Thesius Code

Posted on Mar 23 • Originally published at datanest-stores.pages.dev

Docker DCA Certification Prep: Docker Certified Associate Exam Guide DCA

#cloud #certification #aws #devops

Docker Certified Associate Exam Guide (DCA)

Validate your container expertise with this comprehensive Docker Certified Associate study guide covering image creation and management, container orchestration with Swarm, networking, storage, and security. This guide provides hands-on, CLI-driven lab exercises for every exam domain, practical Dockerfile optimization patterns, and practice questions that test both conceptual knowledge and operational skills. Docker remains the foundation of modern containerization, and this certification proves you can build, ship, and run production container workloads. Follow the structured study plan to build skills progressively from image basics through production orchestration.

Key Features

All six DCA exam domains covered with weighted study priorities and hands-on labs
Image management including multi-stage builds, layer optimization, and registry operations
Container orchestration with Docker Swarm: services, stacks, rolling updates, and secrets
Networking deep dives covering bridge, overlay, macvlan, and host network drivers
Storage and volumes patterns for persistent data, bind mounts, and volume plugins
Security hardening with user namespaces, seccomp profiles, content trust, and image scanning
Dockerfile best practices with optimization patterns that reduce image size by 80%+

Study Plan

Week 1-2: Image Creation, Management, and Registry (20% of exam)

Dockerfile instructions: FROM, RUN, COPY, ADD, CMD, ENTRYPOINT, ENV, ARG
Multi-stage builds for minimal production images
Image tagging, pushing, pulling, and registry management
Image layer analysis and size optimization

Week 3-4: Orchestration (25% of exam)

Docker Swarm initialization, node management, and quorum
Service creation, scaling, rolling updates, and rollback
Docker Compose files and stack deployments
Global vs. replicated services, placement constraints, and drain

Week 5-6: Networking (15% of exam)

Bridge networks for single-host container communication
Overlay networks for multi-host Swarm networking
Port publishing, DNS resolution, and load balancing
Network troubleshooting and traffic inspection

Week 7-8: Installation, Configuration, and Storage (25% of exam)

Docker Engine installation and daemon configuration
Storage drivers: overlay2, devicemapper, btrfs
Volumes, bind mounts, and tmpfs mounts
Backup, restore, and disaster recovery patterns

Week 9-10: Security (15% of exam)

Docker Content Trust and image signing
User namespaces and rootless Docker
Seccomp and AppArmor profiles
Secrets management in Swarm mode

Key Topics

Domain	Weight	Focus Areas
Image Management	20%	Dockerfile, multi-stage, registries
Orchestration	25%	Swarm, services, stacks, updates
Networking	15%	Bridge, overlay, DNS, ports
Storage and Installation	25%	Volumes, drivers, daemon config
Security	15%	Content trust, namespaces, secrets

Practice Questions

Q1: A developer has a Dockerfile that produces a 1.2 GB image. The application is a compiled Go binary that only needs the binary file to run. How can the image size be reduced to under 20 MB?

A1: Use a multi-stage build. First stage: use golang:1.21 as the build environment to compile the binary. Second stage: use scratch or alpine as the runtime base and COPY only the compiled binary from the build stage. Example: COPY --from=builder /app/myapp /myapp. The scratch base has zero overhead; alpine adds ~7 MB but includes a shell for debugging.

Q2: A Docker Swarm cluster has 5 manager nodes. How many manager nodes can fail simultaneously while the cluster remains operational?

A2: Two manager nodes can fail. Swarm uses the Raft consensus algorithm which requires a majority (quorum) of managers to be available. With 5 managers, the quorum is 3 (majority of 5). So the cluster tolerates 5 - 3 = 2 failures. Formula: fault tolerance = (N - 1) / 2 for N manager nodes.

Q3: A container needs to store database files that persist across container restarts and can be shared between containers on the same host. Which storage option should be used?

A3: Use a named Docker volume (docker volume create db-data). Volumes are managed by Docker, persist when containers are removed, can be shared between containers via --mount source=db-data,target=/var/lib/data, and support volume drivers for remote storage. Bind mounts also work but volumes are preferred for production because Docker manages the lifecycle and they work on all platforms.

Q4: How do you rotate the TLS certificates used for Docker Swarm node communication?

A4: Run docker swarm ca --rotate on a manager node. This triggers an automatic rotation of all TLS certificates across the swarm. You can also set the certificate rotation interval with docker swarm update --cert-expiry 720h. The default cert expiry is 90 days, and Swarm handles renewal automatically.

Lab Exercises

Lab 1: Multi-Stage Build Optimization

# Stage 1: Build environment
FROM golang:1.21-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux go build -o /app/server .

# Stage 2: Minimal runtime
FROM alpine:3.19
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
COPY --from=builder /app/server /usr/local/bin/server
USER appuser
EXPOSE 8080
ENTRYPOINT ["server"]

# Build and verify the image size
docker build -t myapp:optimized .
docker images myapp:optimized
# Compare with single-stage: often 50-100x smaller

Lab 2: Swarm Service Management

# Initialize a Swarm cluster
docker swarm init --advertise-addr 192.168.1.10

# Create a replicated service with 3 replicas
docker service create --name web \
  --replicas 3 \
  --publish published=80,target=8080 \
  --update-parallelism 1 \
  --update-delay 30s \
  --rollback-parallelism 1 \
  nginx:1.25

# Perform a rolling update
docker service update --image nginx:1.26 web

# Rollback if the update fails
docker service rollback web

# Scale the service
docker service scale web=5

Lab 3: Network Troubleshooting

# Create a custom bridge network
docker network create --driver bridge --subnet 172.20.0.0/16 app-net

# Run two containers on the same network
docker run -d --name app1 --network app-net alpine sleep 3600
docker run -d --name app2 --network app-net alpine sleep 3600

# Test DNS resolution between containers
docker exec app1 ping -c 3 app2

# Inspect network details
docker network inspect app-net

# View container network configuration
docker exec app1 ip addr show

Exam Tips

Orchestration is the largest domain at 25% — know Swarm inside and out: services, stacks, updates, and node management
Multi-stage builds are tested frequently — practice writing Dockerfiles that separate build and runtime stages
Know the difference between CMD and ENTRYPOINT, COPY and ADD, volumes and bind mounts
Swarm quorum math — memorize: 3 managers = 1 failure, 5 managers = 2 failures, 7 managers = 3 failures
Networking drivers — bridge for single host, overlay for Swarm, macvlan for direct LAN access, host for no isolation
Security questions expect practical answers — content trust, user namespaces, and read-only filesystems
Practice at the CLI — the exam assumes fluency with docker commands, not just GUI knowledge

Resources

This is 1 of 11 resources in the Certification Prep Pro toolkit. Get the complete [Docker DCA Certification Prep] with all files, templates, and documentation for $39.

Get the Full Kit →

Or grab the entire Certification Prep Pro bundle (11 products) for $249 — save 30%.

Get the Complete Bundle →

DEV Community