Foundations
Docker
11 labs · 6h 40mContainers from first principles — build them, run them, network them, and debug them when they will not start.
- Assumes
- Linux Administration
A container is a process with a different view of the filesystem and the network. Once that lands, image layers, networking, and volumes stop being magic and start being consequences.
First principles is the three labs that make containers stop being magic. Data, builds, and limits is what you need before running one in anger — persistence, build caching, resource ceilings, and pulls you can reproduce. Ship it, then debug it covers Compose, the debugging routine for a container that will not start, the hardening you should apply by default, and a challenge.
Everything runs on your machine. Nothing is deployed and nothing costs money — the registry lab runs its own registry in a container.
The labs, in order
First principles1h 35m
- Run your first container and inspect itStart a container, get a shell inside it, and prove from the host that it is an ordinary process.20mBeginner
- Build a small image with a multi-stage DockerfileBuild the same Go service two ways and measure why the build toolchain should not ship to production.35mBeginner
- Wire two containers together on a network you definePut a service and a Postgres instance on a user-defined network, resolve one from the other by name, and watch what a volume survives.40mIntermediate
Data, builds, and limits2h 25m
- Persist data properly, and meet the UID problemCompare a named volume against a bind mount, then fix the permission denied that every bind mount eventually gives you.40mIntermediate
- Make builds fast with layers and cacheWatch a one-line source change rebuild everything, then reorder the Dockerfile so it rebuilds almost nothing.35mIntermediate
- Cap what a container can takeSet memory and CPU limits, then get a container OOM-killed on purpose so you recognise the evidence it leaves.35mIntermediate
- Tags lie — pull by digest insteadRun your own registry, push two different images under the same tag, and see why :latest is not a version.35mIntermediate
Ship it, then debug it2h 40m
- Declare the stack with ComposeReplace eight docker run flags with one file, then add a healthcheck so the app waits for the database instead of crash-looping.40mIntermediate
- Debug a container that will not startWork through five containers that each fail differently, and learn the exit codes and commands that identify each in seconds.40mIntermediate
- Run it as nobody, with a read-only filesystemHarden a container to non-root, read-only rootfs and no capabilities, then prove each restriction holds by trying to break it.40mIntermediate
- Challenge: works on my machineAn image runs on your laptop and fails in a clean environment. Four faults, all of them things this track already showed you.40mChallengeIntermediate
Done in order, the track is about 6h 40m of work.