I85PREP
⌘ K
DCA study materials
DCA study resources

Docker Certified Associate (DCA): Docker container technologies: Docker EE platform with CE familiarity

DCA · Work through your exam, one topic at a time.

All guide sections

Docker container technologies: Docker EE platform with CE familiarity

Docker container technologies: Docker EE platform with CE familiarity

This domain tests whether you can operate containers on the Docker Enterprise Edition stack - EE Engine, Universal Control Plane (UCP) and Docker Trusted Registry (DTR) - while knowing which behaviors come from the Community Edition engine. Expect swarm primitives, service and stack deployment, secrets and configs, volumes, and registry workflows.

The platform layers

  • EE Engine is the same dockerd as CE, packaged with supported versions in Docker EE 3.x.
  • UCP is not a separate orchestrator: it is a management layer over swarm mode adding RBAC, LDAP/AD, collections and a UI. UCP controllers run as swarm services.
  • DTR is a registry with org/repo namespacing, image scanning, Notary signing and RBAC; images are referenced as dtr.example.com/org/repo:tag.
  • Nodes are managers or workers. docker swarm init prints join tokens; docker swarm join-token worker --rotate rotates the worker token.

Services and stacks

A service is the declarative unit: --replicas sets desired tasks and the scheduler reconciles. A stack groups services from a Compose file. docker stack deploy honors the deploy: key; docker-compose up does not and ignores deploy.replicas.

Worked example

Goal: three nginx tasks, published port 8080, one secret.

  1. printf 'S3cr3t' | docker secret create web_pw -
  2. docker service create --name web --replicas 3 --secret web_pw -p 8080:80 --with-registry-auth nginx:1.19
  3. docker service ps web shows three tasks; docker service inspect web shows the secret reference.

Reasoning: the manager stores the secret in the Raft log and mounts it at /run/secrets/web_pw only inside task containers. The routing mesh answers on port 8080 on every node, not just nodes running a task. Images are pulled on each node receiving a task, so a DTR image needs docker login dtr.example.com or --with-registry-auth.

Traps

  • Bind mounts (-v /data:/data) need that host path on every node; named volumes do not.
  • Secrets are not exposed in docker inspect or environment variables by default.
  • docker node promote/demote changes manager count; never demote below quorum.
  • UCP RBAC grants roles on collections; it is not the same as swarm node roles.
  • CE has swarm mode and Compose but no UCP, DTR or EE support.