Software
Engineer ← All courses
Advanced·9 lessons·103 min
Docker in Production
What changes when containers carry real traffic: the daemon’s internals, dropping privileges, resource limits, SBOMs and provenance, Scout, hardened base images, Sigstore signing, observability, and running AI models with Model Runner.
Written and verified against
- Docker Engine
- 29.7.2
- Docker Compose
- v5.5.0
- Buildx
- v0.36.1
- BuildKit
- v0.32.2
- Dockerfile frontend
- 1.26.0
- Docker Desktop
- 4.88.1
Checked 28 August 2026. Official docs: docs.docker.com ↗
- 01The Engine Underneathdockerd, containerd, shims and runc — and why containers survive a daemon restart. 11 min
- 02Container SecurityNon-root, dropped capabilities, seccomp, read-only roots, and rootless mode. 12 min
- 03Resource LimitsCapping memory and CPU, and why your runtime cannot see the limit. 13 min
- 04Supply Chain and AttestationsSBOMs, provenance, and why production deploys by digest. 10 min
- 05Docker ScoutTurning a CVE list into a task list — and gating on the delta, not the total. 11 min
- 06Hardened Base ImagesDistroless, DHI, and VEX: removing packages instead of triaging them. 12 min
- 07Signing and TrustContent Trust is gone. Sigstore, cosign, and what a signature actually proves. 10 min
- 08ObservabilityLogging drivers, events, and finding the crash loop that looks healthy. 12 min
- 09AI WorkloadsModel Runner, models in Compose, GPUs, and what is different about operating a model. 12 min