Wiki workshop · Αγγλικά

Docker Exercises: Advanced Security (EN)

These exercises belong to the workshop level Advanced Security. Every task requires traceable evidence: command, expected state, observed state, assessment and cleanup.

Γλώσσα περιεχομένου · ΑγγλικάΜέγεθος · 73.0 KBexercises/04-advanced-security-exercises-docker-EN.md

Παραδείγματα workshop σε ZIP

Πρόοδος μάθησης στη web app

Σημειώστε κεφάλαια ως αναγνωσμένα, δείτε την πρόοδο ανάγνωσης και ολοκληρώστε πρακτικές ενότητες αφού ενεργοποιήσετε την προαιρετική web app. Η πρόοδος του workshop υπολογίζεται από τα κεφάλαια όλων των σελίδων τεκμηρίωσης. Οι επιλογές μένουν σε αυτή τη συσκευή· δεν υπάρχει λογαριασμός ή συγχρονισμός με server. Δεν απαιτείται εγκατάσταση. Η ανάκληση στις Ρυθμίσεις απορρήτου διαγράφει την πρόοδο.

Πρόοδος ανάγνωσης0%

0%

0 / 6 κεφάλαια που διαβάστηκαν

Δεν υπάρχει ακόμη ελληνική έκδοση αυτού του εγγράφου. Το περιεχόμενο εμφανίζεται στα αγγλικά.

Άλλη γλωσσική έκδοσηΓερμανικά ↗Ελληνικά ↗

Docker Exercises: Advanced Security (EN)

These exercises belong to the workshop level Advanced Security. Every task requires traceable evidence: command, expected state, observed state, assessment and cleanup.

Submission Format

Do not store production secrets. Document instead:

commands used,
relevant outputs,
affected Docker resources,
assessment of persistence, networking, permissions and cleanup,
open questions or assumptions.

Required Tasks

Task 01: Rootless

Goal: Examine Rootless in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 02: User Namespaces

Goal: Examine User Namespaces in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 03: Seccomp

Goal: Examine Seccomp in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 04: AppArmor

Goal: Examine AppArmor in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 05: Socket-Schutz

Goal: Examine Socket-Schutz in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 06: Supply Chain

Goal: Examine Supply Chain in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 07: Rootless

Goal: Examine Rootless in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 08: User Namespaces

Goal: Examine User Namespaces in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 09: Seccomp

Goal: Examine Seccomp in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 10: AppArmor

Goal: Examine AppArmor in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 11: Socket-Schutz

Goal: Examine Socket-Schutz in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 12: Supply Chain

Goal: Examine Supply Chain in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 13: Rootless

Goal: Examine Rootless in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 14: User Namespaces

Goal: Examine User Namespaces in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 15: Seccomp

Goal: Examine Seccomp in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 16: AppArmor

Goal: Examine AppArmor in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 17: Socket-Schutz

Goal: Examine Socket-Schutz in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 18: Supply Chain

Goal: Examine Supply Chain in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 19: Rootless

Goal: Examine Rootless in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 20: User Namespaces

Goal: Examine User Namespaces in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 21: Seccomp

Goal: Examine Seccomp in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 22: AppArmor

Goal: Examine AppArmor in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 23: Socket-Schutz

Goal: Examine Socket-Schutz in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Task 24: Supply Chain

Goal: Examine Supply Chain in an isolated Docker lab and document the effect.

Read the matching documentation in docs/ and at least one example in examples/.
Before executing, state which Docker resource should be created, changed or checked.
Run an appropriate docker or docker compose command, or explain why you only simulate it.
Prove state with docker inspect, docker ps, docker logs, docker network inspect, docker volume inspect or docker compose config.
Describe cleanup and perform it in the lab environment if resources were created.

Success criterion: Another person can follow your steps without guessing host state.

Practice Appendix: Advanced Security Exercises

This appendix provides a backlog for longer trainings, reviews and repetition. Each task is deliberately small so it can be verified and discussed independently.

A001. Rootless

Task: document context and desired state and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A002. User Namespaces

Task: explain the command before running it and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A003. Seccomp

Task: prove current state with inspect and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A004. AppArmor

Task: capture logs and exit code and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A005. Socket-Schutz

Task: sketch the network path and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A006. Supply Chain

Task: check the volume lifecycle and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A007. Docker Engine

Task: assess image provenance and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A008. Docker CLI

Task: distinguish tag and digest and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A009. Docker Daemon

Task: explain build cache impact and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A010. Image

Task: write down rollback or cleanup path and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A011. Container

Task: name the security impact and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A012. Dockerfile

Task: rate the operational risk and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A013. Build Context

Task: document context and desired state and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A014. Layer

Task: explain the command before running it and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A015. Tag and Digest

Task: prove current state with inspect and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A016. Registry

Task: capture logs and exit code and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A017. Network

Task: sketch the network path and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A018. Volume

Task: check the volume lifecycle and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A019. Bind Mount

Task: assess image provenance and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A020. Compose

Task: distinguish tag and digest and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A021. Rootless Mode

Task: explain build cache impact and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A022. Socket

Task: write down rollback or cleanup path and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A023. Rootless

Task: name the security impact and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A024. User Namespaces

Task: rate the operational risk and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A025. Seccomp

Task: document context and desired state and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A026. AppArmor

Task: explain the command before running it and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A027. Socket-Schutz

Task: prove current state with inspect and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A028. Supply Chain

Task: capture logs and exit code and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A029. Docker Engine

Task: sketch the network path and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A030. Docker CLI

Task: check the volume lifecycle and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A031. Docker Daemon

Task: assess image provenance and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A032. Image

Task: distinguish tag and digest and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A033. Container

Task: explain build cache impact and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A034. Dockerfile

Task: write down rollback or cleanup path and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A035. Build Context

Task: name the security impact and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A036. Layer

Task: rate the operational risk and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A037. Tag and Digest

Task: document context and desired state and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A038. Registry

Task: explain the command before running it and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A039. Network

Task: prove current state with inspect and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A040. Volume

Task: capture logs and exit code and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A041. Bind Mount

Task: sketch the network path and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A042. Compose

Task: check the volume lifecycle and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A043. Rootless Mode

Task: assess image provenance and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A044. Socket

Task: distinguish tag and digest and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A045. Rootless

Task: explain build cache impact and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A046. User Namespaces

Task: write down rollback or cleanup path and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A047. Seccomp

Task: name the security impact and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A048. AppArmor

Task: rate the operational risk and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A049. Socket-Schutz

Task: document context and desired state and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A050. Supply Chain

Task: explain the command before running it and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A051. Docker Engine

Task: prove current state with inspect and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A052. Docker CLI

Task: capture logs and exit code and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A053. Docker Daemon

Task: sketch the network path and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A054. Image

Task: check the volume lifecycle and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A055. Container

Task: assess image provenance and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A056. Dockerfile

Task: distinguish tag and digest and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A057. Build Context

Task: explain build cache impact and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A058. Layer

Task: write down rollback or cleanup path and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A059. Tag and Digest

Task: name the security impact and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A060. Registry

Task: rate the operational risk and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A061. Network

Task: document context and desired state and explicitly relate the observation to Network.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A062. Volume

Task: explain the command before running it and explicitly relate the observation to Volume.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A063. Bind Mount

Task: prove current state with inspect and explicitly relate the observation to Bind Mount.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A064. Compose

Task: capture logs and exit code and explicitly relate the observation to Compose.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A065. Rootless Mode

Task: sketch the network path and explicitly relate the observation to Rootless Mode.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A066. Socket

Task: check the volume lifecycle and explicitly relate the observation to Socket.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A067. Rootless

Task: assess image provenance and explicitly relate the observation to Rootless.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A068. User Namespaces

Task: distinguish tag and digest and explicitly relate the observation to User Namespaces.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A069. Seccomp

Task: explain build cache impact and explicitly relate the observation to Seccomp.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A070. AppArmor

Task: write down rollback or cleanup path and explicitly relate the observation to AppArmor.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A071. Socket-Schutz

Task: name the security impact and explicitly relate the observation to Socket-Schutz.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A072. Supply Chain

Task: rate the operational risk and explicitly relate the observation to Supply Chain.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A073. Docker Engine

Task: document context and desired state and explicitly relate the observation to Docker Engine.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A074. Docker CLI

Task: explain the command before running it and explicitly relate the observation to Docker CLI.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A075. Docker Daemon

Task: prove current state with inspect and explicitly relate the observation to Docker Daemon.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A076. Image

Task: capture logs and exit code and explicitly relate the observation to Image.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A077. Container

Task: sketch the network path and explicitly relate the observation to Container.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A078. Dockerfile

Task: check the volume lifecycle and explicitly relate the observation to Dockerfile.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A079. Build Context

Task: assess image provenance and explicitly relate the observation to Build Context.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A080. Layer

Task: distinguish tag and digest and explicitly relate the observation to Layer.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A081. Tag and Digest

Task: explain build cache impact and explicitly relate the observation to Tag and Digest.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

A082. Registry

Task: write down rollback or cleanup path and explicitly relate the observation to Registry.
Evidence: Write down at least one Docker command, one expected result and one limit of that evidence.
Operations question: What would a wrong assumption change in a CI runner, on a developer workstation and on a shared host?
Security question: Which permission, secret or host path is most sensitive in this step?
Cleanup: Describe which containers, images, networks, volumes or temporary files must be removed.

Official Sources and Scope

The material is aligned with public Docker documentation. When the workshop mentions external tools around Docker Engine, those tools are presented as adjacent operational practice, not as Docker Engine features.

Docker Engine: https://docs.docker.com/engine/
Dockerfile Reference: https://docs.docker.com/reference/dockerfile/
Compose File Reference: https://docs.docker.com/reference/compose-file/
Compose Specification: https://github.com/compose-spec/compose-spec/blob/master/spec.md
Docker Engine Security: https://docs.docker.com/engine/security/
Docker Rootless Mode: https://docs.docker.com/engine/security/rootless/
Protect the Docker Daemon Socket: https://docs.docker.com/engine/security/protect-access/
Docker Build Best Practices: https://docs.docker.com/build/building/best-practices/
Docker Training: https://www.docker.com/trainings/

Additional Review Drills

Use these drills when the primary task is complete and the learner needs another pass over operational reasoning. They are intentionally evidence-oriented and can be answered without inventing platform behavior.

Drill 01: image provenance

State which Docker object or host boundary is affected by image provenance.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 02: build context

State which Docker object or host boundary is affected by build context.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 03: layer ordering

State which Docker object or host boundary is affected by layer ordering.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 04: container user

State which Docker object or host boundary is affected by container user.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 05: mounts and volumes

State which Docker object or host boundary is affected by mounts and volumes.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 06: bridge network

State which Docker object or host boundary is affected by bridge network.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 07: port publishing

State which Docker object or host boundary is affected by port publishing.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 08: Compose configuration

State which Docker object or host boundary is affected by Compose configuration.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 09: daemon socket

State which Docker object or host boundary is affected by daemon socket.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 10: registry access

State which Docker object or host boundary is affected by registry access.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 11: rootless mode

State which Docker object or host boundary is affected by rootless mode.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 12: seccomp and capabilities

State which Docker object or host boundary is affected by seccomp and capabilities.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 13: logs and events

State which Docker object or host boundary is affected by logs and events.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 14: cleanup and rollback

State which Docker object or host boundary is affected by cleanup and rollback.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 15: image provenance

State which Docker object or host boundary is affected by image provenance.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

Drill 16: build context

State which Docker object or host boundary is affected by build context.
Name one command that produces evidence and one field in the output that matters.
Explain what can be concluded from that evidence and what cannot be concluded from it.
Describe the safest cleanup path for a shared training host.

DKR · Orthevs Academy

31 modules ως ενιαία διαδρομή μάθησης.

Η σειρά παραμένει αμετάβλητη: από τη βασική δομή του lab μέσω τεχνικών θεμελίων και λειτουργικών μοντέλων έως το τελικό troubleshooting. Τα τεχνικά ονόματα καταλόγων διατηρούνται σκόπιμα.

Πρακτικά modules