Docker Hands-On Labs

Run and inspect your first containers, then build a small image and publish its port.

Beginner · 20 min

Monitoring gives you one host PID and nothing else. Work back to the container it belongs to without restarting it.

Intermediate · 25 min

Two containers are down for two different reasons. Diagnose both from evidence, repair them, and drive a container through every state it has.

Intermediate · 30 min

Take a real Node service from source code to a running, published container — writing the Dockerfile yourself.

Beginner · 35 min

A Dockerfile that builds cleanly and is wrong five ways. Find them from the built image, not from reading, and fix them without changing what the app does.

Intermediate · 35 min

A working image that ships a build cache, a git directory and a developer's .env. Cut the context, split the build, and prove the runtime carries only what runs.

Intermediate · 40 min

Half your team is on arm64 laptops and the servers are amd64. Publish one image reference that serves both, find out where the emulation actually lives, then stop needing it.

Intermediate · 45 min

A repository with no container tooling and a list of production requirements. Produce a release-quality image and defend your choices. Requirements only — no procedure.

Advanced · 75 min

Take a backup of a live PostgreSQL container, delete the container and its volume for real, and bring the data back — verified against a checksum you recorded first.

Intermediate · 40 min

A database hardened to run non-root will not start against its mounted directory. Find the ownership mismatch and repair it without handing root back or making the data world-writable.

Intermediate · 30 min

Connect containers by name on a private bridge network, and prove data survives container replacement with a named volume.

Intermediate · 25 min

Split an application across edge, app and data networks so a compromised gateway has no route to the database — then test the paths that are supposed to fail.

Intermediate · 35 min

Three faults on one request path — a name that will not resolve, a process on the wrong address, and a port mapping to nowhere. Repair all three without flattening the network.

Intermediate · 40 min

Define the Status API plus PostgreSQL as one Compose stack: private network, named volume, environment config, and health-aware startup.

Intermediate · 60 min

One stack, two environments, optional extras that cost nothing when unused — and a database password that stops living in the file.

Intermediate · 40 min

Three replicas behind Nginx. One problem announces itself with an error; the other is silent and is the one that matters.

Intermediate · 40 min

You inherit a deployment that does not work. Several things in the Compose file are wrong, some loudly and some silently. Existing data must survive the repair.

Advanced · 90 min

Every deploy drops requests because SIGTERM never reaches the application. Find it in the exit code, fix PID 1, and prove the stop is clean.

Intermediate · 35 min

Give a service a real healthcheck, enforce CPU and memory limits, and run it without root.

Advanced · 25 min

Slow, restarting, and a disk filling up. Work out which of the three is the cause, restore service, and keep the evidence.

Advanced · 40 min

A service running as root with every default capability and a writable filesystem. Apply the four controls and keep it serving.

Advanced · 35 min

A credential reached a published image. Find it with a scanner, ship a clean rebuild that never contained it, and leave behind an SBOM and a provenance record that name the exact digest.

Advanced · 60 min

A credential was copied into an image and deleted in the next instruction. Find it in the layer that still has it, rebuild without it, and harden what runs.

Advanced · 40 min

Push one build under several tags to a private registry, prove they all name the same bytes, then delete every local copy and pull it back by digest.

Intermediate · 45 min

Wire build, test, scan and publish into one script that fails fast, refuses to ship a broken revision, and tags every release immutably.

Advanced · 75 min

Promote a tested release without rebuilding, deploy one that passes its health check and answers wrongly, and get back in two minutes.

Advanced · 40 min

Source to a hardened, scanned, signed, published release — then deploy it, find it faulty, and recover by rolling back to a digest you can prove was verified.

Advanced · 120 min

A production-like stack is down. Diagnose it, restore service, then harden the image and runtime and prove it survives a database restart.

Advanced · 90 min