True zero to confident Docker practitioner

Container Operations with Docker

Build, run, inspect, debug, secure, and release containers with evidence.

Build practical Docker judgment through a focused Core Path. Find advanced engine operations, administration, and the legacy library in All Material.

Start the free chapter View syllabus

No credit card for the free chapter. Preview what the chapter covers.

By the end

Observable skills you will practice.

Explain the client, engine, image, container, network, volume, and registry boundaries
Build reproducible images from deliberate Dockerfiles and contexts
Run containers with explicit process, configuration, port, and lifecycle contracts
Read state, inspect data, logs, events, process lists, and exit evidence before changing anything
Choose writable layers, volumes, bind mounts, and network boundaries without losing data or exposing services.
Separate running from ready and diagnose common build, start, process, DNS, and health failures
Harden containers with non-root users, dropped capabilities, read-only filesystems, secret hygiene, and trusted images.
Publish and verify an image by registry digest, then prove an application capstone and intentional cleanup.

Syllabus

92 chapters from the published course structure.

The focused path contains 90 required lessons. The advanced library remains available when your role needs more depth.

Focused path chapters14 chapters contain the required 90-lesson path.

Chapter 00Free

Free Docker first contact

Build the first Docker mental model, read engine evidence, run a named container, inspect it, read logs, and clean up.

9 focused lessons

Chapter 01Full course

Images, tags, IDs, digests, and layers

Read image references, filter tags, prove shared image IDs, inspect metadata, read layer history, use digests, and remove image tags safely.

8 focused lessons

Chapter 02Full course

Running containers deliberately

Control foreground and detached runs, names, command overrides, exit codes, environment, working directory, automatic cleanup, and restart policy evidence.

8 focused lessons

Chapter 03Full course

State, logs, inspection, and events

Debug containers through the right evidence surface: ps, inspect, logs, events, top, stats, stopped records, crash evidence, and cleanup timelines.

8 focused lessons

Chapter 04Full course

Dockerfiles from zero

Author simple images with Dockerfile instructions, build context, .dockerignore, runtime defaults, metadata, and evidence-backed build gates.

8 focused lessons

Chapter 05Full course

Build cache and reproducible builds

Predict cache hits and misses, repair poor layer order, use .dockerignore, make build args explicit, and prove clean rebuilds.

6 focused lessons + 2 advanced lessons

Chapter 06Full course

Volumes and bind mounts

Prove writable-layer loss, named-volume persistence, volume inventory, bind mounts, read-only protection, backup, and cleanup.

8 focused lessons

Chapter 07Full course

Docker networking and ports

Prove private ports, published ports, user-defined bridge networks, name-based DNS, network isolation, running-container attachment, and cleanup.

7 focused lessons + 1 advanced lesson

Chapter 08Full course

Configuration and environment

Separate image defaults from runtime values, prove -e and env-file overrides, render Compose .env interpolation, inspect runtime environment, detect secret traps, and clean up.

6 focused lessons + 2 advanced lessons

Chapter 09Full course

Healthchecks and readiness

Distinguish running from ready, define HEALTHCHECK behavior, diagnose unhealthy containers, tune start periods, override checks, and prove Compose service_healthy readiness.

5 focused lessons + 3 advanced lessons

Chapter 10Full course

Debugging containers

Preserve evidence while debugging with baseline state, exec, docker cp, Docker Debug, missing executable diagnosis, service-name DNS repair, cleanup, and incident notes.

6 focused lessons + 2 advanced lessons

Chapter 11Full course

Registries, tagging, and release flow

Move images from local builds to a private registry. Prove authentication, release tags, pushed digests, tag and digest pulls, smoke tests, and a release manifest.

4 focused lessons + 4 advanced lessons

Chapter 12Full course

Security fundamentals

Reduce risk with non-root images, dropped capabilities, no-new-privileges, read-only filesystems, socket and secret checks, scan evidence, and cleanup.

6 focused lessons + 2 advanced lessons

Chapter 13Full course

Final professional capstone

Deliver a Docker operator packet with requirements, image and runtime configuration, persistence, networking, failure repair, hardening, registry evidence, and cleanup.

1 focused lesson + 8 advanced lessons

Explore 78 advanced library chapters

These chapters provide optional drills and reference depth. They are not required to complete the focused path.

Library 07Full course

Image hygiene and base image selection

Review release images through trusted bases, size, labels, non-root defaults, secret history, scan evidence, and fresh-base rebuilds.

8 advanced lessons

Library 10Full course

Docker Compose applications

Define a multi-service app in compose.yaml, render config, start services, read project state and logs, prove service-name networking, inspect published ports, and clean up.

8 advanced lessons

Library 16Full course

Resource limits and runtime constraints

Set and verify memory, CPU, pids, ulimit, restart, stats, OOM, writable-layer disk pressure, cleanup, and a resource boundary plan.

8 advanced lessons

Library 17Full course

Multi-stage builds

Separate builder and runtime stages, copy artifacts, repair artifact paths, compare final sizes, choose language patterns, handle build secrets, and release a clean runtime image.

8 advanced lessons

Library 18Full course

CI, automation, and policy checks

Read Docker CI workflows, prove metadata tags and labels, test before push, run build checks, use CI cache, inspect Scout evidence, repair build policy failures, and record pipeline evidence.

8 advanced lessons

Library 19Full course

Cleanup, prune, and storage pressure

Measure daemon storage, prune stopped containers, dangling images, anonymous volumes, unused networks, and build cache while preserving running work and named data.

8 advanced lessons

Library 20Full course

Troubleshooting gauntlet

Repair missing images, broken build context, host port collisions, bind mount source failures, DNS and health issues, platform mismatches, and cleanup evidence.

8 advanced lessons

Library 22Full course

Production handoff and portfolio

Turn the capstone into a readable operator packet with runbook, release notes, operations checklist, incident story, reproducibility bundle, portfolio README, and final handoff proof.

8 advanced lessons

Library 23Full course

Production readiness review

Review the Docker capstone for launch readiness through risk register, observability plan, rollback plan, capacity and disk plan, security review, maintenance cadence, and final readiness proof.

8 advanced lessons

Library 24Full course

Buildx and multi-platform release

Use Buildx to inspect builder capability, build amd64 and arm64 images, push a multi-platform registry index, inspect it with image tools, add SBOM and provenance metadata, and pass a final platform release gate.

8 advanced lessons

Library 25Full course

Contexts and remote engines

Prevent wrong-target Docker operations by listing contexts, inspecting endpoints, switching safely, using one-command overrides, clearing DOCKER_HOST, releasing to staging, and proving the target.

8 advanced lessons

Library 26Full course

Logging drivers and daemon log policy

Prove how Docker captures container output through logging drivers, daemon defaults, container overrides, rotation options, inheritance, and docker logs reader limits.

8 advanced lessons

Library 27Full course

Rootless Docker and user namespace isolation

Reduce host privilege risk with rootless Docker, subordinate UID and GID ranges, rootless engine evidence, cgroup and port limits, userns-remap, bind-mount traps, and explicit user namespace exceptions.

8 advanced lessons

Library 28Full course

Daemon operations and storage backend readiness

Operate Docker as a host service with daemon configuration, validation, data-root, overlay2 evidence, live restore, config recovery, startup flag conflicts, service state, and daemon logs.

8 advanced lessons

Library 29Full course

Backup, restore, and migration drills

Prove Docker recovery through named volume backup and restore, image save and load, export and commit caveats, docker cp artifacts, manifests, and final recovery evidence.

8 advanced lessons

Library 30Full course

Docker Engine API and automation

Use the Docker Engine API as a structured automation surface for version checks, container lists, inspect detail, create and start lifecycle, logs, events, notes, and final proof.

8 advanced lessons

Library 31Full course

Swarm services and stacks

Operate Docker Swarm services with manager node evidence, replicated tasks, scaling, rolling updates, rollback, secrets, configs, stack deploy, stack cleanup, and final proof.

8 advanced lessons

Library 32Full course

Docker Scout and supply-chain inspection

Inspect image supply-chain risk with Scout quickview, CVEs, SBOMs, artifact targets, remediation recommendations, attestations, VEX exceptions, decision records, and final proof.

8 advanced lessons

Library 33Full course

Buildx Bake and declarative build orchestration

Use Docker Buildx Bake to turn complex build flags into reviewable targets, groups, variables, matrices, Compose inputs, release notes, and final proof.

8 advanced lessons

Library 34Full course

Advanced BuildKit cache strategy

Use BuildKit cache mounts, build bind mounts, local cache, registry cache, inline cache, invalidation evidence, garbage-collection planning, and final proof.

8 advanced lessons

Library 35Full course

Buildx builders and remote build execution

Treat Buildx builders as build infrastructure with inventory, docker-container drivers, output loading, state preservation, Docker Build Cloud, context optimization, and final proof.

8 advanced lessons

Library 36Full course

Advanced build secrets and SSH mounts

Handle private build inputs with unsafe ARG evidence, BuildKit secret mounts, environment-backed secret sources, required secrets, SSH forwarding, remote Git authentication, operating plan, and final proof.

8 advanced lessons

Library 37Full course

Docker daemon remote access, TLS, and authorization

Control remote daemon access with insecure TCP rejection, SSH contexts, TLS daemon configuration, client certificates, network scope, authorization plugins, audit plans, and final proof.

8 advanced lessons

Library 38Full course

Runtime internals, isolation, and OCI boundaries

Follow Docker from CLI request to host process with dockerd, containerd, shims, runc, namespaces, cgroups, capabilities, alternative runtimes, failure classification, and final proof.

8 advanced lessons

Library 39Full course

Advanced network drivers, IPAM, and packet path

Master Docker network driver choice with bridge IPAM, host and none modes, published port packet paths, overlay scope, macvlan and ipvlan planning, firewall validation, and final proof.

8 advanced lessons

Library 40Full course

Storage driver internals, overlay2, and writable-layer forensics

Investigate Docker storage with overlay2 driver evidence, copy-on-write writes, docker diff, inspect size metadata, volume contrast, verbose system df, and final proof.

8 advanced lessons

Library 41Full course

Daemon metrics, event streams, and observability evidence

Connect Docker daemon Prometheus metrics, scrape configuration, container stats, filtered event timelines, alert notes, and final observability proof.

8 advanced lessons

Library 42Full course

Registry mirrors, pull-through cache, and trust operations

Operate Docker registry paths with local registry service evidence, explicit references, daemon mirrors, pull-through cache proof, certificate trust, operating notes, and final proof.

8 advanced lessons

Library 43Full course

Advanced Compose overlays, profiles, and fragments

Operate advanced Compose projects with multiple-file merge evidence, default service lists, profile activation, profiled runs, reusable fragments, operating conventions, and final proof.

8 advanced lessons

Library 44Full course

Compose Watch and development inner loop

Use Compose Develop and Watch with sync, rebuild, sync plus restart, up with watch, watch evidence, operating notes, and final proof.

8 advanced lessons

Library 45Full course

Compose secrets, configs, and runtime sensitive inputs

Use Compose secrets and configs with rendered access proof, file-mounted secrets, environment boundary checks, config mounts, service scope, operating notes, and final proof.

8 advanced lessons

Library 46Full course

Compose project lifecycle operations

Operate a named Compose project with rendered config proof, up wait, ps and logs, events, narrow restart, orphan cleanup, teardown, operating notes, and final proof.

8 advanced lessons

Library 47Full course

Compose volumes and data retention

Operate Compose named volumes with rendered model proof, state writes, normal down preservation, backup and restore, external volume boundaries, destructive reset, operating notes, and final proof.

8 advanced lessons

Library 48Full course

Compose troubleshooting and repair gauntlet

Diagnose and repair Compose failures with config render errors, missing external volumes, port collisions, ps and logs evidence, events, narrow restart, cleanup, operating notes, and final proof.

8 advanced lessons

Library 49Full course

Compose production readiness contract

Review a Compose service as an operating contract with env sources, rendered config, healthcheck, restart policy, deploy resources, labels, smoke testing, cleanup, checklist, and final proof.

8 advanced lessons

Library 50Full course

Compose image build and release flow

Use Compose to inspect build inputs, render service image references, build images, start and list image evidence, push, remove, pull, clean up, record a release note, and prove the final image release.

8 advanced lessons

Library 51Full course

Compose environment override stacks

Use base, development, and production Compose files to prove merge order, rendered differences, services, profiles, images, JSON evidence, runtime cleanup, operating plans, and final proof.

8 advanced lessons

Library 52Full course

Compose modularization patterns

Use include, extends, reusable fragments, service inventory, profile and image review, JSON evidence, operating plans, and final proof to keep large Compose projects reviewable.

8 advanced lessons

Library 53Full course

Compose networking and service discovery

Operate Compose networking with default service discovery, custom frontend and internal backplane networks, aliases, published ports, network_mode conflict diagnosis, network inspection, cleanup plans, and final proof.

8 advanced lessons

Library 54Full course

Compose dependency readiness and startup order

Operate Compose dependency graphs with depends_on conditions, health-gated services, completion-gated migrations, up --wait, event timelines, restart propagation, cleanup plans, and final proof.

8 advanced lessons

Library 55Full course

Compose scaling and stateless replicas

Scale stateless Compose services with up --scale, inspect replica state and logs, downscale deliberately, diagnose container_name and fixed-port scaling traps, clean up, and submit final proof.

8 advanced lessons

Library 56Full course

Compose update and recreate behavior

Operate Compose changes with baseline state, --no-recreate guardrails, changed-service recreation, --force-recreate, --no-deps targeting, cleanup plans, and final proof.

8 advanced lessons

Library 57Full course

Compose image freshness and pull policy

Refresh Compose service images deliberately with rendered image inventory, service pulls, dependency pulls, buildable-service handling, up --pull always, cleanup plans, and final proof.

8 advanced lessons

Library 58Full course

Compose build freshness and rebuild policy

Rebuild Compose service images deliberately with input review, rendered build inventory, baseline builds, cache-aware rebuilds, --no-cache, --pull, dependency builds, up --build, cleanup plans, and final proof.

8 advanced lessons

Library 59Full course

Compose dry-run and change previews

Preview Compose changes deliberately with render-first discipline, dry-run up, dry-run build and recreate, destructive cleanup preview, apply-after-preview, state proof, cleanup plans, and final proof.

8 advanced lessons

Library 60Full course

Compose one-off commands and live debugging

Choose the right Compose command surface with run --rm, --no-deps, --service-ports, exec, logs, attach, cleanup plans, and final proof.

8 advanced lessons

Library 61Full course

Compose wait, exit codes, and job pipelines

Operate job-style Compose workflows with wait, ps --all, status filters, event timelines, failed-job proof, --exit-code-from test gates, cleanup plans, and final proof.

8 advanced lessons

Library 62Full course

Compose service control and safe removal

Control service state deliberately with stop, start, restart, pause, unpause, kill, rm, down, state proof, cleanup plans, and final proof.

8 advanced lessons

Library 63Full course

Compose filesystem handoff and snapshots

Move files in and out of Compose service containers, inspect filesystem drift, export service filesystems, create emergency commit snapshots, clean up, and submit final proof.

8 advanced lessons

Library 64Full course

Compose runtime triage with logs, top, stats, and ports

Diagnose live Compose services with bounded logs, process lists, one-shot stats, port bindings, event timelines, narrow restarts, cleanup plans, and final proof.

8 advanced lessons

Library 65Full course

Compose resource contracts and OOM triage

Declare CPU, memory, and PID resource contracts, render them, sample stats, interpret headroom, diagnose OOM failures, clean up, and submit final proof.

8 advanced lessons

Library 66Full course

Compose security hardening contract

Render and prove least-privilege Compose services with non-root users, read-only root filesystems, tmpfs scratch space, dropped capabilities, no-new-privileges, cleanup plans, and final proof.

8 advanced lessons

Library 67Full course

Compose single-server production release

Prove the production target, read base and overlay inputs, render the merged model, deploy, smoke test, rebuild and redeploy one service with --no-deps, record release evidence, and clean up.

8 advanced lessons

Library 68Full course

Compose rollback and recovery

Prove a known-good baseline, inject a failing release, preserve state, logs, events, and smoke evidence, select the previous release, roll back only the affected service, verify recovery, and record the handoff.

8 advanced lessons

Library 69Full course

Compose blue-green traffic release

Establish blue as a control, test green privately, preserve a failed canary, switch traffic through a proxy, roll the route back, and record the evidence.

8 advanced lessons

Library 70Full course

Compose disaster recovery and regional failover

Prove primary and standby identity, read replication lag, preserve primary failure evidence, fence writes, promote one standby route, verify marker integrity, and record the recovery handoff.

8 advanced lessons

Library 71Full course

Compose incident response and operations handoff

Establish a healthy control, preserve a failed release timeline, contain only the failing service, recover with a web-only no-deps update, verify public health and release identity, write the handoff, and clean up safely.

8 advanced lessons

Library 72Full course

Compose Bridge portability and generated Kubernetes models

Convert a resolved Compose model into Kubernetes manifests, inspect the generated Kustomize output, apply an explicit organization transformation, reject unsafe host assumptions, validate with a dry run, deploy, document, and clean up.

8 advanced lessons

Library 73Full course

Compose Bridge migration validation and handoff

Compare canonical Compose intent with generated Kubernetes resources, review policy, storage, and secret boundaries, reject contract drift, validate rollout and smoke behavior, document ownership, and clean up safely.

8 advanced lessons

Library 74Full course

Compose Bridge promotion and drift control

Pin source, transformation, target, and release identity, render a fresh promotion bundle, compare live state, reject unmanaged drift, apply with a field owner, verify behavior, and record rollback-aware evidence.

8 advanced lessons

Library 75Full course

Compose Bridge rollback, recovery, and ownership repair

Preserve failure evidence, identify the last known-good revision, render and diff a pinned rollback candidate, reject field conflicts, apply with ownership, verify service and data boundaries, and record recovery evidence.

8 advanced lessons

Library 76Full course

Compose Bridge reconciliation, scoped pruning, and garbage collection

Render the current desired model, classify stale generated resources, reject broad or data-bearing prune requests, apply with a scoped field manager, verify convergence and ownership, preserve data, and record the handoff.

8 advanced lessons

Library 77Full course

Compose Bridge transformation images, custom templates, and governance

Read the transformation contract, extract and customize templates, build and inspect a pinned transformation image, render safe output, reject unsafe host and secret inputs, validate, smoke-test, hand off, and clean up.

8 advanced lessons

Library 78Full course

Docker Model Runner lifecycle, API boundaries, and safe local inference

Operate Docker Model Runner from runner status and safe installation through model identity, request evidence, host and container APIs, budgeted tuning, provenance-aware packaging, and cleanup.

8 advanced lessons

Library 79Full course

Docker Offload sessions, remote execution, and ephemeral cloud boundaries

Operate Docker Offload from access and session lifecycle through remote runs, narrow ports and mounts, context-safe remote builds, immutable registry persistence, teardown, diagnosis, recovery, and cleanup.

8 advanced lessons

Library 80Full course

Docker Hardened Images adoption, comparison, and policy evidence

Adopt Docker Hardened Images through catalog review, dhi.io access, Scout comparison, SBOM and attestation evidence, runtime compatibility, Dockerfile migration, policy review, customization boundaries, and cleanup.

8 advanced lessons

Library 81Full course

Hardened Docker Desktop, Enhanced Container Isolation, and managed settings

Operate Hardened Docker Desktop with Enhanced Container Isolation, managed settings, UID mapping proof, Sysbox runtime evidence, blocked privileged and namespace escape paths, protected bind mounts, governed Docker socket exceptions, limitation review, cleanup, and final proof.

8 advanced lessons

Library 82Full course

Hardened Docker Desktop access policy and air-gapped containers

Control registry hostnames, Docker Hub image categories, personal namespace publishing, and air-gapped image-pull and runtime egress paths with managed policies, negative tests, redirect review, rollout limits, and final evidence.

8 advanced lessons

Library 83Full course

Docker Hub organization governance and release evidence

Map organizations, teams, members, and repositories; grant least-privilege access; rotate scoped tokens; protect immutable release tags; verify webhooks; export activity evidence; and run an identity-offboarding drill.

8 advanced lessons

Library 84Full course

Docker Hub distribution limits, lifecycle, and CI migration

Measure pull limits and attribution, design cache and mirror policy, retire stale repositories safely, interpret Hub security insights, migrate deprecated Automated Builds, and run a distribution incident drill.

8 advanced lessons

Library 85Full course

Docker Extensions trust, marketplaces, and SDK operations

Map extension privilege boundaries, review immutable installs, validate metadata, govern a private marketplace, run the SDK lifecycle, control settings, and recover from an extension incident.

8 advanced lessons

Library 86Full course

Docker Desktop diagnostics and safe recovery

Classify Desktop failures, collect bounded logs and diagnostics, review privacy, back up data, choose the smallest recovery action, restore a known-good endpoint, and hand off an auditable incident packet.

8 advanced lessons

Library 87Full course

Docker MCP Catalog, profiles, gateway, and AI tool governance

Operate Docker MCP Toolkit with catalog provenance, project profiles, client and gateway verification, credential boundaries, safe sharing, custom catalogs, and incident cleanup.

8 advanced lessons

Library 88Full course

Docker Agent teams, tools, distribution, and sandbox boundaries

Operate Docker Agent teams with config review, delegation traces, tool approval, model credentials, OCI sharing, aliases, sandbox execution, and cleanup evidence.

8 advanced lessons

Library 89Full course

Testcontainers and production-like integration tests

Use real containerized test dependencies with lifecycle, readiness, runtime connection, seeding, multi-service graphs, failure cleanup, cloud CI offload, and final evidence.

8 advanced lessons

Library 90Full course

Docker Desktop Kubernetes and local cluster operations

Operate Docker Desktop Kubernetes with context discipline, control-plane image visibility, local image deployment, Service access, ConfigMap and PVC state, triage, reset recovery, and final evidence.

8 advanced lessons

Library 91Full course

Docker Desktop networking, proxies, DNS, and host access

Operate Docker Desktop networking with backend-path evidence, published-port scope, host connectivity, VPN and firewall visibility, DNS behavior, proxy boundaries, host networking, and final evidence.

8 advanced lessons

Library 92Full course

Docker Desktop file sharing, bind mounts, sync, and volumes

Operate Docker Desktop file sharing with VM-boundary evidence, shared-folder scope, case-sensitivity traps, bind performance, synchronized shares, volume placement, Compose watch policy, and final evidence.

8 advanced lessons

Full access

Choose access for Container Operations with Docker

Every available offer is shown with its exact CAD price and billing model. Checkout opens only after you choose an offer and enter the receipt email.

Payments are processed by Lemon Squeezy for Phoenix Soft Inc. Paid access can be restored after secure sign-in.

Questions

Know what to expect before you start.

What can I try for free?

Free Docker first contact is free and contains 9 lessons. No credit card is requested before the free workspace opens.

What experience do I need?

No Docker experience is required. Basic command-line familiarity is helpful.

What does the focused path include?

90 required lessons, with 9 free and 81 included in paid access.

Is there material beyond the focused path?

Yes. The course also includes 648 advanced practice and reference resources. They are available when you need more depth, but they do not lengthen the required path.

Which paid options are available?

Academy Founder Annual: CA$139 per year. Founder Vault: CA$279 one-time.

How is paid access billed?

Academy Founder Annual: Access continues while the annual subscription remains active. Founder Vault: No recurring charge. Coverage includes courses launched during the first 24 months.

How long does it take?

The published estimate is 24 to 32 active hours for Docker Core. Your pace will depend on how much you repeat the practice.

Do I need to install anything?

No installation is required to start the guided free chapter. Later lessons explain the real tools, files, and operating boundaries relevant to the skill.

What technology is covered?

The syllabus and these stated outcomes are the source of truth: Explain the client, engine, image, container, network, volume, and registry boundaries; Build reproducible images from deliberate Dockerfiles and contexts; Run containers with explicit process, configuration, port, and lifecycle contracts; Read state, inspect data, logs, events, process lists, and exit evidence before changing anything; Choose writable layers, volumes, bind mounts, and network boundaries without losing data or exposing services.; Separate running from ready and diagnose common build, start, process, DNS, and health failures; Harden containers with non-root users, dropped capabilities, read-only filesystems, secret hygiene, and trusted images.; Publish and verify an image by registry digest, then prove an application capstone and intentional cleanup..

Which browsers are supported?

Use a current browser with JavaScript enabled. The free chapter is the quickest compatibility check for your device.

Does the workspace work on mobile?

The reading pages reflow for small screens. Command-heavy practice is more comfortable with a physical keyboard and a larger display.

What happens when I make a mistake?

The practice state is isolated from production systems. Read the resulting evidence, revise the action, and try again.

How do I restore access?

Use the receipt email on the restore-access page. The sign-in link verifies the account before paid entitlements are loaded.