Management and Registry
Management and Registry
This domain covers day-two operations and image distribution. On the management side, candidates must be fluent with container lifecycle commands (run, stop, rm, exec, logs, inspect, stats), resource limits (--memory, --cpus, and their Swarm equivalents), restart policies (no, on-failure, always, unless-stopped), and health checks (HEALTHCHECK or --health-cmd). Know that docker inspect returns JSON and that --format with Go templates extracts fields. Understand labels for organization and filters for listing.
On the registry side, know the difference between a registry (storage and distribution service) and a repository (a named collection of related images/tags). Tags are mutable pointers; digests are immutable content hashes. Pushing requires docker login, correct tagging with the registry hostname prefix (registry.example.com:5000/app:1.2), and docker push. Pull policies matter: always, if-not-present, and never. Private registries need credentials distributed to nodes (for Swarm, docker login on each node or a credential helper), and insecure registries must be configured in the daemon.
Traps: assuming a tag identifies content (it can be overwritten - pin by digest for reproducibility); confusing docker save/load (tar archives of images) with docker export/import (flattened container filesystems that lose history); and forgetting that a registry on localhost:5000 is treated as insecure by default while remote hosts need explicit configuration.
Rule of thumb: tag for humans, deploy by digest. If a rollback must be exact, reference image@sha256:... rather than a moving tag.