Docker turned containers into everyday infrastructure, and the administrators who run it well are the ones who understand what sits underneath the CLI. This course builds that understanding in both directions: the Linux kernel features that make containers possible, namespaces, cgroups, OverlayFS, and the OCI runC runtime, and the day-to-day Docker workflow that rides on top of them. Because Red Hat Enterprise Linux 10 ships Podman rather than Docker, students install Docker Engine 29 from Docker's own packages and learn how the RHEL container landscape, including Podman, containerd, and CRI-O, relates to what they are running.
Coverage follows the full lifecycle of a containerized application. Students configure the Docker daemon through systemd drop-ins and daemon.json, protect the control socket with TLS certificates signed by a local CA, and apply capability, user, filesystem, SELinux, and seccomp restrictions to running containers. Image work spans registry operations, promotion by digest, multi-architecture platform images, commit and diff, save, load, export, and import, then moves into Dockerfile authoring in depth: build context, layer caching and cache mounts, ENTRYPOINT and CMD forms, HEALTHCHECK probes, and multi-stage builds that cut both image size and attack surface. Storage covers named volumes, bind mounts, tmpfs, and volume drivers. Orchestration covers YAML authoring and Docker Compose service sets, then Swarm mode on a real classroom cluster: services, rolling updates and rollback, stacks, secrets, quorum, and overlay networking. Networking and logging round out the Docker stack, from bridge networks, DNS resolution, and published ports through syslog, journald, Graylog, Fluentd, Splunk, and cloud provider log drivers. A closing chapter runs Podman beside Docker on the same host: the same images under both engines, rootless containers, Podman secrets without a swarm, and a web site served as a Quadlet unit under systemd.
Thirty guided lab exercises anchor the material, with hands-on work in every chapter: building containers by hand with runC, securing the daemon with TLS, hardening container privileges, promoting images by digest, optimizing build size and cache behavior, rolling a Swarm service forward and back, managing Swarm secrets, and publishing services on private networks. An appendix takes students through running their own registry, securing it with TLS and htpasswd authentication, and signing images with Cosign, now that Docker Content Trust has left the Docker 29 command line.