-level tuning and capacity1 hr
   • file descriptor limits
   • inotify watches
   • pid limits
   • disk pressure
   • host sizing
6. Benchmarking before and after a change1 hr
   • baseline capture
   • load generation
   • metric selection
   • statistical noise
   • documenting the delta

Hands-on project: Establish measured limits for three services by load-testing each, and show the host stays healthy when all three are saturated.

You can explain what you gain and lose moving from a single host to an orchestrator, and make the move deliberately.

1. What orchestration actually provides1 hr
   • scheduling
   • self-healing
   • rolling updates
   • service discovery
   • declarative state
2. Docker Swarm as the small step1 hr
   • swarm init
   • services and replicas
   • overlay networks
   • secrets and configs
   • when Swarm suffices
3. Kubernetes concepts mapped from Compose2 hrs
   • pods
   • deployments
   • services
   • configmaps and secrets
   • persistent volume claims
4. Translating a Compose stack1 hr
   • manifest authoring
   • health probe mapping
   • resource requests
   • namespace scoping
   • verification
5. Rolling updates and rollback1 hr
   • update strategy
   • surge and unavailable
   • readiness gating
   • rollback command
   • zero-downtime checks
6. Choosing an orchestrator honestly1 hr
   • single host sufficiency
   • managed Kubernetes
   • Swarm end of life risk
   • Nomad and alternatives
   • team capacity

Hands-on project: Migrate a working Compose stack to Kubernetes manifests, keeping behaviour identical, and document what the orchestrator now handles.

You can take an application with no containerisation and deliver it production-ready: small, non-root, scanned, observable, documented and running under an orchestrator.

1. Assessment and containerisation plan1 hr
   • dependency audit
   • statefulness analysis
   • image strategy
   • risk list
   • success criteria
2. Building the images2 hrs
   • multi-stage builds
   • base selection
   • non-root users
   • health checks
   • size targets
3. Compose stack and developer workflow1 hr
   • service definitions
   • startup ordering
   • seed data
   • hot reload
   • onboarding docs
4. Security hardening and supply chain2 hrs
   • scan and remediate
   • secret handling
   • SBOM and signing
   • runtime flags
   • accepted risks
5. Observability and resource limits1 hr
   • metrics wiring
   • dashboards
   • log strategy
   • load-tested limits
   • alert rules
6. Orchestration, runbook and defence1 hr
   • Kubernetes manifests
   • rolling update test
   • runbook authoring
   • handover
   • panel review

Hands-on project: Containerise a multi-service application end to end: multi-stage non-root images under 100 MB, a Compose stack for development, a hardened build passing Trivy with no high findings, a private registry with signing and retention, Prometheus metrics and Grafana dashboards, evidence-based resource limits, Kubernetes manifests with rolling updates, and a written runbook — defended in review.