Build an index with CREATE INDEX CONCURRENTLY while a writer is active, and handle the transaction-block error and the invalid index that a failed build leaves. After this, you can add an index to a busy table without stopping its writers.
Add a NOT NULL column to a big table with a constant default, or with a nullable column, a batch backfill, NOT VALID and VALIDATE. After this, you can tell a quick change from a table rewrite and avoid long locks.
Take a pg_dump backup in Docker, restore it into a scratch database, compare the tables and see what a damaged backup looks like. After this, you have a short routine that proves your backup works.
Add a BuildKit cache mount to pip install so a changed requirements file downloads only the new packages. After this, a dependency change no longer means downloading everything again.
Build a Go service in a multi-stage Dockerfile and ship it in an image well under 50 MB, with a non-root user and a health check. After this, you know why Go gets that small and Node does not.
Add a user to an image, give it only the folder it writes to, and fix the two permission errors you will most likely hit. After this, your containers stop running as root.
Look up a base image digest, pin it in the FROM line, check the build used it and plan how to update it. After this, your builds are repeatable without missing security fixes.
Break an app on purpose and compare three health checks, then put the one that works in the Dockerfile. After this, unhealthy means the app is broken, not the check.
Set CPU and memory limits, watch them work, change them on a running container and set them in Compose. After this, one busy container cannot take the whole machine.
Show why restart leaves old log settings in place, recreate one service with bounded logging, and verify retained messages without changing engine defaults.
Log in to a password-protected registry the way a CI job should, push an image, log out, and see the GitHub Actions version. After this, CI logins stop leaking tokens.
Find where an app writes, run it read-only, and give it a tmpfs for scratch files and a volume for data. After this, nothing inside the container can change its own files.