← Back to All Certifications

🐳 Docker Certified Associate (DCA)

Your complete guide to earning the Docker Certified Associate (DCA) — the industry's leading container certification, validating expertise in image management, Swarm orchestration, networking, security, and storage for production container deployments.

📅 2–3 Months Study
📝 55 Questions · 90 Minutes
🏆 Pass Score: 70%
⌨️ MCQ + Multi-Select + Match
💰 $195 USD via Docker
🎯 Intermediate Level | DevOps Engineer / Platform Engineer / Site Reliability Engineer / Cloud Engineer

What is the Docker Certified Associate (DCA)?

The Docker Certified Associate (DCA) is the premier vendor-neutral container platform certification from Docker. It validates hands-on expertise in containerizing applications, building production-grade Docker images, orchestrating workloads with Docker Swarm, implementing container networking and storage, and securing Docker environments. DCA holders understand how to manage the full container lifecycle — from writing optimized Dockerfiles and managing private registries (DTR/Docker Hub), to deploying highly available Swarm clusters with rolling updates, secrets management, and overlay networking. The exam tests real-world practical knowledge across 6 domains, heavily weighted toward hands-on command proficiency. Employers across cloud, fintech, retail, and media industries actively seek DCA-certified engineers because containers are now the standard deployment unit for modern applications.

📋 Recommended Prerequisites

🗺️ Certification Pathway

Linux Fundamentals
→
Docker Basics (Docker Desktop)
→
Docker Certified Associate (DCA)
→
CKA (Kubernetes)
→
Cloud Native Specialist
Exam Blueprint
Docker Certified Associate — 6 Exam Domains
55 questions · 90 minutes · 70% passing score · Online proctored
Domain 1: Orchestration 25%
  • Docker Swarm: init, join, manager quorum (Raft consensus), node management
  • Services: replicated vs global mode, scaling, rolling updates, rollbacks
  • Stacks: docker-compose v3 format, deploy keys, secrets/configs integration
  • Health checks and their integration with Swarm scheduling
  • Placement constraints, preferences, resource reservations and limits
  • Update configurations: parallelism, delay, failure-action, monitor window
  • Volume templates for per-task storage in Swarm services
Domain 2: Image Creation, Management, and Registry 20%
  • Dockerfile instructions: FROM, RUN, COPY, ADD, ENV, ARG, WORKDIR, EXPOSE, USER, HEALTHCHECK, ENTRYPOINT, CMD, ONBUILD
  • Build optimization: layer caching, .dockerignore, multi-stage builds, --target flag
  • Image tagging, pushing, and pulling from Docker Hub and private registries
  • Docker Content Trust (DCT) for image signing and notary
  • Docker Trusted Registry (DTR): image promotion policies, security scanning, webhooks
  • Registry authentication, CA certificate configuration in /etc/docker/certs.d/
  • docker scout cves for vulnerability scanning; docker history for layer inspection
Domain 3: Installation and Configuration 15%
  • Docker Engine installation on Ubuntu, CentOS, RHEL, and Windows Server
  • daemon.json configuration: log-driver, storage-driver, live-restore, userns-remap, icc, dns
  • Storage drivers: overlay2 requirements and configuration
  • Docker proxy configuration for airgapped environments
  • Docker namespaces: pid, net, ipc, uts, mnt, user — isolation mechanisms
  • cgroups for resource limiting: CPU shares, memory limits, PIDs limit
  • systemd service management, Docker version commands, docker info output
Domain 4: Networking 15%
  • Network drivers: bridge, host, overlay, macvlan, none — use cases for each
  • Bridge networking: default bridge vs user-defined, DNS resolution differences
  • Overlay networks: VXLAN encapsulation, port requirements (TCP 2377, 7946 / UDP 4789, 7946)
  • Routing mesh: ingress network, IPVS load balancing, publish mode (ingress vs host)
  • Network troubleshooting: container DNS, connectivity debugging, tcpdump
  • Encrypted overlay networks (--opt encrypted, AES-256)
Domain 5: Security 15%
  • Docker secrets: creation, service access, tmpfs mounting at /run/secrets/, Raft encryption
  • Docker configs: non-sensitive configuration files, service-scoped distribution
  • Secrets vs Configs: what's encrypted vs not, use case differentiation
  • Kernel security: namespaces, capabilities, seccomp profiles, AppArmor/SELinux
  • Docker socket security: risks of mounting /var/run/docker.sock
  • Non-root container users (USER instruction), no-new-privileges daemon option
  • Docker Content Trust, image signing workflow with Notary
Domain 6: Storage and Volumes 10%
  • Volume types: named volumes, bind mounts, tmpfs mounts — when to use each
  • Volume lifecycle: creation, inspection, backup patterns, removal safety
  • Storage driver concepts: overlay2, copy-on-write (CoW), read-write layers
  • docker system df: image, container, volume, build cache disk breakdown
  • Volume backup: docker run --rm with alpine + tar pattern
  • Volume templates in Swarm ({{.Task.Slot}}) for per-task storage
Phase 1 · Weeks 1–2
Container Foundations and Docker Engine
Build the foundation before diving into orchestration. This phase ensures you can work with containers and images fluently.

🐳 Core Container Concepts

Container vs VM architecture
Linux namespaces and cgroups
Image layers (copy-on-write)
Container lifecycle states
docker run flags: -d, -p, -v, -e, --name
Image pull, tag, push, inspect
docker exec, logs, stats, top
Stop vs kill (SIGTERM/SIGKILL)
Exit code 137 (OOM/SIGKILL)
--rm auto-cleanup flag
docker system prune variants
docker system df disk breakdown

🔨 Dockerfile Mastery

All 18 Dockerfile instructions
Layer cache invalidation rules
COPY vs ADD (when each is right)
ENTRYPOINT vs CMD interaction
Multi-stage builds + --target
Build args (ARG) vs ENV
USER instruction (non-root)
HEALTHCHECK configuration
.dockerignore patterns
dockerfile WORKDIR
RUN chaining with && (fewer layers)
docker build --no-cache

📚 Resources

  • Docker Official Documentation — docs.docker.com — comprehensive, authoritative, free
  • Play with Docker (PWD) — labs.play-with-docker.com — free browser-based Docker environment
  • Docker 101 Tutorial — labs at training.play-with-docker.com — free hands-on labs
  • Bret Fisher's Docker and Kubernetes course (Udemy) — best DCA prep course available
  • Nigel Poulton's "Docker Deep Dive" book — concise, DCA-aligned, affordable

Phase 1 Study Tips

  • Do not skip the hands-on: install Docker Desktop locally or use Play with Docker for every concept you learn
  • The DCA exam heavily tests command flags — practice docker run, build, exec, inspect, logs until flags are second nature
  • Memorize the difference between ENTRYPOINT form (exec form vs shell form) — it appears on almost every DCA practice exam
  • Build 5+ different Dockerfiles from scratch: a Node.js app, a Python Flask app, an Nginx static site, a Go binary, and a Java JAR — each teaches different Dockerfile patterns
Phase 2 · Weeks 3–4
Networking and Storage Deep Dive
Master container networking and volume management — two domains where DCA candidates most commonly lose points.

🌐 Container Networking

Bridge driver internals
Default vs user-defined bridge
Automatic DNS in user-defined
Host network driver
None network driver
Macvlan for layer-2 access
Overlay + VXLAN architecture
--opt encrypted for overlays
Port publishing modes
Routing mesh + ingress
Service discovery (VIP)
Network troubleshooting

💾 Volumes and Storage

Named volumes vs bind mounts
tmpfs for in-memory storage
Volume backup with tar + alpine
overlay2 storage driver
Copy-on-write layer model
docker volume inspect
Volumes survive container removal
Volume driver plugins
Secrets stored as tmpfs
docker system df

🧪 Hands-On Labs

Lab: Network Driver Comparison

Run 4 containers using each network driver (bridge, host, overlay [requires Swarm], none). For bridge: create a user-defined bridge, add 2 containers, ping by container name (works). Compare to default bridge where ping by name fails. Use docker network inspect to see subnets.

Lab: Volume Backup and Restore

Create a postgres container with a named volume. Insert data. Stop the container. Run: `docker run --rm -v postgres-data:/data -v $(pwd):/backup alpine tar czf /backup/postgres-backup.tar.gz /data`. Remove the volume. Restore from backup. Verify data is intact.

  • Docker Networking documentation — docs.docker.com/network — read all 6 driver pages
  • Container Networking from Docker — youtube.com/docker — free official talks
  • Katacoda Docker Networking scenarios — interactive labs (check for archived versions)
Phase 3 · Weeks 5–6
Docker Swarm Orchestration Mastery
Orchestration is the largest domain (25%). You MUST practice Swarm with real multi-node clusters, not just single-node desktop setups.

🐝 Swarm Cluster Management

docker swarm init + advertise-addr
Join tokens (worker vs manager)
Raft consensus + quorum math
Manager fault tolerance (n/2+1)
Node promotion and demotion
Node availability states
Node labels + placement constraints
docker node ls + inspect

⚙️ Services and Stacks

Replicated vs global services
docker service create flags
docker service scale
docker service update
--update-parallelism + --update-delay
--update-failure-action rollback
Health check integration
docker stack deploy -c
Compose v3 deploy section
Volume templates ({{.Task.Slot}})
docker service ps + logs
service scale=0 (zero-downtime off)

🧪 Hands-On Labs

Lab: 3-Manager High-Availability Swarm

Use Play with Docker or 3 local VMs to build a 3-manager Swarm. Verify quorum. Kill one manager — cluster should still function. Kill a second — quorum is lost, read-only mode. Restore the second manager. Practice: `docker swarm init`, join with manager token, `docker node ls`, `docker node promote/demote`.

Lab: Rolling Update with Auto-Rollback

Deploy a service with v1 image. Monitor with `watch docker service ps`. Run update to a deliberately broken v2 image. Observe Swarm detect health check failures and auto-rollback to v1 (requires `--update-failure-action rollback` and a HEALTHCHECK). Check `docker service inspect` for rollback_config and update_config fields.

  • Play with Docker Classroom — training.play-with-docker.com — free Swarm labs
  • Bret Fisher's Docker Swarm Mastery course — Udemy — most comprehensive Swarm-focused course
  • Docker Swarm Tutorial — docs.docker.com/engine/swarm/swarm-tutorial — step by step official
Phase 4 · Weeks 7–8
Security, Registry, and Installation Configuration
Complete your knowledge with Docker security best practices, image registry management, and engine configuration.

🔐 Docker Security

Docker secrets lifecycle
Secrets vs Configs (encrypted vs not)
Non-root USER in Dockerfile
--no-new-privileges flag
Linux kernel capabilities
Seccomp profiles (default)
AppArmor profile assignment
userns-remap in daemon.json
Docker socket risks
Docker Content Trust (DCT)
docker scout cves scanning
Encrypted overlay networks

📦 Image Registry and DTR

Docker Hub organizations
Private registry setup
TLS for private registries
CA cert at /etc/docker/certs.d/
DTR image promotion policies
DTR security scanning
DTR webhooks
Registry mirror configuration

⚙️ Engine Configuration

daemon.json: log-driver + log-opts
live-restore: true
overlay2 storage driver config
Proxy settings in daemon.json
Docker Engine installation (apt/yum)
systemctl manage Docker service
Logging drivers comparison
--init flag and tini PID 1

Security Domain Tips

  • Know EXACTLY where secrets are mounted: /run/secrets/{secret-name} — accessible as file, not as env var (this is by design, env vars can be leaked via child processes)
  • Docker socket mounting (docker run -v /var/run/docker.sock:/var/run/docker.sock) = container can control the host Docker daemon = complete host compromise. Treat this as privileged mode.
  • Content Trust: set DOCKER_CONTENT_TRUST=1 before push/pull, or use --disable-content-trust=false flag. Without DCT: any image from any registry is pulled without signature verification.
  • live-restore: true in daemon.json allows containers to keep running during daemon restart (e.g., dockerd upgrade). Without this: all containers stop when dockerd stops.
Phase 5 · Final Week
Exam Preparation and Practice Testing
Final polish: identify weak areas, do timed practice, review command flags, and build exam-day confidence.

📊 Practice Exam Strategy

Whizlabs DCA practice tests
Udemy DCA practice (Vikas Kushwaha)
Official Docker mock questions
Review docker man pages for flags
Timed 90-minute mock exams
Identify weakest domain
Review official DCA study guide
Flashcard review (30 DCA cards)

🎯 High-Frequency Exam Topics

  • Swarm quorum: with 3 managers, tolerate 1 failure. With 5 managers, tolerate 2 failures. Formula: (managers-1)/2 failures tolerated.
  • Raft consensus: Swarm manager state is distributed via Raft. All managers participate; only Leader executes. Loss of quorum = read-only mode.
  • Overlay network required ports: TCP 2377 (Swarm management), TCP+UDP 7946 (node communication), UDP 4789 (VXLAN data plane)
  • docker service update vs docker stack deploy: update modifies running service; stack deploy is declarative (idempotent whole-stack update)
  • ENTRYPOINT + CMD combined: ENTRYPOINT is the executable, CMD provides default arguments. Override CMD at runtime, override ENTRYPOINT with --entrypoint flag.
  • Secrets are encrypted in Raft log (at rest) — Configs are NOT encrypted. Both deliver to container only when service has access.
Final Lab: Full DCA Scenario

Given: a docker-compose.yml with a web app + database. Tasks: (1) Convert to Swarm stack format (v3.9 with deploy section). (2) Create secrets for DB password. (3) Create overlay network with encryption. (4) Deploy the stack. (5) Scale the web service to 5 replicas. (6) Perform a rolling update with auto-rollback on failure. (7) Verify routing mesh serves traffic from any node. (8) Backup the database volume. (9) Clean up: remove stack, secrets, network, images. Time yourself — this is the level of the DCA hands-on component.

Career Impact
Roles and Salary Ranges for DCA Holders
Container expertise is foundational for modern DevOps, cloud, and platform engineering roles
DevOps Engineer
$110K–$160K
Platform Engineer
$125K–$175K
Site Reliability Engineer
$130K–$185K
Cloud Engineer
$105K–$155K
Container Security Engineer
$130K–$190K

DCA + What's Next?

  • DCA + CKA is the power combo: Docker Swarm (DCA) + Kubernetes (CKA) = cover all container orchestration platforms. Most modern shops use Kubernetes, but Swarm is simpler and many SMBs still use it.
  • Docker + Terraform + CKA = the DevOps engineer trifecta. Cloud companies pay premium for all three in one engineer.
  • Container Security specialization: DCA → Kubernetes NeuVector / Falco → CKS (Certified Kubernetes Security Specialist). Container security is a fast-growing niche with limited supply of experts.

Ready to Get Docker Certified?

Start with the Docker fundamentals phase, build hands-on projects on Swarm, and practice with DCA-aligned questions and flashcards to validate your readiness before the exam.

🧠 Practice DCA Questions 🃏 Docker Flashcards 🔨 Hands-On Projects