Docker Certified Associate (DCA) Exam Guide

The Docker Certified Associate validates your ability to use Docker Enterprise for containerized application development, deployment, and management. While Docker Inc. has evolved its certification program, the underlying skills remain critical for any container professional.

Exam Overview

Detail	Value
Provider	Docker Inc. / Mirantis
Questions	55 (multiple choice)
Length	90 minutes
Passing Score	65%
Price	~$195 USD

Domain Breakdown

Domain	Weight
Orchestration	25%
Image Creation, Management, and Registry	20%
Installation and Configuration	15%
Networking	15%
Security	15%
Storage and Volumes	10%

Key Concepts

1. Orchestration (25%)

Docker Swarm

Swarm initialization — docker swarm init, docker swarm join, docker swarm leave
Node types — Manager (control plane) vs Worker (runs containers)
Raft consensus — Manager quorum (3+ managers for high availability)
Services — docker service create, docker service ls, docker service scale, docker service update
Replicated vs Global services — Replicated (N instances) vs Global (one per node)
Rolling updates — Order (start-first vs stop-first), parallelism, update delay, rollback

Stack Files

Compose file format (version 3+) for deploying to Swarm
docker stack deploy -c docker-compose.yml my-stack
docker stack services, docker stack ps, docker stack rm

Desired State Reconciliation

Docker Swarm continuously reconciles actual state → desired state
Health checks, restart policies, rescheduling

2. Image Creation, Management & Registry (20%)

Dockerfile

FROM node:18-alpine           # Base image
WORKDIR /app                  # Working directory
COPY package*.json ./         # Copy files
RUN npm install               # Build-time commands
COPY . .
EXPOSE 3000                   # Document port
ENV NODE_ENV=production       # Environment variables
USER node                     # Run as non-root
CMD ["node", "app.js"]        # Default command

Best Practices

Multi-stage builds — Separate build vs runtime stages
Minimize layers — Combine RUN commands with &&
Use .dockerignore — Exclude unnecessary files
Use specific tags — Never latest in production
Prefer scratch/alpine base for minimal size

Registry

Docker Hub — Public and private repos, automated builds
Private registry — registry:2 image, authentication (htpasswd), TLS
docker push, docker pull, docker tag, docker login

3. Installation and Configuration (15%)

Docker Engine Installation

RHEL/CentOS — yum install docker-ce docker-ce-cli containerd.io
Ubuntu/Debian — apt install docker-ce docker-ce-cli containerd.io
Post-install — Add user to docker group, enable docker service

Configuration

/etc/docker/daemon.json — Log driver, storage driver, insecure registries, cgroup driver
dockerd — Daemon startup options (debug, host, storage-driver)
Troubleshooting — docker info, docker system df, docker system events

Container Runtimes

runc (default), containerd, CRI-O
Low-level vs high-level runtimes

4. Networking (15%)

Network Types

Network Type	Scope	Use Case
bridge	Single host	Default for containers on same host
host	Single host	Container uses host networking stack
overlay	Multi-host	Swarm service networking across nodes
macvlan	Multi-host	Assign MAC addresses to containers
none	—	No network (loopback only)

DNS and Service Discovery

Embedded DNS — Container name resolution (service name → IP)
/etc/resolv.conf — Managed by Docker
--network-alias — Network aliases for service discovery

Port Mapping

-p host:container — Publish port (e.g., -p 8080:80)
-P — Publish all exposed ports to random high ports
Exposure (EXPOSE) — Documentation only, does not publish

5. Security (15%)

Content Trust

export DOCKER_CONTENT_TRUST=1
Image signing with delegation keys
Push/pull requires signed images

Secrets Management

Swarm secrets — docker secret create, mounted at /run/secrets/<name>
Not stored in images — encrypted during transport and at rest
Read-only tmpfs mount in container

User Namespaces

--userns-remap — Map container root to non-root host user
/etc/subuid, /etc/subgid — UID/GID mapping ranges

Security Best Practices

Don't run containers as root — Use USER in Dockerfile, --user in run
Read-only root filesystem — --read-only
Drop capabilities — --cap-drop=ALL --cap-add=NET_BIND_SERVICE
Resource limits — --memory, --cpus, --pids-limit
Seccomp, AppArmor, SELinux — Kernel security modules

6. Storage and Volumes (10%)

Volume Types

Type	Command	Persistence	Sharing
Named volume	`docker volume create`	Managed by Docker	Between containers
Bind mount	`-v /host:/container`	Any file on host	Host filesystem
tmpfs mount	`--tmpfs /path`	In-memory only	Not persistent

Volume Drivers

local (default), nfs, cloudstor (AWS EBS, Azure Disk)
Volume plugins — Third-party drivers for various backends

Data Management

docker cp — Copy files between container and host
docker export / docker import — Container filesystem export
docker commit — Create image from container changes

Essential Docker Commands

# Images
docker pull nginx:alpine
docker images
docker rmi nginx
docker build -t my-app .
docker tag my-app my-registry/my-app:1.0

# Containers
docker run -d --name web -p 8080:80 nginx
docker ps -a
docker stop web && docker rm web
docker exec -it web /bin/bash
docker logs -f web
docker inspect web

# Volumes
docker volume create my-data
docker run -d --name db -v my-data:/var/lib/mysql mysql

# Swarm
docker swarm init --advertise-addr 10.0.0.1
docker service create --name web --replicas 3 -p 80:80 nginx
docker service scale web=5
docker node ls

# System
docker system df
docker system prune -a
docker info

Study Tips

Master the CLI — Know every flag for docker run, docker service create, docker build
Understand Swarm deeply — Manager/worker roles, Raft consensus, service updates, rolling back
Practice Dockerfiles — Multi-stage builds, layer optimization, security best practices
Know networking — Bridge vs overlay vs host, DNS resolution, port mapping options
Compare orchestration — Swarm vs Kubernetes (when to use which)

Practice Questions

Test your knowledge with our Docker practice questions — 50+ questions covering all domains.

Start Practice →

Career Impact

DevOps Engineer — $100k–$145k
Platform Engineer — $110k–$150k
Site Reliability Engineer — $120k–$160k
Cloud Engineer — $95k–$135k

Next: CKA (Kubernetes Administrator) or CKAD (Kubernetes Developer)

Docker Certified Associate Exam Guide