Docker Training in Pune with Placement

What a container actually is, established properly before any command is typed. Containers versus virtual machines as an isolation and resource-sharing story, the Linux namespaces and cgroups underneath (intuition rather than kernel internals), and the Docker Engine architecture — CLI, daemon, containerd and runc — so that later failures can be attributed to the right layer.

The OCI image format is opened up: layers, the manifest, the config, and content-addressable digests. The week ends with fluency in the core CLI and an understanding of why `docker run` on the same tag can produce different results tomorrow.

Writing Dockerfiles that build fast and behave predictably. Every instruction and when each is the right one, then the subject that matters most in daily work: the layer cache, how instruction ordering determines whether a one-line code change rebuilds in four seconds or four minutes, and `.dockerignore` as both a speed and a secret-safety control.

The distinctions that trip people up get dedicated time — ARG versus ENV, ENTRYPOINT versus CMD, shell versus exec form — along with signal handling, graceful shutdown and PID 1 behaviour.

Modern image building. BuildKit as the default builder — parallel stage execution, cache mounts that persist dependency downloads between builds, and build secrets that never land in a layer (the correct answer to a question most candidates get wrong).

Multi-stage builds separate the toolchain from the runtime, then base-image selection is treated as an engineering decision: Alpine versus slim versus distroless, weighed on attack surface, glibc compatibility and debuggability. Language-specific patterns for Java, Node, Python, Go and .NET close the module.

Shipping images that run everywhere and live somewhere. Buildx with QEMU emulation and native builders for amd64 and arm64 output — now a routine requirement given Apple Silicon laptops and Graviton or Ampere servers — plus manifest lists and how a single tag serves multiple architectures.

Registries follow: Docker Hub rate limits, Amazon ECR, Azure Container Registry, Google Artifact Registry and GHCR; authentication, tagging strategy, retention and lifecycle policies, and mirroring or pull-through caches for teams behind slow links.

Compose v2 as the tool that makes a multi-service project runnable with one command. Services, networks and volumes; `depends_on` with health-gated conditions so a web container waits for a database that is genuinely ready rather than merely started; and environment files, variable interpolation and Compose secrets.

Profiles allow opt-in services, and override files handle per-environment differences without duplicating the base file. Reference stacks — Node with Postgres, Java with Postgres and Kafka, Python with Celery and Redis — are built and debugged in class.

Container networking from the driver up. Bridge, host, overlay, macvlan and none, and the workload each one suits; user-defined bridge networks and why they behave differently from the default bridge; and embedded DNS resolution that lets containers address each other by service name.

Port publishing and the host-to-container mapping are covered alongside the diagnostics that resolve most connectivity problems — inspecting networks, testing from inside a container, and distinguishing a DNS failure from a firewall one.

Persisting data correctly. Named volumes versus bind mounts versus tmpfs, ownership and permission problems on Linux (the single most common source of 'it works on my Mac'), and volume drivers for remote or networked storage.

Stateful patterns are then built for real: PostgreSQL, Redis and Elasticsearch containers with durable storage, initialisation scripts, and backup and restore performed through a helper container. The module ends on data migration between volumes and honest guidance on running databases in containers in production.

Reducing what a compromised container can do. Non-root users and read-only root filesystems, dropping Linux capabilities to the minimum set, seccomp and AppArmor profiles, and `no-new-privileges`. Resource limits as a denial-of-service control rather than only a performance setting.

The threat model is made explicit — what container isolation does and does not protect against, why the Docker socket is effectively root, and how privileged containers and host mounts undo everything else. Rootless Docker and gVisor close the module.

Proving an image is trustworthy, which is now a routine requirement in Indian enterprise and BFSI delivery. Vulnerability scanning with Trivy and Docker Scout, reading a CVE report critically, and distinguishing findings that matter from base-image noise you cannot fix.

SBOM generation with Syft or Docker Scout, provenance and SLSA build attestations, and image signing with Cosign — including keyless signing — followed by verification enforced at deploy time so an unsigned image simply cannot run.

Automating everything built so far. GitHub Actions building and publishing images with OIDC federation to a cloud registry — no static credentials — plus GitLab CI as the alternative many Pune enterprise teams run.

Build speed is treated as a first-class concern: registry-backed layer caching, GitHub Actions cache backends, and matrix builds across architectures. The pipeline is completed with scan and signature gates that fail the build, then tag promotion from development through to release.

Running containers once they leave your laptop. Logging drivers and log rotation, container metrics and `docker stats`, restart policies, and the health-check-driven restart behaviour orchestrators depend on.

Troubleshooting is taught as a repeatable method rather than a list of tricks: diagnosing OOM kills from exit code 137, debugging a container that exits immediately, inspecting a distroless image with no shell using ephemeral debug containers, and reading layer history to find what actually changed. Compose-to-Kubernetes migration closes the module.

The capstone brings the whole course together: a multi-service application containerised with multi-stage, multi-platform builds, orchestrated locally with Compose, hardened to a non-root read-only baseline, scanned and signed in a CI pipeline, and published to a registry with a documented tagging strategy.

Interview preparation targets what Pune panels actually ask about Docker — image-size reduction, cache-miss diagnosis, the ENTRYPOINT and CMD distinction, security hardening, and the Docker socket question. Resume, LinkedIn and GitHub polish included.