Course
Docker & Containers in Production
Dockerfiles that build fast and stay small, images that run as nobody, and the runtime flags, secret handling, and hygiene that keep a container from becoming your incident report.
Build Images Worth Deploying
Dockerfile craft, layer caching, and multi-stage builds that produce small, reproducible images.
- 01How Layers and the Build Cache Really WorkLayers, cache keys, and instruction ordering — why COPY placement decides whether builds take 30 seconds or 15 minutes.25mOpen
- 02Multi-Stage Builds: Ship the Binary, Not the ToolchainSplit the build from the runtime so the image that ships contains your artifact and nothing else.30mOpen
- 03Reproducible Builds: Digests, ARG Traps, and Leaky LayersPin base images by digest, survive the pre-FROM ARG trap, and learn why rm in a later layer doesn't erase a secret.25mMembers
Harden the Runtime
Non-root users, dropped capabilities, seccomp, read-only filesystems, and resource limits that actually matter.
- 01Running as Non-Root Without Breaking EverythingUSER, deterministic uids, build-time ownership, and the port-binding rules that changed in Docker 20.10.30mMembers
- 02Dropping Capabilities and Filtering SyscallsWhy the default capability set is too generous, when to drop ALL, and what seccomp is already blocking for you.30mMembers
- 03Read-Only Rootfs, tmpfs, and Resource LimitsImmutable filesystems, honest healthchecks, and the cgroup limits that keep one container from starving the host.25mMembers
Secrets, Compose, and Day-Two Operations
Handling secrets without leaking them, using Compose where it belongs, and production hygiene that survives incidents.
- 01Secrets: Build-Time Mounts and Runtime FilesWhy ENV and ARG leak, how BuildKit secret mounts work, and the runtime patterns that keep credentials out of images.30mPremium
- 02Compose for Development, Not for ProductionA compose file that earns its keep: health-gated startup, loopback-only ports, override files — and where Compose ends.25mPremium
- 03The Production Checklist: Scan, Sign, Harden, MonitorImage scanning in CI, cosign signing, the full hardening run command, log rotation, and auditing with docker-bench.30mPremium