Installation and Configuration
Installation and Configuration
Candidates must understand how Docker is installed and configured on a host. The engine consists of the dockerd daemon and the docker CLI, which communicate over a Unix socket (/var/run/docker.sock) or a TCP endpoint. Installation options include distribution packages, Docker's official repositories, and convenience scripts; in all cases, verify the version and confirm the service is enabled at boot.
The central configuration file is /etc/docker/daemon.json. It controls the data root (data-root), storage driver, log driver and options (log-driver, log-opts with max-size/max-file), registry mirrors, insecure registries, default address pools (default-address-pools), and the listen endpoint. Changes require a daemon reload or restart. On systemd hosts, environment variables can also be set via a drop-in (/etc/systemd/system/docker.service.d/), and systemctl daemon-reload must follow edits there. The CLI reads ~/.docker/config.json, which stores credentials and per-registry settings.
Rootless mode and user namespaces are important security-adjacent configuration topics: rootless runs the daemon and containers without root, using a user namespace for isolation. Also know that the docker group grants effective root-equivalent access, so membership is a privilege decision.
Traps: putting invalid JSON in daemon.json (the daemon fails to start - validate before restarting); expecting CLI-side settings in daemon.json or vice versa; forgetting that data-root changes require migrating existing images and containers; and assuming a systemctl restart docker is enough after editing a systemd drop-in (you need daemon-reload first).
Rule of thumb: change one key at a time in daemon.json, validate the JSON, then reload - and remember that log rotation is off by default, so set max-size early.