Target State

You should not treat Docker as a loose command collection. The important model is the boundary: Docker CLI talks to Docker Engine, Docker Engine manages images, containers, networks and volumes, and daemon access is security-sensitive. The document connects concept, workflow, evidence and cleanup.

Focus

• Architekturbilder
• Build-Fluss
• Run-Fluss
• Compose-Topologie
• Security-Grenzen

Core Terms

Working Model

1. Describe the desired state: build an image, start a container, attach a network, provide a volume or define a Compose project.
2. Check context: docker context ls, docker version, registry access, current directory and build context.
3. Execute the change and record the exact command.
4. Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose ps.
5. Assess security, persistence and cleanup before closing the exercise.

Reference Commands

# Check environment and client
docker version
docker context ls
docker info

# Inspect images, containers, networks and volumes
docker image ls
docker ps -a
docker network ls
docker volume ls

# Start a controlled disposable container
docker run --name docker-workshop-smoke --rm alpine:3.20 sh -c 'echo ok && id && uname -a'

# Use no-cache builds only in labs when you can explain the impact
docker build --progress=plain -t local/docker-workshop:lab .

# Validate a Compose project before leaving anything running
docker compose config
docker compose up --detach
docker compose ps
docker compose down --volumes

Typical Decisions

Operations Notes

• Docker containers are not tiny virtual machines; they share the host kernel.
• A container stops when its main process exits. This is central for ENTRYPOINT and CMD.
• Docker stores persistent data reliably outside the container layer only when volumes or intentional bind mounts are used.
• Compose files should be normalized with docker compose config before teams share them.
• Access to /var/run/docker.sock is not a harmless convenience; it is broad host-level power.

Scope Boundary

This document covers Docker Engine and direct Docker workflows. Kubernetes, containerd administration, registry-server hardening and external security scanners are mentioned only where they explain Docker decisions or realistic operational boundaries.

Review Checklist for Diagrams

• 01. document context and desired state: record the affected Docker resource, the command that proves state and the rollback path.
• 02. explain the command before running it: record the affected Docker resource, the command that proves state and the rollback path.
• 03. prove current state with inspect: record the affected Docker resource, the command that proves state and the rollback path.
• 04. capture logs and exit code: record the affected Docker resource, the command that proves state and the rollback path.
• 05. sketch the network path: record the affected Docker resource, the command that proves state and the rollback path.
• 06. check the volume lifecycle: record the affected Docker resource, the command that proves state and the rollback path.
• 07. assess image provenance: record the affected Docker resource, the command that proves state and the rollback path.
• 08. distinguish tag and digest: record the affected Docker resource, the command that proves state and the rollback path.
• 09. explain build cache impact: record the affected Docker resource, the command that proves state and the rollback path.
• 10. write down rollback or cleanup path: record the affected Docker resource, the command that proves state and the rollback path.
• 11. name the security impact: record the affected Docker resource, the command that proves state and the rollback path.
• 12. rate the operational risk: record the affected Docker resource, the command that proves state and the rollback path.
• 13. document context and desired state: record the affected Docker resource, the command that proves state and the rollback path.
• 14. explain the command before running it: record the affected Docker resource, the command that proves state and the rollback path.
• 15. prove current state with inspect: record the affected Docker resource, the command that proves state and the rollback path.
• 16. capture logs and exit code: record the affected Docker resource, the command that proves state and the rollback path.
• 17. sketch the network path: record the affected Docker resource, the command that proves state and the rollback path.
• 18. check the volume lifecycle: record the affected Docker resource, the command that proves state and the rollback path.
• 19. assess image provenance: record the affected Docker resource, the command that proves state and the rollback path.
• 20. distinguish tag and digest: record the affected Docker resource, the command that proves state and the rollback path.
• 21. explain build cache impact: record the affected Docker resource, the command that proves state and the rollback path.
• 22. write down rollback or cleanup path: record the affected Docker resource, the command that proves state and the rollback path.
• 23. name the security impact: record the affected Docker resource, the command that proves state and the rollback path.
• 24. rate the operational risk: record the affected Docker resource, the command that proves state and the rollback path.
• 25. document context and desired state: record the affected Docker resource, the command that proves state and the rollback path.
• 26. explain the command before running it: record the affected Docker resource, the command that proves state and the rollback path.
• 27. prove current state with inspect: record the affected Docker resource, the command that proves state and the rollback path.
• 28. capture logs and exit code: record the affected Docker resource, the command that proves state and the rollback path.
• 29. sketch the network path: record the affected Docker resource, the command that proves state and the rollback path.
• 30. check the volume lifecycle: record the affected Docker resource, the command that proves state and the rollback path.
• 31. assess image provenance: record the affected Docker resource, the command that proves state and the rollback path.
• 32. distinguish tag and digest: record the affected Docker resource, the command that proves state and the rollback path.
• 33. explain build cache impact: record the affected Docker resource, the command that proves state and the rollback path.
• 34. write down rollback or cleanup path: record the affected Docker resource, the command that proves state and the rollback path.
• 35. name the security impact: record the affected Docker resource, the command that proves state and the rollback path.
• 36. rate the operational risk: record the affected Docker resource, the command that proves state and the rollback path.
• 37. document context and desired state: record the affected Docker resource, the command that proves state and the rollback path.
• 38. explain the command before running it: record the affected Docker resource, the command that proves state and the rollback path.
• 39. prove current state with inspect: record the affected Docker resource, the command that proves state and the rollback path.
• 40. capture logs and exit code: record the affected Docker resource, the command that proves state and the rollback path.
• 41. sketch the network path: record the affected Docker resource, the command that proves state and the rollback path.
• 42. check the volume lifecycle: record the affected Docker resource, the command that proves state and the rollback path.
• 43. assess image provenance: record the affected Docker resource, the command that proves state and the rollback path.
• 44. distinguish tag and digest: record the affected Docker resource, the command that proves state and the rollback path.

Practice Appendix: Diagrams

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is deliberately small so it can be verified and discussed independently.

A001. Architekturbilder

• Task: document context and desired state and explicitly relate the observation to Architekturbilder.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A002. Build-Fluss

• Task: explain the command before running it and explicitly relate the observation to Build-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A003. Run-Fluss

• Task: prove current state with inspect and explicitly relate the observation to Run-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A004. Compose-Topologie

• Task: capture logs and exit code and explicitly relate the observation to Compose-Topologie.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A005. Security-Grenzen

• Task: sketch the network path and explicitly relate the observation to Security-Grenzen.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A006. Docker Engine

• Task: check the volume lifecycle and explicitly relate the observation to Docker Engine.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A007. Docker CLI

• Task: assess image provenance and explicitly relate the observation to Docker CLI.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A008. Docker Daemon

• Task: distinguish tag and digest and explicitly relate the observation to Docker Daemon.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A009. Image

• Task: explain build cache impact and explicitly relate the observation to Image.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A010. Container

• Task: write down rollback or cleanup path and explicitly relate the observation to Container.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A011. Dockerfile

• Task: name the security impact and explicitly relate the observation to Dockerfile.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A012. Build Context

• Task: rate the operational risk and explicitly relate the observation to Build Context.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A013. Layer

• Task: document context and desired state and explicitly relate the observation to Layer.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A014. Tag and Digest

• Task: explain the command before running it and explicitly relate the observation to Tag and Digest.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A015. Registry

• Task: prove current state with inspect and explicitly relate the observation to Registry.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A016. Network

• Task: capture logs and exit code and explicitly relate the observation to Network.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A017. Volume

• Task: sketch the network path and explicitly relate the observation to Volume.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A018. Bind Mount

• Task: check the volume lifecycle and explicitly relate the observation to Bind Mount.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A019. Compose

• Task: assess image provenance and explicitly relate the observation to Compose.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A020. Rootless Mode

• Task: distinguish tag and digest and explicitly relate the observation to Rootless Mode.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A021. Socket

• Task: explain build cache impact and explicitly relate the observation to Socket.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A022. Architekturbilder

• Task: write down rollback or cleanup path and explicitly relate the observation to Architekturbilder.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A023. Build-Fluss

• Task: name the security impact and explicitly relate the observation to Build-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A024. Run-Fluss

• Task: rate the operational risk and explicitly relate the observation to Run-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A025. Compose-Topologie

• Task: document context and desired state and explicitly relate the observation to Compose-Topologie.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A026. Security-Grenzen

• Task: explain the command before running it and explicitly relate the observation to Security-Grenzen.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A027. Docker Engine

• Task: prove current state with inspect and explicitly relate the observation to Docker Engine.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A028. Docker CLI

• Task: capture logs and exit code and explicitly relate the observation to Docker CLI.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A029. Docker Daemon

• Task: sketch the network path and explicitly relate the observation to Docker Daemon.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A030. Image

• Task: check the volume lifecycle and explicitly relate the observation to Image.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A031. Container

• Task: assess image provenance and explicitly relate the observation to Container.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A032. Dockerfile

• Task: distinguish tag and digest and explicitly relate the observation to Dockerfile.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A033. Build Context

• Task: explain build cache impact and explicitly relate the observation to Build Context.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A034. Layer

• Task: write down rollback or cleanup path and explicitly relate the observation to Layer.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A035. Tag and Digest

• Task: name the security impact and explicitly relate the observation to Tag and Digest.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A036. Registry

• Task: rate the operational risk and explicitly relate the observation to Registry.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A037. Network

• Task: document context and desired state and explicitly relate the observation to Network.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A038. Volume

• Task: explain the command before running it and explicitly relate the observation to Volume.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A039. Bind Mount

• Task: prove current state with inspect and explicitly relate the observation to Bind Mount.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A040. Compose

• Task: capture logs and exit code and explicitly relate the observation to Compose.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A041. Rootless Mode

• Task: sketch the network path and explicitly relate the observation to Rootless Mode.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A042. Socket

• Task: check the volume lifecycle and explicitly relate the observation to Socket.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A043. Architekturbilder

• Task: assess image provenance and explicitly relate the observation to Architekturbilder.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A044. Build-Fluss

• Task: distinguish tag and digest and explicitly relate the observation to Build-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A045. Run-Fluss

• Task: explain build cache impact and explicitly relate the observation to Run-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A046. Compose-Topologie

• Task: write down rollback or cleanup path and explicitly relate the observation to Compose-Topologie.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A047. Security-Grenzen

• Task: name the security impact and explicitly relate the observation to Security-Grenzen.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A048. Docker Engine

• Task: rate the operational risk and explicitly relate the observation to Docker Engine.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A049. Docker CLI

• Task: document context and desired state and explicitly relate the observation to Docker CLI.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A050. Docker Daemon

• Task: explain the command before running it and explicitly relate the observation to Docker Daemon.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A051. Image

• Task: prove current state with inspect and explicitly relate the observation to Image.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A052. Container

• Task: capture logs and exit code and explicitly relate the observation to Container.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A053. Dockerfile

• Task: sketch the network path and explicitly relate the observation to Dockerfile.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A054. Build Context

• Task: check the volume lifecycle and explicitly relate the observation to Build Context.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A055. Layer

• Task: assess image provenance and explicitly relate the observation to Layer.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A056. Tag and Digest

• Task: distinguish tag and digest and explicitly relate the observation to Tag and Digest.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A057. Registry

• Task: explain build cache impact and explicitly relate the observation to Registry.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A058. Network

• Task: write down rollback or cleanup path and explicitly relate the observation to Network.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A059. Volume

• Task: name the security impact and explicitly relate the observation to Volume.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A060. Bind Mount

• Task: rate the operational risk and explicitly relate the observation to Bind Mount.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A061. Compose

• Task: document context and desired state and explicitly relate the observation to Compose.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A062. Rootless Mode

• Task: explain the command before running it and explicitly relate the observation to Rootless Mode.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A063. Socket

• Task: prove current state with inspect and explicitly relate the observation to Socket.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A064. Architekturbilder

• Task: capture logs and exit code and explicitly relate the observation to Architekturbilder.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A065. Build-Fluss

• Task: sketch the network path and explicitly relate the observation to Build-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A066. Run-Fluss

• Task: check the volume lifecycle and explicitly relate the observation to Run-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A067. Compose-Topologie

• Task: assess image provenance and explicitly relate the observation to Compose-Topologie.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A068. Security-Grenzen

• Task: distinguish tag and digest and explicitly relate the observation to Security-Grenzen.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A069. Docker Engine

• Task: explain build cache impact and explicitly relate the observation to Docker Engine.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A070. Docker CLI

• Task: write down rollback or cleanup path and explicitly relate the observation to Docker CLI.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A071. Docker Daemon

• Task: name the security impact and explicitly relate the observation to Docker Daemon.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A072. Image

• Task: rate the operational risk and explicitly relate the observation to Image.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A073. Container

• Task: document context and desired state and explicitly relate the observation to Container.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A074. Dockerfile

• Task: explain the command before running it and explicitly relate the observation to Dockerfile.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A075. Build Context

• Task: prove current state with inspect and explicitly relate the observation to Build Context.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A076. Layer

• Task: capture logs and exit code and explicitly relate the observation to Layer.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A077. Tag and Digest

• Task: sketch the network path and explicitly relate the observation to Tag and Digest.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A078. Registry

• Task: check the volume lifecycle and explicitly relate the observation to Registry.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A079. Network

• Task: assess image provenance and explicitly relate the observation to Network.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A080. Volume

• Task: distinguish tag and digest and explicitly relate the observation to Volume.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A081. Bind Mount

• Task: explain build cache impact and explicitly relate the observation to Bind Mount.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A082. Compose

• Task: write down rollback or cleanup path and explicitly relate the observation to Compose.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A083. Rootless Mode

• Task: name the security impact and explicitly relate the observation to Rootless Mode.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A084. Socket

• Task: rate the operational risk and explicitly relate the observation to Socket.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A085. Architekturbilder

• Task: document context and desired state and explicitly relate the observation to Architekturbilder.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A086. Build-Fluss

• Task: explain the command before running it and explicitly relate the observation to Build-Fluss.
• Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
• Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
• Security question: Which permission, secret or host path is most sensitive in this step?
• Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

Official Sources and Scope

The material is aligned with public Docker documentation. When the workshop mentions external tools around Docker Engine, those tools are presented as adjacent operational practice, not as Docker Engine features.

• Docker Engine: https://docs.docker.com/engine/
• Dockerfile Reference: https://docs.docker.com/reference/dockerfile/
• Compose File Reference: https://docs.docker.com/reference/compose-file/
• Compose Specification: https://github.com/compose-spec/compose-spec/blob/master/spec.md
• Docker Engine Security: https://docs.docker.com/engine/security/
• Docker Rootless Mode: https://docs.docker.com/engine/security/rootless/
• Protect the Docker Daemon Socket: https://docs.docker.com/engine/security/protect-access/
• Docker Build Best Practices: https://docs.docker.com/build/building/best-practices/
• Docker Training: https://www.docker.com/trainings/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered without inventing platform behavior.

Drill 01: image provenance

• State which Docker object or host boundary is affected by image provenance.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 02: build context

• State which Docker object or host boundary is affected by build context.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 03: layer ordering

• State which Docker object or host boundary is affected by layer ordering.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 04: container user

• State which Docker object or host boundary is affected by container user.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 05: mounts and volumes

• State which Docker object or host boundary is affected by mounts and volumes.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 06: bridge network

• State which Docker object or host boundary is affected by bridge network.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 07: port publishing

• State which Docker object or host boundary is affected by port publishing.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 08: Compose configuration

• State which Docker object or host boundary is affected by Compose configuration.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 09: daemon socket

• State which Docker object or host boundary is affected by daemon socket.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 10: registry access

• State which Docker object or host boundary is affected by registry access.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 11: rootless mode

• State which Docker object or host boundary is affected by rootless mode.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 12: seccomp and capabilities

• State which Docker object or host boundary is affected by seccomp and capabilities.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 13: logs and events

• State which Docker object or host boundary is affected by logs and events.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 14: cleanup and rollback

• State which Docker object or host boundary is affected by cleanup and rollback.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 15: image provenance

• State which Docker object or host boundary is affected by image provenance.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.

Drill 16: build context

• State which Docker object or host boundary is affected by build context.
• Name one command that produces evidence and one field in the output that matters.
• Explain what can be concluded from that evidence and what cannot be concluded from it.
• Describe the safest cleanup path for a shared training host.