Docker Certified Associate (DCA) cheat sheet

Docker Container Technologies (Docker EE, with CE familiarity)

• Docker Engine architecture: dockerd (daemon) exposes the REST API and manages containers; containerd handles image transfer, storage, and container execution; runc is the OCI-compliant low-level runtime that actually creates namespaces/cgroups and starts the process. Each layer is a separate process, so a container survives neither dockerd nor containerd restart by default (live-restore can keep containers running if only dockerd restarts).

• Namespaces isolate what a process can see (pid, net, mnt, uts, ipc, user, cgroup); cgroups limit and account for resources (CPU shares/quota, memory limit, pids limit, blkio). A container is just a process with these applied plus a root filesystem - there is no VM and no separate kernel.

• Image model: an image is an ordered stack of immutable read-only layers plus a JSON config (entrypoint, cmd, env, labels, exposed ports, volumes). The container adds one thin writable layer on top; deleting the container discards that layer. Layers are content-addressed by digest (sha256), which is why identical layers are shared across images and containers.

• Dockerfile instruction semantics: each RUN/COPY/ADD creates a layer; CMD and ENTRYPOINT are metadata only. ENTRYPOINT sets the executable, CMD supplies default arguments that docker run <image> args overrides. Only the last CMD/ENTRYPOINT in the file takes effect. COPY is preferred over ADD (ADD also auto-extracts local tars and fetches URLs). EXPOSE documents a port but does not publish it.

• Build cache rules: a layer is reused only if the instruction string and all parent layers are unchanged. Put rarely changing steps (dependency install) before frequently changing ones (source copy) so cache survives. COPY/ADD cache is keyed on file checksums; --no-cache disables reuse; multi-stage builds (FROM x AS build then COPY --from=build) keep build tooling out of the final image.

• Volumes vs bind mounts: volumes are managed by Docker under /var/lib/docker/volumes and are the portable, backed-up choice; bind mounts map an arbitrary host path and depend on host layout. tmpfs mounts live in memory only. Data written to a container's writable layer is lost when the container is removed, so persist state in a volume or bind mount.

• Networking drivers: bridge (default, per-host private network with NAT), host (no isolation, shares host stack), none (loopback only), overlay (multi-host, used by Swarm), macvlan (container gets a MAC on the physical network), ipvlan. User-defined bridge networks provide automatic DNS resolution by container name; the default bridge does not. Published ports use -p host:container and are implemented with iptables/DNAT on Linux.

• Resource and health controls: --memory sets a hard cgroup limit (OOM-kill inside the container when exceeded); --cpus / --cpu-shares control CPU; --pids-limit caps process count. HEALTHCHECK defines a command whose exit status marks the container healthy/unhealthy; it does not restart the container by itself - restart policies (no, on-failure, always, unless-stopped) do.

• Docker EE vs CE: CE is the free upstream-style engine; EE is the commercially supported edition with a certified image/plugin program, a supported engine lifecycle, and integration with Universal Control Plane (UCP) for cluster management and Docker Trusted Registry (DTR) for image storage and signing. EE also adds security features such as image scanning and signing policy enforcement through UCP/DTR.