Add a BuildKit cache mount to pip install so a changed requirements file downloads only the new packages. After this, a dependency change no longer means downloading everything again.
Build a Go service in a multi-stage Dockerfile and ship it in an image well under 50 MB, with a non-root user and a health check. After this, you know why Go gets that small and Node does not.
Add a user to an image, give it only the folder it writes to, and fix the two permission errors you will most likely hit. After this, your containers stop running as root.
Look up a base image digest, pin it in the FROM line, check the build used it and plan how to update it. After this, your builds are repeatable without missing security fixes.
Break an app on purpose and compare three health checks, then put the one that works in the Dockerfile. After this, unhealthy means the app is broken, not the check.
Set CPU and memory limits, watch them work, change them on a running container and set them in Compose. After this, one busy container cannot take the whole machine.
Show why restart leaves old log settings in place, recreate one service with bounded logging, and verify retained messages without changing engine defaults.
Log in to a password-protected registry the way a CI job should, push an image, log out, and see the GitHub Actions version. After this, CI logins stop leaking tokens.
Find where an app writes, run it read-only, and give it a tmpfs for scratch files and a volume for data. After this, nothing inside the container can change its own files.
Deploy a new version with blue and green copies, a proxy reload and a switch script, and prove no request failed. After this, a deployment on one host does not drop users.
Export an SPDX SBOM from a real build, list its packages and scan it with Grype, without a Docker account. After this, you can hand over what is in an image and what was known about it on a given day.