Docker Solution: Advanced Security (EN)

This solution guide belongs to the assessment Advanced Security. It does not provide one rigid answer; it defines verifiable answer criteria.

Grading Rubric

Area	Expectation
Terms	Docker resources are named correctly.
Evidence	Answers mention concrete commands and interpretable outputs.
Operations	Persistence, networking, logs and cleanup are covered.
Security	Socket, permissions, user, secrets and host paths are assessed.

Sample Criteria

Solution 01: Rootless

A strong answer for Rootless names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 02: User Namespaces

A strong answer for User Namespaces names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 03: Seccomp

A strong answer for Seccomp names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 04: AppArmor

A strong answer for AppArmor names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 05: Socket-Schutz

A strong answer for Socket-Schutz names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 06: Supply Chain

A strong answer for Supply Chain names the affected Docker resource, uses at least one matching inspect or Compose command, separates image, container, network and volume state and describes explicit cleanup.

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 07: Rootless

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 08: User Namespaces

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 09: Seccomp

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 10: AppArmor

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 11: Socket-Schutz

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 12: Supply Chain

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 13: Rootless

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 14: User Namespaces

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 15: Seccomp

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 16: AppArmor

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 17: Socket-Schutz

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 18: Supply Chain

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 19: Rootless

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 20: User Namespaces

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 21: Seccomp

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 22: AppArmor

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 23: Socket-Schutz

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 24: Supply Chain

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 25: Rootless

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 26: User Namespaces

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 27: Seccomp

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 28: AppArmor

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 29: Socket-Schutz

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 30: Supply Chain

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 31: Rootless

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 32: User Namespaces

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 33: Seccomp

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 34: AppArmor

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 35: Socket-Schutz

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 36: Supply Chain

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 37: Rootless

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 38: User Namespaces

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 39: Seccomp

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Solution 40: AppArmor

Good evidence: concrete output or field from docker inspect, docker logs, docker compose config or docker events.
Common mistake: mentioning only a successful start without checking ports, mounts, user, exit code or cleanup.
Security expectation: no real secrets, no unnecessary privileges, no unreviewed host mounts and no casual Docker socket access.

Practice Appendix: Advanced Security Solution

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is deliberately small so it can be verified and discussed independently.

A001. Rootless

Task: document context and desired state and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A002. User Namespaces

Task: explain the command before running it and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A003. Seccomp

Task: prove current state with inspect and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A004. AppArmor

Task: capture logs and exit code and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A005. Socket-Schutz

Task: sketch the network path and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A006. Supply Chain

Task: check the volume lifecycle and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A007. Docker Engine

Task: assess image provenance and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A008. Docker CLI

Task: distinguish tag and digest and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A009. Docker Daemon

Task: explain build cache impact and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A010. Image

Task: write down rollback or cleanup path and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A011. Container

Task: name the security impact and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A012. Dockerfile

Task: rate the operational risk and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A013. Build Context

Task: document context and desired state and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A014. Layer

Task: explain the command before running it and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A015. Tag and Digest

Task: prove current state with inspect and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A016. Registry

Task: capture logs and exit code and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A017. Network

Task: sketch the network path and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A018. Volume

Task: check the volume lifecycle and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A019. Bind Mount

Task: assess image provenance and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A020. Compose

Task: distinguish tag and digest and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A021. Rootless Mode

Task: explain build cache impact and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A022. Socket

Task: write down rollback or cleanup path and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A023. Rootless

Task: name the security impact and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A024. User Namespaces

Task: rate the operational risk and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A025. Seccomp

Task: document context and desired state and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A026. AppArmor

Task: explain the command before running it and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A027. Socket-Schutz

Task: prove current state with inspect and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A028. Supply Chain

Task: capture logs and exit code and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A029. Docker Engine

Task: sketch the network path and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A030. Docker CLI

Task: check the volume lifecycle and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A031. Docker Daemon

Task: assess image provenance and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A032. Image

Task: distinguish tag and digest and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A033. Container

Task: explain build cache impact and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A034. Dockerfile

Task: write down rollback or cleanup path and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A035. Build Context

Task: name the security impact and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A036. Layer

Task: rate the operational risk and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A037. Tag and Digest

Task: document context and desired state and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A038. Registry

Task: explain the command before running it and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A039. Network

Task: prove current state with inspect and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A040. Volume

Task: capture logs and exit code and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A041. Bind Mount

Task: sketch the network path and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A042. Compose

Task: check the volume lifecycle and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A043. Rootless Mode

Task: assess image provenance and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A044. Socket

Task: distinguish tag and digest and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A045. Rootless

Task: explain build cache impact and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A046. User Namespaces

Task: write down rollback or cleanup path and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A047. Seccomp

Task: name the security impact and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A048. AppArmor

Task: rate the operational risk and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A049. Socket-Schutz

Task: document context and desired state and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A050. Supply Chain

Task: explain the command before running it and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A051. Docker Engine

Task: prove current state with inspect and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A052. Docker CLI

Task: capture logs and exit code and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A053. Docker Daemon

Task: sketch the network path and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A054. Image

Task: check the volume lifecycle and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A055. Container

Task: assess image provenance and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A056. Dockerfile

Task: distinguish tag and digest and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A057. Build Context

Task: explain build cache impact and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A058. Layer

Task: write down rollback or cleanup path and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A059. Tag and Digest

Task: name the security impact and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A060. Registry

Task: rate the operational risk and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A061. Network

Task: document context and desired state and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A062. Volume

Task: explain the command before running it and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A063. Bind Mount

Task: prove current state with inspect and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A064. Compose

Task: capture logs and exit code and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A065. Rootless Mode

Task: sketch the network path and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A066. Socket

Task: check the volume lifecycle and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A067. Rootless

Task: assess image provenance and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A068. User Namespaces

Task: distinguish tag and digest and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A069. Seccomp

Task: explain build cache impact and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A070. AppArmor

Task: write down rollback or cleanup path and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A071. Socket-Schutz

Task: name the security impact and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A072. Supply Chain

Task: rate the operational risk and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

Official Sources and Scope

The material is aligned with public Docker documentation. When the workshop mentions external tools around Docker Engine, those tools are presented as adjacent operational practice, not as Docker Engine features.

Docker Engine: https://docs.docker.com/engine/
Dockerfile Reference: https://docs.docker.com/reference/dockerfile/
Compose File Reference: https://docs.docker.com/reference/compose-file/
Compose Specification: https://github.com/compose-spec/compose-spec/blob/master/spec.md
Docker Engine Security: https://docs.docker.com/engine/security/
Docker Rootless Mode: https://docs.docker.com/engine/security/rootless/
Protect the Docker Daemon Socket: https://docs.docker.com/engine/security/protect-access/
Docker Build Best Practices: https://docs.docker.com/build/building/best-practices/
Docker Training: https://www.docker.com/trainings/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered without inventing platform behavior.

Drill 01: image provenance

State which Docker object or host boundary is affected by image provenance.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 02: build context

State which Docker object or host boundary is affected by build context.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 03: layer ordering

State which Docker object or host boundary is affected by layer ordering.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 04: container user

State which Docker object or host boundary is affected by container user.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 05: mounts and volumes

State which Docker object or host boundary is affected by mounts and volumes.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 06: bridge network

State which Docker object or host boundary is affected by bridge network.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 07: port publishing

State which Docker object or host boundary is affected by port publishing.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 08: Compose configuration

State which Docker object or host boundary is affected by Compose configuration.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 09: daemon socket

State which Docker object or host boundary is affected by daemon socket.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 10: registry access

State which Docker object or host boundary is affected by registry access.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 11: rootless mode

State which Docker object or host boundary is affected by rootless mode.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 12: seccomp and capabilities

State which Docker object or host boundary is affected by seccomp and capabilities.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 13: logs and events

State which Docker object or host boundary is affected by logs and events.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 14: cleanup and rollback

State which Docker object or host boundary is affected by cleanup and rollback.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 15: image provenance

State which Docker object or host boundary is affected by image provenance.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 16: build context

State which Docker object or host boundary is affected by build context.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.