Docker Certificate

# Docker certificate - outline

## Part 1 - hands-on exam (75 min)

Operate in a sandbox:
- Build a multi-stage image under 100MB for a Node API
- Use BuildKit cache mount for npm
- Add HEALTHCHECK that hits /healthz
- Build for linux/amd64 + linux/arm64 with buildx
- Sign the image with cosign and verify the signature

Grading: each task is graded on outcome via a verification script.

## Part 2 - production project (take-home, ~6 hours)

Build, scan, sign, push, and deploy a small service:
- Multi-stage Dockerfile (distroless or scratch final stage)
- Non-root user, pinned base image SHA, HEALTHCHECK
- docker-compose.yml for local dev with db + cache
- GitHub Actions workflow: build, scan (trivy or scout), sign (cosign), push
- Deploy to a free target (Fly, Render) and prove it serves traffic

Submit a Git repo + image URL + verified signature output.

## Grading

- Image hygiene (30 percent): size, non-root, signed, scanned clean
- Compose for local dev (20 percent)
- CI workflow (25 percent)
- Deployment + observability (25 percent)

## Tips

- Distroless or scratch beats Alpine for size + CVE surface
- Always pin base images to SHA in production
- Sign every release image; verify in your deploy pipeline
- Use docker scout cves in CI to catch new CVEs in old images

# /certificate/docker