DevOps · DOP-11

Docker in Practice

Docker in Practice is a hands-on course in using Docker the way real teams do, from container internals and multi-stage Dockerfiles with BuildKit to multi-service systems with Docker Compose, container security, vulnerability scanning, registries and debugging. It suits developers, DevOps engineers and tech leads who already know basic Docker and want to use it professionally.

Updated 20 Oct 2026

From 8,550 THB / person 9,500 −10% excl. VAT 7% · group rates available

Corporate training quote Join the waiting list

PDFDownload the course outline

Duration18 hours · 3 days
FormatOnsite / live online
Next roundOn request
CertificateIncluded

Course overview

Containers are now the standard way to ship software, from the developer's laptop and the CI/CD pipeline to Kubernetes in production. Yet many teams still use Docker only to the point where things run. Images end up large, builds are slow, vulnerabilities come in with the base image, containers run as root, and problems are hard to track down once a system has several services. Docker itself has also changed a great deal: Docker Engine 29 makes the containerd image store the default for fresh installs, and Docker Compose v5 hands builds over to Docker Bake.

This course shows how teams really use Docker Engine 29, Docker Desktop, BuildKit and Buildx, Docker Compose v5, Docker Scout and Trivy. It covers container internals, Dockerfiles that produce small images that build fast, networks and volumes, multi-service systems with Compose, security, registries, resource limits and systematic debugging. Everything is built up on one sample system, BrewTrack Coffee Ordering, until it is ready for a CI/CD pipeline and the move to Kubernetes. (3 days, 6 hours per day, 18 hours in total, Intermediate level.)

What you’ll gain

Understand container internals: namespaces, cgroups, image layers and containerd
Write Dockerfiles that produce small, fast-building, maintainable images with multi-stage builds and BuildKit
Build multi-architecture images (amd64 and arm64) with Buildx
Manage container networks, volumes and configuration correctly
Compose multi-service systems with Docker Compose, including healthchecks, profiles and watch
Harden containers with non-root users, secrets and image vulnerability scanning
Set registry, tagging and image versioning standards for a team
Set resource limits, configure logging and debug container problems systematically

Who this course is for

Backend, frontend and full-stack developers who want to use Docker in real projects
DevOps and system engineers who look after the organisation's containers
Tech leads who want to set container standards for their team
People who already know basic Docker and want to use it professionally
Anyone preparing to move on to CI/CD and Kubernetes

Prerequisites

Programming experience in at least one language and an understanding of how web applications work
Basic command-line (Linux shell or PowerShell) and Git skills
Basic networking knowledge such as IP addresses, ports, DNS and HTTP
A laptop with 16 GB RAM or more, virtualisation enabled and permission to install software

Curriculum

Course Details

This course builds on Basic Docker (2 days) and goes deeper into BuildKit, multi-platform builds, security, registries and using Docker Compose for real multi-service systems. It runs for 3 days, 6 hours per day (18 hours in total, 09:00-16:00), as a continuous workshop on the BrewTrack Coffee Ordering sample system, a fictional coffee shop that uses only sample data. Intermediate level. Every lab runs on the

learner's own laptop with Docker Desktop or Docker Engine on WSL2 or Linux. Docker Swarm is out of scope, and Kubernetes is demonstrated only to prepare for the next step. To go further, continue with Kubernetes (K8s) Orchestration, DevSecOps in Practice or DevOps for Full Stack Developers. Learners take home the lab guide, the Dockerfiles and Compose files of the sample system, and a checklist of Docker standards for their team.

Day 1 Container Internals and Building Great Images

Section 1: Lab: Container Internals

Containers compared with virtual machines, and what a container shares with the host
Linux namespaces, cgroups and union filesystems
The architecture of the Docker CLI, Docker Engine, containerd and runc
What changed in Docker Engine 29: the containerd image store is the default for fresh installs
Lab: explore a container's namespaces, cgroups and image layers with real commands

Section 2: Lab: The Docker CLI in Practice

The container lifecycle: create, start, stop, restart and rm
docker exec, logs, inspect, stats and events
Managing images with pull, tag, history and prune
Lab: run and inspect the BrewTrack services one by one from official images

Section 3: Dockerfile Best Practices

Ordering instructions to make the most of the layer cache
.dockerignore, COPY versus ADD, and ENTRYPOINT versus CMD
Choosing a base image: official, slim, Alpine and distroless
ARG, ENV, LABEL and making builds reproducible
Lab: write the first Dockerfile for the REST API and measure its size and build time

Section 4: Lab: Multi-stage Builds and BuildKit

Separating the build stage from the runtime stage to shrink images
Cache mounts for package managers to speed up repeat builds
Build secrets that never stay in an image layer
Development and production build targets from a single Dockerfile
Workshop: optimise the API and frontend images and compare size and time before and after

Section 5: Lab: Buildx and Multi-platform Images

Buildx builder instances and drivers
Building for linux/amd64 and linux/arm64 in one command
An overview of Docker Bake for managing multiple build targets
Lab: build multi-platform BrewTrack images and inspect the resulting manifest

Day 2 Networking, Storage and Docker Compose

Section 6: Lab: Docker Networking

Network drivers: bridge, host, none and overlay at concept level
User-defined bridge networks and internal DNS between containers
Port publishing and separating frontend and backend networks
An overview of the nftables firewall backend, still experimental in Docker Engine 29
Lab: isolate the network so the database is reachable only from the API

Section 7: Lab: Volumes and Data Persistence

How volumes, bind mounts and tmpfs differ, and when to use each
Backing up and restoring volume data
File permission (UID/GID) issues between host and container
Lab: keep PostgreSQL data in a volume, then back it up and restore it

Section 8: Configuration and Environments

Environment variables, .env files and the order of precedence
Separating development, staging and production settings
Passing secrets to containers without baking them into images
Lab: move all BrewTrack settings out of the images and into the environment

Section 9: Lab: Docker Compose v5

Compose file structure: services, networks, volumes, configs and secrets
Healthchecks and conditional depends_on to control start-up order
Init containers for preparation tasks such as database migrations
Profiles for optional services and merging several Compose files
How builds in Compose v5 run through Docker Bake

Section 10: Developer Workflow with Compose Watch

Compose Watch actions: sync, rebuild and sync+restart
Setting up hot reload for the API and the frontend
Everyday commands: up, down, logs, ps, exec and config
Workshop: run the frontend, API, PostgreSQL, Redis and Nginx in one Compose project with watch and a database tools profile

Day 3 Security, Operations and Master Workshop

Section 11: Lab: Container Security

Running containers as non-root with a read-only filesystem
Dropping Linux capabilities and preventing privilege escalation
Rootless mode at concept level
Reducing the attack surface with minimal or distroless images and regular base image updates
Lab: make every BrewTrack image run as non-root

Section 12: Lab: Image Scanning and the Supply Chain

Scanning for vulnerabilities with Docker Scout and Trivy, and reading CVE results
SBOMs and provenance attestations for images
Setting a policy that blocks images with critical vulnerabilities
Lab: scan the images and fix them until they meet the team's threshold

Section 13: Registries and Versioning

Docker Hub, private registries and the GitHub or GitLab container registries
Tagging strategies: semantic versions, Git SHAs and the risks of latest
Authenticating to registries safely with credential helpers
Lab: tag and push images to a private registry following the team's versioning strategy

Section 14: Lab: Resources, Logging and Debugging

CPU and memory limits, restart policies and OOM kills
Logging drivers and log rotation
A debugging routine: inspect, logs, events, exec and docker debug for images without a shell
Lab: fix simulated problems such as an OOM-killed container, a service that cannot reach the database and wrong volume permissions

Section 15: From Docker to CI/CD, Kubernetes and Master Workshop

Building and pushing images in a CI/CD pipeline
Compose concepts compared with Kubernetes: pods, deployments and services
Demonstration of running the same image on Docker Desktop's Kubernetes or kind
Master Workshop: finish BrewTrack so it is secure, has resource limits and log rotation, and is ready for a pipeline

Schedule & training options

For individuals — public rounds

No public rounds are open right now. Join the waiting list and we will contact you first when the next round opens, or ask us on LINE. Or call 02-570-8449 or 088-807-9770

Join the waiting list Ask about rounds

For organisations — in-house / private

Tailor the content to your team’s tools and projects
Your dates, at your office or live online
Quotation with tax ID for procurement

Corporate training quote

Instructors

Samit KoyomFounder & CEO, IT Genius Engineering

Frequently asked questions

How does this course differ from Basic Docker?

Basic Docker (2 days) lays the foundations of container commands and concepts. This course goes deeper into how teams really use Docker: internals, BuildKit, multi-platform builds, Docker Compose v5 for multi-service systems, security, vulnerability scanning, registries and debugging. Afterwards you can continue with DevOps for Full Stack Developers, which takes containers into GitLab CI/CD and Kubernetes, or with Kubernetes (K8s) Orchestration and DevSecOps in Practice.

I have never used Docker. Can I join?

Yes. The first morning reviews the basics you need, but the pace is quick and the content goes deep. If you have never used the command line or seen a container, take Basic Docker first. People who have used Docker before get the most from this course.

Do I need a paid Docker Desktop subscription?

No. Docker Desktop is free for individuals and small businesses, but larger organisations need a paid subscription, so check your organisation's terms. Without a subscription you can use Docker Engine on WSL2 or Linux, which has no licence cost. The institute does not provide licences or lab machines.

How should I prepare my laptop?

You use your own laptop with 16 GB RAM or more, at least 40 GB of free disk space and virtualisation enabled in the BIOS. Install Docker Desktop (with WSL2 on Windows) or Docker Engine, VS Code and Git before the course, and make sure you can pull images from Docker Hub. If your company network uses a proxy or registry mirror, configure it beforehand.

Does the sample system use Node.js or Python?

The BrewTrack REST API comes in both Node.js and Python FastAPI versions, with starter code provided, because the course is about containerising and operating the system rather than teaching a framework. Choose whichever language you know. The Dockerfile and Compose principles apply to other languages too.

Does the course cover Docker Swarm and Kubernetes?

Docker Swarm is not covered, since most organisations use Kubernetes as their orchestrator. Kubernetes is covered by comparing its concepts with Compose and demonstrating the same image running on a cluster, as preparation for the next step. For full Kubernetes training, continue with Kubernetes (K8s) Orchestration.