Docker & Containers · Operational reference
Toolkit
Operational artefacts for Docker & Containers: checklists for cadences, runbooks for incidents, hands-on labs for skills, and break/fix scenarios for troubleshooting reflexes. None of this replaces reading the corresponding lessons — these are the artefacts you keep open in a second tab during real work.
- Runbooks
- 24
- Checklists
- 13
- Labs
- 27
- Break/Fix
- 20
- Assessments
- 1
Operational checklists
Repetitive tasks performed on a schedule.
Before deployment
- Checklist: Compose stack production readiness24 items→
- Checklist: Container security review16 items→
- Checklist: Docker host production readiness11 items→
- Checklist: Container image production readiness10 items→
- Checklist: Registry and image-pull readiness21 items→
- Checklist: Container runtime upgrade readiness21 items→
- Checklist: Image supply chain verification25 items→
Runbooks
Step-by-step procedures. Treat the rollback as part of the procedure — never skip it.
Critical risk
- criticalservice affectingRunbook: Bad image deployment — roll back to the previous version~15 min · 12 steps · verified 2026-08-12→
- criticalcluster affectingRunbook: Compromised container response~60 min · 20 steps · verified 2026-08-12→
- criticalservice affectingRunbook: Rebuild a Docker host from scratch~180 min · 20 steps · verified 2026-08-12→
- criticaldata loss riskRunbook: Reclaim Docker disk space safely~30 min · 15 steps · verified 2026-08-12→
- criticaldata loss riskRunbook: Recover a corrupt image store or overlay2 layer~90 min · 16 steps · verified 2026-08-12→
- criticalservice affectingRunbook: Registry unavailable during deploy~30 min · 14 steps · verified 2026-08-12→
- criticalservice affectingRunbook: Respond to a leaked secret~90 min · 15 steps · verified 2026-08-12→
- criticalservice affectingRunbook: TLS certificate expired on production~20 min · 14 steps · verified 2026-08-12→
High risk
- highservice affectingRunbook: Certificate renewal failure~30 min · 14 steps · verified 2026-08-12→
- highservice affectingRunbook: dockerd will not start~30 min · 13 steps · verified 2026-08-12→
- highservice affectingRunbook: Disk full — what to do when the host runs out of space~15 min · 11 steps · verified 2026-08-12→
- highservice affectingRunbook: Migrate to the containerd image store~90 min · 17 steps · verified 2026-08-12→
- highdata loss riskRunbook: Restore a named volume from backup~45 min · 12 steps · verified 2026-08-12→
- highservice affectingRunbook: Roll back a Compose stack to a pinned digest~30 min · 11 steps · verified 2026-08-12→
- highservice affectingRunbook: Rotate registry credentials with no failed pulls~60 min · 15 steps · verified 2026-08-12→
- highservice affectingRunbook: Upgrade Docker Engine on a production host~60 min · 14 steps · verified 2026-08-12→
- highservice affectingRunbook: Vulnerable image response (CVE drop)~90 min · 16 steps · verified 2026-08-12→
Medium risk
- mediumservice affectingRunbook: Application container exits immediately after start~15 min · 4 steps · verified 2026-08-09→
- mediumservice affectingRunbook: Container unreachable — work down the network path in order~30 min · 10 steps · verified 2026-08-12→
- mediumservice affectingRunbook: Drain a Docker host for maintenance~45 min · 15 steps · verified 2026-08-12→
- mediumservice affectingRunbook: Health check flapping between healthy and unhealthy~25 min · 10 steps · verified 2026-08-12→
- mediumservice affectingRunbook: Host reboot — services do not come back~15 min · 13 steps · verified 2026-08-12→
- mediumservice affectingRunbook: Sustained high CPU — attribute it before you act~30 min · 10 steps · verified 2026-08-12→
- mediumservice affectingRunbook: Container OOM-killed — find what actually consumed the memory~25 min · 10 steps · verified 2026-08-12→
Hands-on labs
Time-boxed exercises.
B · Nested virtualisation
- Lab 1: Your first container — manual nsenter and unshare~45 min · 3 objectives→
- Lab 10: Compose secrets from files~20 min · 3 objectives→
- Lab 11: Observing an OOM kill with cgroup files~25 min · 3 objectives→
- Lab 12: Restart policies in practice~20 min · 2 objectives→
- Lab 13: Diagnose a bind-mount UID mismatch~20 min · 2 objectives→
- Lab 14: Validate firewall exposure for published ports~20 min · 3 objectives→
- Lab 15: Postgres backup consistency — pg_dump vs filesystem snapshot~30 min · 3 objectives→
- Lab 16: Recover from log-disk exhaustion~25 min · 3 objectives→
- Lab 17: Prometheus + cAdvisor + Grafana for container hosts~45 min · 3 objectives→
- Lab 18: Ship container logs to Loki~30 min · 2 objectives→
- Lab 19: Capabilities drop — minimum privilege for a service~20 min · 3 objectives→
- Lab 2: Inspecting cgroups — what limits actually apply~30 min · 3 objectives→
- Lab 20: Bad image deployment and rollback~25 min · 3 objectives→
- Lab 22: TLS certificate renewal with certbot~30 min · 3 objectives→
- Lab 23: Registry authentication failure~20 min · 2 objectives→
- Lab 24: Cosign image signing and verification~25 min · 3 objectives→
- Lab 25: SBOM and vulnerability scan with syft + grype~20 min · 2 objectives→
- Lab 26: Rootless Docker in user namespaces~30 min · 3 objectives→
- Lab 3: OverlayFS — observing copy-up in real time~25 min · 3 objectives→
- Lab 4: Container networking — see veth, bridge, iptables~35 min · 3 objectives→
- Lab 5: Install Docker and verify the engine~30 min · 3 objectives→
- Lab 6: Configure daemon.json and observe the effect~30 min · 4 objectives→
- Lab 7: Build a multi-stage image with BuildKit cache mounts~45 min · 3 objectives→
- Lab 8: Use BuildKit build secrets~30 min · 3 objectives→
- Lab 9: Compose healthchecks and dependencies~30 min · 2 objectives→
Break/Fix scenarios
Troubleshooting drills. Each scenario gives symptoms and evidence, then hides the solution behind a reveal.
runtime
- beginnerBreak/Fix 1: Container exits with 137 (OOMKilled)~15 min · 4 symptoms→
- intermediateBreak/Fix 20: Token and TLS validation fail on one host after a VM restore~20 min · 4 symptoms→
- intermediateBreak/Fix 4: Container in restart loop — application exits, health check is the alarm~15 min · 3 symptoms→
- beginnerBreak/Fix 6: Container takes 10 seconds to stop (SIGTERM-ignoring PID 1)~12 min · 3 symptoms→
network
- advancedBreak/Fix 10: MTU mismatch causes intermittent network failures~20 min · 3 symptoms→
- advancedBreak/Fix 11: Default-DROP nftables policy blocks a published port~20 min · 4 symptoms→
- beginnerBreak/Fix 2: Database connection refused from application~15 min · 4 symptoms→
- intermediateBreak/Fix 3: Container cannot pull image from registry~15 min · 3 symptoms→
image
security
container
storage
Assessments
Production-readiness examinations. Each combines auto-scored questions with scenario-based rubrics you can use to grade yourself.