Containers

Author Dockerfiles and Compose files; build and run container workloads.

45 challenges · 13 easy · 21 medium · 11 pro

• ADD Auto-Extracts a Tarballeasy · in-browser
  Write /home/player/Dockerfile (FROM debian) that sets WORKDIR /opt/app then uses ADD release.tar.gz /opt/app/ so the archive is auto-extracted into the image (ADD, unlike COPY, unpacks local tarballs). (Authored config, graded structurally — the engine isn't run here.)
• Add OCI image labelseasy · in-browser
  Write /home/player/Dockerfile (FROM alpine) with LABEL org.opencontainers.image.source and org.opencontainers.image.version. (Authored config, graded structurally — the engine isn't run here.)
• Compose Port Mappingeasy · in-browser
  Write /home/player/docker-compose.yml with a service web (any nginx image tag is fine) that publishes a ports mapping of host 8443 to container 443. (Authored config, graded structurally — the engine isn't run here.)
• Compose env_fileeasy · in-browser
  Write /home/player/docker-compose.yml: service app (image myapp:1) loading an env_file named app.env. (Authored config, graded structurally — the engine isn't run here.)
• Compose restart policyeasy · in-browser
  Write /home/player/docker-compose.yml: service `app` (image myapp:1) with restart: unless-stopped. (Authored config, graded structurally — the engine isn't run here.)
• Declare a VOLUMEeasy · in-browser
  Write /home/player/Dockerfile (FROM postgres:16) declaring a VOLUME at /var/lib/postgresql/data. (Authored config, graded structurally — the engine isn't run here.)
• EXPOSE and ENVeasy · in-browser
  Write /home/player/Dockerfile (FROM nginx) that EXPOSEs port 8080 and sets ENV APP_ENV=prod. (Authored config, graded structurally — the engine isn't run here.)
• Pinned Image Serviceeasy · in-browser
  Write /home/player/docker-compose.yml declaring a single service named cache under a top-level services: block that uses the pinned image redis:7.2. (Authored config, graded structurally — the engine isn't run here.)
• Python ENV Settingseasy · in-browser
  Write /home/player/Dockerfile (FROM python:3.12) that sets two environment variables for cleaner container behavior: ENV PYTHONUNBUFFERED=1 and ENV PYTHONDONTWRITEBYTECODE=1. (Authored config, graded structurally — the engine isn't run here.)
• Set STOPSIGNALeasy · in-browser
  Write /home/player/Dockerfile (FROM nginx) with STOPSIGNAL SIGQUIT. (Authored config, graded structurally — the engine isn't run here.)
• Set a working directoryeasy · in-browser
  Write /home/player/Dockerfile (FROM node:20) with WORKDIR /app before any COPY. (Authored config, graded structurally — the engine isn't run here.)
• Write a .dockerignoreeasy · in-browser
  Write /home/player/.dockerignore excluding .git, node_modules and *.log from the build context. (Authored config, graded structurally — the engine isn't run here.)
• Write a Dockerfileeasy
  Author /home/player/Dockerfile for a Python app: base image python:3.12-slim, working dir /app, copy the source in, install from requirements.txt, and run `python app.py` as the default command.
• Build-time ARGmedium · in-browser
  Write /home/player/Dockerfile using an ARG VERSION (default 1.0) referenced as FROM busybox:${VERSION}. (Authored config, graded structurally — the engine isn't run here.)
• COPY with --chownmedium · in-browser
  Write /home/player/Dockerfile (FROM python:3.12-slim) that creates user app and uses COPY --chown=app:app to copy the source. (Authored config, graded structurally — the engine isn't run here.)
• Compose Resource Limitsmedium · in-browser
  Write /home/player/docker-compose.yml with a service api (image myapp:1.0) capped via deploy.resources.limits to cpus "0.50" and memory 512M. (Authored config, graded structurally — the engine isn't run here.)
• Compose custom networkmedium · in-browser
  Write /home/player/docker-compose.yml: services web and api both attached to a custom network 'appnet' declared at top level. (Authored config, graded structurally — the engine isn't run here.)
• Compose deploy replicasmedium · in-browser
  Write /home/player/docker-compose.yml: service api (myapi:1) with deploy.replicas 3. (Authored config, graded structurally — the engine isn't run here.)
• Compose log rotationmedium · in-browser
  Write /home/player/docker-compose.yml: service app with a logging driver json-file and options max-size 10m, max-file 3. (Authored config, graded structurally — the engine isn't run here.)
• Compose named volumemedium · in-browser
  Write /home/player/docker-compose.yml: service db (image postgres:16) mounting a named volume pgdata at /var/lib/postgresql/data, plus a top-level volumes: pgdata. (Authored config, graded structurally — the engine isn't run here.)
• Compose profilesmedium · in-browser
  Write /home/player/docker-compose.yml: a service debugtools under profile 'debug'. (Authored config, graded structurally — the engine isn't run here.)
• Compose ulimits nofilemedium · in-browser
  Write /home/player/docker-compose.yml with a service es (any elasticsearch 8.x image tag) that raises the open-files limit via ulimits.nofile with soft: 65536 and hard: 65536. (Authored config, graded structurally — the engine isn't run here.)
• Docker Run Launch Scriptmedium · in-browser
  Write /home/player/run.sh, a bash script (bash shebang on line one) that launches nginx with a single docker run command: detached (-d), auto-removed on exit (--rm), named web (--name web), and publishing host 8080 to container 80 (-p 8080:80). (Authored config, graded structurally — the engine isn't run here.)
• Dockerfile HEALTHCHECKmedium · in-browser
  Write /home/player/Dockerfile (FROM nginx) with a HEALTHCHECK that has an --interval and runs a CMD probing localhost. (Authored config, graded structurally — the engine isn't run here.)
• ENTRYPOINT vs CMDmedium · in-browser
  Write /home/player/Dockerfile (FROM debian) with an exec-form ENTRYPOINT ["/app/run"] and a default CMD ["--help"]. (Authored config, graded structurally — the engine isn't run here.)
• Entrypoint Exec Handoffmedium · in-browser
  Write /home/player/entrypoint.sh, a /bin/sh entrypoint (sh shebang on line one) that runs startup work then hands control to the container command. Begin the body with set -e and end with exec "$@" so the CMD becomes PID 1 and receives signals. (Authored config, graded structurally — the engine isn't run here.)
• Exec-form CMDmedium · in-browser
  Write /home/player/Dockerfile (FROM alpine) whose CMD is exec form running /bin/sh -c with an echo. (Authored config, graded structurally — the engine isn't run here.)
• Multi-arch FROM --platformmedium · in-browser
  Write /home/player/Dockerfile pinning the base arch: FROM --platform=linux/amd64 debian:stable-slim. (Authored config, graded structurally — the engine isn't run here.)
• Podman Quadlet Web Unitmedium · in-browser
  Write /home/player/nginx.container, a Podman Quadlet unit that runs nginx. Under a [Container] section set Image=docker.io/library/nginx:1.27 and PublishPort=8080:80, and add an [Install] section with a WantedBy= line so the generated service starts on boot. (Authored config, graded structurally — the engine isn't run here.)
• Read-Only Root Filesystemmedium · in-browser
  Write /home/player/docker-compose.yml with a service app that runs with read_only: true and mounts a tmpfs list for writable scratch space, including /tmp. (Authored config, graded structurally — the engine isn't run here.)
• Run as non-rootmedium · in-browser
  Write /home/player/Dockerfile (FROM python:3.12-slim) that creates a user 'appuser' and switches to it with USER before CMD. (Authored config, graded structurally — the engine isn't run here.)
• Strict-Mode Entrypointmedium · in-browser
  Write /home/player/entrypoint.sh starting with a /usr/bin/env bash shebang. Begin the body with set -euo pipefail, require a DB_HOST variable using the ${DB_HOST:?...} fail-if-unset form, and end with exec "$@". (Authored config, graded structurally — the engine isn't run here.)
• Write a Compose filemedium
  Author /home/player/docker-compose.yml with two services: `web` (build .) publishing port 8080:80 and depending on `db`; `db` using image postgres:16 with POSTGRES_PASSWORD set.
• depends_on healthymedium · in-browser
  Write /home/player/docker-compose.yml: web depends_on db with condition service_healthy; db (postgres:16) has a healthcheck. (Authored config, graded structurally — the engine isn't run here.)
• Build Secret Mountpro · in-browser
  Write /home/player/Dockerfile pinning the BuildKit frontend on the first line (# syntax=docker/dockerfile:1), basing on node:20, and running npm ci with a build secret instead of baking credentials into a layer. Use RUN --mount=type=secret,id=npmrc and target the secret at the npm config path so npm ci can read it without persisting it in any layer. (Authored config, graded structurally — the engine isn't run here.)
• BuildKit cache mountpro · in-browser
  Write /home/player/Dockerfile (FROM python:3.12-slim) with a RUN using --mount=type=cache for pip. (Authored config, graded structurally — the engine isn't run here.)
• Compose YAML Anchor Reusepro · in-browser
  Write /home/player/docker-compose.yml that defines a shared config block with a YAML anchor &common containing restart: unless-stopped, then merges it into two services using the merge key <<: *common. (Authored config, graded structurally — the engine isn't run here.)
• Compose healthcheckpro · in-browser
  Write /home/player/docker-compose.yml: service api (image myapi:1) with a healthcheck (test using CMD, an interval and retries). (Authored config, graded structurally — the engine isn't run here.)
• Compose secretspro · in-browser
  Write /home/player/docker-compose.yml: a top-level secrets entry db_password (file ./db.txt) used by service db. (Authored config, graded structurally — the engine isn't run here.)
• Distroless final stagepro · in-browser
  Write /home/player/Dockerfile: a builder stage (golang:1.22 AS build) and a final FROM gcr.io/distroless/static that COPYs --from=build and sets a nonroot USER. (Authored config, graded structurally — the engine isn't run here.)
• Dockerfile RUN Heredocpro · in-browser
  Write /home/player/Dockerfile pinning the BuildKit frontend on the first line (# syntax=docker/dockerfile:1), basing on debian, and running a single RUN heredoc (RUN <<EOF ... EOF) whose body starts with set -e. Close the heredoc with EOF on its own line. (Authored config, graded structurally — the engine isn't run here.)
• Multi-stage hardened imagepro
  Author /home/player/Dockerfile as a multi-stage build: a `FROM golang:1.22 AS build` stage that compiles, and a minimal final stage that COPYs the binary `--from=build`, runs as a non-root USER, and declares a HEALTHCHECK.
• ONBUILD triggerpro · in-browser
  Write /home/player/Dockerfile (FROM node:20) with an ONBUILD COPY and an ONBUILD RUN npm ci. (Authored config, graded structurally — the engine isn't run here.)
• Podman Quadlet Volume Unitpro · in-browser
  Write /home/player/pgdata.volume, a Podman Quadlet volume unit. Under a [Volume] section set VolumeName=pgdata and Driver=local, and add an [Install] section so the volume is created on boot. (Authored config, graded structurally — the engine isn't run here.)
• Slim apt layerpro · in-browser
  Write /home/player/Dockerfile (FROM debian:stable-slim) with a single RUN that apt-get updates, installs curl with --no-install-recommends, and cleans /var/lib/apt/lists. (Authored config, graded structurally — the engine isn't run here.)