Docker Solution: Professional (EN)

This solution guide belongs to the assessment Professional. It does not provide one rigid answer; it defines verifiable answer criteria.

Grading Rubric

Area	Expectation
Terms	Docker resources are named correctly.
Evidence	Answers mention concrete commands and interpretable outputs.
Operations	Persistence, networking, logs and cleanup are covered.
Security	Socket, permissions, user, secrets and host paths are assessed.

Sample Criteria

Solution 01: Daemon-Konfiguration

A strong answer for Daemon-Konfiguration names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 02: Registry

A strong answer for Registry names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 03: CI/CD

A strong answer for CI/CD names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 04: Betrieb

A strong answer for Betrieb names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 05: Observability

A strong answer for Observability names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 06: Plattformstandards

A strong answer for Plattformstandards names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 07: Daemon-Konfiguration

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 08: Registry

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 09: CI/CD

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 10: Betrieb

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 11: Observability

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 12: Plattformstandards

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 13: Daemon-Konfiguration

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 14: Registry

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 15: CI/CD

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 16: Betrieb

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 17: Observability

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 18: Plattformstandards

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 19: Daemon-Konfiguration

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 20: Registry

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 21: CI/CD

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 22: Betrieb

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 23: Observability

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 24: Plattformstandards

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 25: Daemon-Konfiguration

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 26: Registry

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 27: CI/CD

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 28: Betrieb

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 29: Observability

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 30: Plattformstandards

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 31: Daemon-Konfiguration

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 32: Registry

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 33: CI/CD

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 34: Betrieb

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 35: Observability

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 36: Plattformstandards

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 37: Daemon-Konfiguration

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 38: Registry

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 39: CI/CD

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 40: Betrieb

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Practice Appendix: Professional Solution

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is deliberately small so it can be verified and discussed independently.

A001. Daemon-Konfiguration

Task: document context and desired state and explicitly relate the observation to Daemon-Konfiguration.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A002. Registry

Task: explain the command before running it and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A003. CI/CD

Task: prove current state with inspect and explicitly relate the observation to CI/CD.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A004. Betrieb

Task: capture logs and exit code and explicitly relate the observation to Betrieb.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A005. Observability

Task: sketch the network path and explicitly relate the observation to Observability.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A006. Plattformstandards

Task: check the volume lifecycle and explicitly relate the observation to Plattformstandards.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A007. Docker Engine

Task: assess image provenance and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A008. Docker CLI

Task: distinguish tag and digest and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A009. Docker Daemon

Task: explain build cache impact and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A010. Image

Task: write down rollback or cleanup path and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A011. Container

Task: name the security impact and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A012. Dockerfile

Task: rate the operational risk and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A013. Build Context

Task: document context and desired state and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A014. Layer

Task: explain the command before running it and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A015. Tag and Digest

Task: prove current state with inspect and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A016. Registry

Task: capture logs and exit code and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A017. Network

Task: sketch the network path and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A018. Volume

Task: check the volume lifecycle and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A019. Bind Mount

Task: assess image provenance and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A020. Compose

Task: distinguish tag and digest and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A021. Rootless Mode

Task: explain build cache impact and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A022. Socket

Task: write down rollback or cleanup path and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A023. Daemon-Konfiguration

Task: name the security impact and explicitly relate the observation to Daemon-Konfiguration.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A024. Registry

Task: rate the operational risk and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A025. CI/CD

Task: document context and desired state and explicitly relate the observation to CI/CD.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A026. Betrieb

Task: explain the command before running it and explicitly relate the observation to Betrieb.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A027. Observability

Task: prove current state with inspect and explicitly relate the observation to Observability.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A028. Plattformstandards

Task: capture logs and exit code and explicitly relate the observation to Plattformstandards.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A029. Docker Engine

Task: sketch the network path and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A030. Docker CLI

Task: check the volume lifecycle and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A031. Docker Daemon

Task: assess image provenance and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A032. Image

Task: distinguish tag and digest and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A033. Container

Task: explain build cache impact and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A034. Dockerfile

Task: write down rollback or cleanup path and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A035. Build Context

Task: name the security impact and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A036. Layer

Task: rate the operational risk and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A037. Tag and Digest

Task: document context and desired state and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A038. Registry

Task: explain the command before running it and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A039. Network

Task: prove current state with inspect and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A040. Volume

Task: capture logs and exit code and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A041. Bind Mount

Task: sketch the network path and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A042. Compose

Task: check the volume lifecycle and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A043. Rootless Mode

Task: assess image provenance and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A044. Socket

Task: distinguish tag and digest and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A045. Daemon-Konfiguration

Task: explain build cache impact and explicitly relate the observation to Daemon-Konfiguration.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A046. Registry

Task: write down rollback or cleanup path and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A047. CI/CD

Task: name the security impact and explicitly relate the observation to CI/CD.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A048. Betrieb

Task: rate the operational risk and explicitly relate the observation to Betrieb.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A049. Observability

Task: document context and desired state and explicitly relate the observation to Observability.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A050. Plattformstandards

Task: explain the command before running it and explicitly relate the observation to Plattformstandards.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A051. Docker Engine

Task: prove current state with inspect and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A052. Docker CLI

Task: capture logs and exit code and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A053. Docker Daemon

Task: sketch the network path and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A054. Image

Task: check the volume lifecycle and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A055. Container

Task: assess image provenance and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A056. Dockerfile

Task: distinguish tag and digest and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A057. Build Context

Task: explain build cache impact and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A058. Layer

Task: write down rollback or cleanup path and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A059. Tag and Digest

Task: name the security impact and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A060. Registry

Task: rate the operational risk and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A061. Network

Task: document context and desired state and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A062. Volume

Task: explain the command before running it and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A063. Bind Mount

Task: prove current state with inspect and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A064. Compose

Task: capture logs and exit code and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A065. Rootless Mode

Task: sketch the network path and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A066. Socket

Task: check the volume lifecycle and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A067. Daemon-Konfiguration

Task: assess image provenance and explicitly relate the observation to Daemon-Konfiguration.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A068. Registry

Task: distinguish tag and digest and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A069. CI/CD

Task: explain build cache impact and explicitly relate the observation to CI/CD.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A070. Betrieb

Task: write down rollback or cleanup path and explicitly relate the observation to Betrieb.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A071. Observability

Task: name the security impact and explicitly relate the observation to Observability.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A072. Plattformstandards

Task: rate the operational risk and explicitly relate the observation to Plattformstandards.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

Official Sources and Scope

The material is aligned with public Docker documentation. When the workshop mentions external tools around Docker Engine, those tools are presented as adjacent operational practice, not as Docker Engine features.

Docker Engine: https://docs.docker.com/engine/
Dockerfile Reference: https://docs.docker.com/reference/dockerfile/
Compose File Reference: https://docs.docker.com/reference/compose-file/
Compose Specification: https://github.com/compose-spec/compose-spec/blob/master/spec.md
Docker Engine Security: https://docs.docker.com/engine/security/
Docker Rootless Mode: https://docs.docker.com/engine/security/rootless/
Protect the Docker Daemon Socket: https://docs.docker.com/engine/security/protect-access/
Docker Build Best Practices: https://docs.docker.com/build/building/best-practices/
Docker Training: https://www.docker.com/trainings/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered without inventing platform behavior.

Drill 01: image provenance

State which Docker object or host boundary is affected by image provenance.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 02: build context

State which Docker object or host boundary is affected by build context.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 03: layer ordering

State which Docker object or host boundary is affected by layer ordering.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 04: container user

State which Docker object or host boundary is affected by container user.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 05: mounts and volumes

State which Docker object or host boundary is affected by mounts and volumes.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 06: bridge network

State which Docker object or host boundary is affected by bridge network.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 07: port publishing

State which Docker object or host boundary is affected by port publishing.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 08: Compose configuration

State which Docker object or host boundary is affected by Compose configuration.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 09: daemon socket

State which Docker object or host boundary is affected by daemon socket.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 10: registry access

State which Docker object or host boundary is affected by registry access.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 11: rootless mode

State which Docker object or host boundary is affected by rootless mode.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 12: seccomp and capabilities

State which Docker object or host boundary is affected by seccomp and capabilities.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 13: logs and events

State which Docker object or host boundary is affected by logs and events.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 14: cleanup and rollback

State which Docker object or host boundary is affected by cleanup and rollback.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 15: image provenance

State which Docker object or host boundary is affected by image provenance.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 16: build context

State which Docker object or host boundary is affected by build context.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.