Stage 4 · Provision
Docker & Containers
Package applications into lean, secure, reproducible containers that run the same way from laptop to production.
8 modules48 lessons6.0h of reading48/48 live today
Prerequisite
Linux + an application to containerize.
What this course leaves you with
- Write lean, secure multi-stage Dockerfiles
- Run multi-service stacks with Compose
- Scan, sign, and publish images
DockerContainersDevOpsSecurity
Why this stage matters — Apps are portable — now automate server configuration.
Progress
0 of 48 lessons complete. Progress is stored locally in your browser so you can pick the path back up later.
0%
course completion
01
6 lessons
Container Fundamentals
Understand what containers isolate, what images package, and how runtimes execute workloads.
- 01Why ContainersCompare containers with virtual machines, reproducible environments, dependency isolation, and deployment portability.6 min
- 02Images vs ContainersDistinguish immutable images, writable container layers, image IDs, container IDs, and lifecycle states.7 min
- 03Linux NamespacesLearn PID, mount, network, UTS, IPC, and user namespaces behind container isolation.8 min
- 04Control GroupsUse cgroups concepts for CPU, memory, process, and I/O limits enforced by the Linux kernel.8 min
- 05Docker and containerdTrace how Docker CLI, dockerd, containerd, runc, and the OCI runtime specification fit together.8 min
- 06Your First ContainerRun hello-world and alpine with docker run, inspect metadata, execute shells, and remove containers.6 min
02
6 lessons
Building Images
Write Dockerfiles that build quickly, cache well, and produce minimal runtime artifacts.
- 01Dockerfile BasicsUse FROM, WORKDIR, COPY, RUN, CMD, ENTRYPOINT, EXPOSE, and .dockerignore correctly.7 min
- 02Layers & Build CacheOrder Dockerfile instructions for cache reuse, understand layer diffs, and diagnose cache misses.8 min
- 03Multi-Stage BuildsCompile Go, Node.js, or Java artifacts in builder stages and copy only runtime files forward.8 min
- 04Distroless ImagesUse scratch, Alpine, and Google distroless bases while handling certificates, users, and debugging tradeoffs.8 min
- 05Image Size OptimizationMeasure image size with docker image ls, remove package caches, and inspect layers with dive.7 min
- 06Build Arguments & MetadataUse ARG, ENV, LABEL, target stages, build contexts, and reproducible version metadata.7 min
03
6 lessons
Running & Networking Containers
Operate containers locally with ports, storage, networks, environment variables, and logs.
- 01docker runUse docker run options for names, detached mode, restart policies, commands, and interactive terminals.7 min
- 02PortsPublish ports with -p, inspect listeners, distinguish container ports from host ports, and avoid collisions.7 min
- 03Volumes & Bind MountsPersist data with named volumes, bind source code, manage ownership, and clean unused storage.8 min
- 04Container NetworksCreate bridge networks, use DNS service names, inspect IPs, and compare host networking.8 min
- 05Environment VariablesPass env vars with -e and --env-file, separate config from images, and avoid leaking secrets.6 min
- 06Logs & execDebug containers with docker logs, docker exec, docker inspect, exit codes, and process signals.7 min
04
6 lessons
Docker Compose
Run complete local systems with declarative Compose files and service-level configuration.
- 01Compose File BasicsDefine services, images, builds, ports, volumes, networks, and environment in compose.yaml.7 min
- 02Multi-Container AppsConnect an API, PostgreSQL, Redis, and worker services using Docker Compose DNS and networks.8 min
- 03Service DependenciesUse depends_on, healthcheck conditions, wait-for scripts, and retry loops for startup ordering.8 min
- 04Local Dev EnvironmentsMount source code, enable hot reload, seed databases, and run repeatable developer stacks.8 min
- 05Profiles & OverridesUse Compose profiles, override files, extension fields, and project names for flexible setups.7 min
- 06Compose OperationsOperate stacks with docker compose up, down, logs, ps, exec, run, pull, and build.6 min
05
6 lessons
Registries & Security
Publish images safely and reduce container risk across scanning, signing, users, and secrets.
- 01Registries & TagsPush images to Docker Hub, GHCR, or ECR with semantic tags, digests, and immutable references.7 min
- 02Trivy ScanningScan images with Trivy for CVEs, OS packages, language dependencies, misconfigurations, and SBOMs.8 min
- 03Image SigningSign and verify container images with Sigstore Cosign, keyless signing, attestations, and Rekor.8 min
- 04Non-Root ContainersRun with USER, drop Linux capabilities, set read-only filesystems, and avoid privileged containers.8 min
- 05SecretsKeep secrets out of layers using BuildKit secrets, runtime mounts, env-file risks, and secret rotation.7 min
- 06Supply ChainUse SBOMs, SLSA provenance, pinned base image digests, dependency updates, and vulnerability gates.8 min
06
6 lessons
Production Containers
Prepare containers for orchestrators with health, resources, standards, and build automation.
- 01Health ChecksDefine Docker HEALTHCHECK instructions, readiness endpoints, startup probes, and failure thresholds.7 min
- 02Resource LimitsSet CPU and memory limits, understand OOM kills, cgroup metrics, and application tuning.8 min
- 03OCI SpecUnderstand OCI image layout, runtime spec, manifests, layers, config JSON, and media types.8 min
- 04BuildKitUse BuildKit for cache mounts, secret mounts, SSH forwarding, parallel builds, and buildx drivers.8 min
- 05BuildpacksBuild images with Cloud Native Buildpacks, pack CLI, builders, build plans, and rebasing.7 min
- 06Kubernetes-Ready ImagesOptimize images for Kubernetes with signals, graceful shutdown, probes, non-root users, and minimal layers.8 min
07
6 lessons
Image Internals & Advanced Builds
Inspect OCI images deeply and make Docker builds faster, smaller, and more reproducible.
- 01OCI Image LayoutInspect manifests, config JSON, layer tarballs, media types, and multi-architecture indexes with skopeo.8 min
- 02Dockerfile Cache StrategyOrder COPY and RUN instructions around dependency locks, package caches, and cache-busting build arguments.7 min
- 03BuildKit Cache MountsSpeed builds with RUN --mount=type=cache, inline cache metadata, registry caches, and buildx bake.8 min
- 04Multi-Arch buildxPublish amd64 and arm64 images with docker buildx, QEMU emulation, manifest lists, and platform testing.8 min
- 05Distroless DebuggingDebug minimal images with ephemeral debug containers, busybox sidecars, copied certificates, and static binaries.7 min
- 06Layer Size ForensicsUse docker history, dive, syft, and .dockerignore to remove hidden bloat and unused artifacts.7 min
08
6 lessons
Networking, Storage & Compose Deep Dive
Operate multi-service container systems with explicit networks, durable storage, and reliable startup checks.
- 01Bridge & Host NetworkingCompare bridge, host, none, and user-defined networks with docker network inspect and DNS aliases.8 min
- 02Published Port PathTrace -p traffic through NAT rules, localhost binding, IPv6 listeners, and container service ports.7 min
- 03Volume LifecycleManage named volumes, bind mounts, tmpfs mounts, ownership, backups, and docker volume prune risks.8 min
- 04Compose Service TopologiesModel APIs, databases, workers, queues, and admin tools with compose.yaml services and networks.8 min
- 05Compose HealthchecksWrite healthcheck commands, depends_on conditions, restart policies, and readiness gates for local stacks.7 min
- 06Compose TroubleshootingDiagnose failing stacks with docker compose ps, logs, exec, events, config, and network inspect.7 min