Look up a base image digest, pin it in the FROM line, check the build used it and plan how to update it. After this, your builds are repeatable without missing security fixes.
Break an app on purpose and compare three health checks, then put the one that works in the Dockerfile. After this, unhealthy means the app is broken, not the check.
Set CPU and memory limits, watch them work, change them on a running container and set them in Compose. After this, one busy container cannot take the whole machine.
Show why restart leaves old log settings in place, recreate one service with bounded logging, and verify retained messages without changing engine defaults.
Log in to a password-protected registry the way a CI job should, push an image, log out, and see the GitHub Actions version. After this, CI logins stop leaking tokens.
Find where an app writes, run it read-only, and give it a tmpfs for scratch files and a volume for data. After this, nothing inside the container can change its own files.
Deploy a new version with blue and green copies, a proxy reload and a switch script, and prove no request failed. After this, a deployment on one host does not drop users.
Export an SPDX SBOM from a real build, list its packages and scan it with Grype, without a Docker account. After this, you can hand over what is in an image and what was known about it on a given day.