# Docker Learn

> Guided learning paths, videos, and hands-on guides for Docker.
> Learn teaches how to achieve outcomes with Docker; docs.docker.com remains
> the authoritative product reference.

Guides may carry simulated terminals inline. These are deterministic
browser simulations: they do not run a real Docker daemon, container, or
AI provider.

## Learning paths

### Get Started with Docker Sandboxes

Learn what a Docker Sandbox is, run an AI coding agent inside one, customize it with kits, and capture the whole setup in a file you can share. Outcome: You can explain what a sandbox isolates and why, run an agent inside one on your own project, and hand your setup to someone else as a file.

- [What is a sandbox?](https://docs.docker.com/learn/content/what-is-a-sandbox.md): Start with the mental model, so every command after it has somewhere to land.
- [Run your first AI agent in a Docker Sandbox](https://docs.docker.com/learn/content/run-your-first-sandbox.md): Run a real agent on your own project, and push on each wall of the sandbox yourself.
- [Customize your sandbox with kits](https://docs.docker.com/learn/content/customize-your-sandbox-with-kits.md): Change what's in the box, from the tools the agent has to the agent itself, without building anything.
- [Define and share your sandbox environment](https://docs.docker.com/learn/content/define-and-share-your-sandbox-environment.md): Turn the setup you've built into a file that anyone can run to get the same sandbox.
- [Integrating sandboxes into native apps](https://docs.docker.com/learn/content/integrating-sandboxes-into-native-apps.md): An optional extra if you'd rather drive the agent from the desktop app you already use.

### Build and customize Docker Sandbox environments

Build your own Docker Sandbox kits — tools, skills, and authenticated access to your services — and publish them so your team gets the same environment. Outcome: You can author a kit that gives an agent the tools, knowledge, and service access your project needs, make it configurable, and publish it for others to use.

- [Build your first Docker Sandbox kit](https://docs.docker.com/learn/content/build-your-first-sandbox-kit.md): Learn the shape of a kit and the edit-and-run loop every other step uses.
- [Add tools and runtimes to a sandbox](https://docs.docker.com/learn/content/add-tools-and-runtimes-to-a-sandbox.md): Give the agent the toolchain your project actually needs.
- [Give your agents reusable skills](https://docs.docker.com/learn/content/give-your-agents-reusable-skills.md): Package what your team knows, not just what it installs.
- [Connect to services without exposing credentials](https://docs.docker.com/learn/content/connect-to-services-without-exposing-credentials.md): Reach your own APIs while the credential stays on the host.
- [Make your Sandbox kits configurable](https://docs.docker.com/learn/content/make-your-sandbox-kits-configurable.md): Turn one team's kit into one that fits many projects.
- [Publish and share your Docker Sandbox kits](https://docs.docker.com/learn/content/publish-and-share-your-sandbox-kits.md): Get the kit off your machine and into everyone else's sandboxes.

### Get started with Docker containers

Learn what containers and images are, run a real app in a container, keep its data, and run it alongside a database with Docker Compose. Outcome: You can explain what a container and an image are, run and configure containers from the command line, keep their data, and start a multi-container app with one command.

- [What is a container?](https://docs.docker.com/learn/content/what-is-a-container.md): Start with the mental model, so every command after it has somewhere to land.
- [Run your first container](https://docs.docker.com/learn/content/run-your-first-container.md): Run a real app, reach it in your browser, configure it, and look inside it.
- [Keep data with volumes and bind mounts](https://docs.docker.com/learn/content/keep-data-with-volumes-and-bind-mounts.md): Containers are disposable. Learn where to put the data that isn't.
- [Run a multi-container app with Compose](https://docs.docker.com/learn/content/run-a-multi-container-app-with-compose.md): Connect the app to a database by hand, then capture the whole setup in one file.

### Build and share your own images

Write a Dockerfile for a real app, make it build fast, make it small, and push it to Docker Hub for anyone to run. Outcome: You can containerize an app with a Dockerfile, order it so rebuilds are fast, slim it down with a multi-stage build, and publish it to a registry.

- [Write your first Dockerfile](https://docs.docker.com/learn/content/write-your-first-dockerfile.md): Turn source code into an image you can run, one instruction at a time.
- [How image layers and the build cache work](https://docs.docker.com/learn/content/how-image-layers-and-the-build-cache-work.md): Learn why some rebuilds take seconds and others take minutes, and reorder your Dockerfile to get the fast kind.
- [Shrink your image with multi-stage builds](https://docs.docker.com/learn/content/shrink-your-image-with-multi-stage-builds.md): Add the frontend build, and leave the tools that built it out of the image you ship.
- [Share your image on Docker Hub](https://docs.docker.com/learn/content/share-your-image-on-docker-hub.md): Tag the image and push it, so it runs anywhere with one command.

### Secure your software supply chain

Start from a trusted base, find and fix what's actually exploitable, enforce your standards, sign what you build, and let production run only what you can verify. Outcome: You can show where an image came from, what's in it, which policies it passed, and that nobody changed it on its way to production.

- [Build your application on a trusted foundation](https://docs.docker.com/learn/content/build-on-a-trusted-foundation.md): Start the chain from a minimal, hardened base instead of whatever the tag points at today.
- [Find and fix vulnerabilities before you ship](https://docs.docker.com/learn/content/find-and-fix-vulnerabilities-before-you-ship.md): Separate the CVEs you can act on from the noise, fix them, and prove the fix worked.
- [Document vulnerabilities that don't affect your application](https://docs.docker.com/learn/content/document-vulnerabilities-that-dont-affect-your-app.md): Record why a CVE that's present isn't exploitable, so every scanner stops asking.
- [Enforce your organization's container standards](https://docs.docker.com/learn/content/enforce-your-container-standards.md): Turn your team's practices into rules that builds and images have to pass.
- [Prove where your container image came from](https://docs.docker.com/learn/content/prove-where-your-image-came-from.md): Sign an image, and verify it by identity and digest instead of trusting a tag.
- [Build a trusted container delivery pipeline](https://docs.docker.com/learn/content/build-a-trusted-delivery-pipeline.md): Put every step into CI, so every image that ships carries the same evidence.
- [Only run trusted images in production](https://docs.docker.com/learn/content/only-run-trusted-images-in-production.md): Have the cluster check that evidence and refuse anything that can't show it.

## All content

- [How image layers and the build cache work](https://docs.docker.com/learn/content/how-image-layers-and-the-build-cache-work.md) (guide, beginner): Find out why changing one line of code can make docker build reinstall every dependency. See the layers your Dockerfile creates, then reorder it so the build cache skips the slow steps.
- [Keep data with volumes and bind mounts](https://docs.docker.com/learn/content/keep-data-with-volumes-and-bind-mounts.md) (guide, beginner): A container's files disappear when you remove it. Keep a to-do app's database in a named volume so it survives a new container, bind-mount a directory so you can see the database on your own disk, and learn which one to reach for.
- [Run a multi-container app with Compose](https://docs.docker.com/learn/content/run-a-multi-container-app-with-compose.md) (guide, beginner): Connect a to-do app to a MySQL database by hand on a Docker network, feel how many flags that takes, then describe the same app in one compose.yaml and run it with a single command.
- [Run your first container](https://docs.docker.com/learn/content/run-your-first-container.md) (guide, beginner): Run a real to-do app in a container, reach it from your browser, run a second copy beside it, configure it with an environment variable, look inside it, and see what happens to its data when you remove it.
- [Share your image on Docker Hub](https://docs.docker.com/learn/content/share-your-image-on-docker-hub.md) (guide, beginner): Name your image for a registry, sign in, and push it to Docker Hub with a version tag and latest, then pull it back and run it the way anyone else would.
- [Shrink your image with multi-stage builds](https://docs.docker.com/learn/content/shrink-your-image-with-multi-stage-builds.md) (guide, beginner): Split a Node.js Dockerfile into build stages and a slim final stage, so the image ships the built frontend and production dependencies but leaves the compilers and dev tools behind. Then measure the difference.
- [What is a container?](https://docs.docker.com/learn/content/what-is-a-container.md) (guide, beginner): Learn what containers and images are, how a container differs from a virtual machine, and where images come from, using registries, repositories, tags, and the trusted content on Docker Hub.
- [Write your first Dockerfile](https://docs.docker.com/learn/content/write-your-first-dockerfile.md) (guide, beginner): Write a Dockerfile for a real Node.js app, build it into an image, run it, and call its API, while learning what each instruction does and what the build context is.
- [Build a trusted container delivery pipeline](https://docs.docker.com/learn/content/build-a-trusted-delivery-pipeline.md) (guide, advanced): Write a GitHub Actions release workflow that builds an image with SBOM and provenance attestations, gates it on Docker Scout policy, signs it by digest with keyless Cosign, and only then publishes the release tag.
- [Build your application on a trusted foundation](https://docs.docker.com/learn/content/build-on-a-trusted-foundation.md) (guide, intermediate): Move a Node.js image from node:22 to a multi-stage Docker Hardened Images build, then measure what changed: size, packages, CVEs, and the signed attestations the new base ships with.
- [Document vulnerabilities that don't affect your application](https://docs.docker.com/learn/content/document-vulnerabilities-that-dont-affect-your-app.md) (guide, intermediate): Write an OpenVEX statement for a CVE your application can't reach, check it against Docker Scout, and attach it to the image so the assessment travels with every pull.
- [Enforce your organization's container standards](https://docs.docker.com/learn/content/enforce-your-container-standards.md) (guide, advanced): Turn your team's image rules into checks that run on every build: a Buildx build policy that refuses unapproved base images before the build starts, and Docker Scout policies that fail an image that doesn't meet the bar.
- [Find and fix vulnerabilities before you ship](https://docs.docker.com/learn/content/find-and-fix-vulnerabilities-before-you-ship.md) (guide, intermediate): Scan an image with the Docker Scout CLI, separate the findings you can act on from the ones you can't, fix them by updating dependencies and refreshing the base image, and prove the fix with a side-by-side comparison.
- [Only run trusted images in production](https://docs.docker.com/learn/content/only-run-trusted-images-in-production.md) (guide, advanced): Install Kyverno and write an admission policy that admits an image to the production namespace only when it is signed by your release workflow and carries a signed SBOM, then watch the cluster refuse everything else.
- [Prove where your container image came from](https://docs.docker.com/learn/content/prove-where-your-image-came-from.md) (guide, advanced): Sign your image by digest with a Cosign key pair, verify the signature, and watch verification catch an image pushed over a trusted tag.
- [Add tools and runtimes to a sandbox](https://docs.docker.com/learn/content/add-tools-and-runtimes-to-a-sandbox.md) (guide, intermediate): Package a language runtime as a Docker Sandbox kit. Install it at build time with a Dockerfile, then use lifecycle hooks and config files to prepare each sandbox before the agent starts.
- [Build your first Docker Sandbox kit](https://docs.docker.com/learn/content/build-your-first-sandbox-kit.md) (guide, intermediate): Write a small v3 mixin kit from scratch, validate it with Buildx, run it in a sandbox from a local directory, and see how a kit carries its files, network rules, and agent instructions in one image.
- [Connect to services without exposing credentials](https://docs.docker.com/learn/content/connect-to-services-without-exposing-credentials.md) (guide, intermediate): Write a kit that teaches the sandbox proxy about your own internal API, so an agent can call it with a real token that never enters the sandbox.
- [Give your agents reusable skills](https://docs.docker.com/learn/content/give-your-agents-reusable-skills.md) (guide, intermediate): Package your team's workflow as an agent skill in a Docker Sandbox kit, add standing guidance beside it, and see an agent find and use both in a fresh sandbox.
- [Make your Sandbox kits configurable](https://docs.docker.com/learn/content/make-your-sandbox-kits-configurable.md) (guide, intermediate): Turn a kit with hardcoded values into one that serves every team and project. Declare arguments with defaults and constraints, template them into network policy and generated files, and supply values from the CLI, an environment file, or a kit set.
- [Publish and share your Docker Sandbox kits](https://docs.docker.com/learn/content/publish-and-share-your-sandbox-kits.md) (guide, intermediate): Turn a kit that works on your machine into a versioned, multi-platform, signed image on Docker Hub, and let GitHub Actions publish every release for you.
- [Customize your sandbox with kits](https://docs.docker.com/learn/content/customize-your-sandbox-with-kits.md) (guide, beginner): Change what's in your sandbox without building anything. Add a published kit to give the agent a browser to test with, then swap the agent itself and keep the browser.
- [Define and share your sandbox environment](https://docs.docker.com/learn/content/define-and-share-your-sandbox-environment.md) (guide, beginner): Capture your sandbox setup in an sbxenv.yaml file, so anyone on your team gets the same sandbox with one command and nobody has to learn every flag you did.
- [What is a sandbox?](https://docs.docker.com/learn/content/what-is-a-sandbox.md) (guide, beginner): A friendly, picture-first look at how a Docker Sandbox keeps an AI agent helpful and your computer safe — the box, the door guard, the pretend key, and the kits you pack inside.
- [Integrating sandboxes into native apps](https://docs.docker.com/learn/content/integrating-sandboxes-into-native-apps.md) (guide, beginner): Wire Claude Desktop and ChatGPT Desktop to a Docker Sandbox over SSH, so the AI app you already use drives an agent that never touches your host.
- [Working with secrets with Docker Sandboxes](https://docs.docker.com/learn/content/working-with-sandbox-secrets.md) (guide, beginner): Configure the credentials an agent needs — built-in services, a kit-declared service, and a private registry — and see why none of them ever reach the sandbox.
- [Run your first AI agent in a Docker Sandbox](https://docs.docker.com/learn/content/run-your-first-sandbox.md) (guide, beginner): Give Claude Code its credentials, start it on a real project inside a sandbox, and test its isolation yourself — the filesystem, the credentials, and the network — before you clean up.
- [Run an agent safely in a Docker Sandbox](https://docs.docker.com/learn/content/run-an-agent-safely.md) (guide, beginner): Practice launching a sandboxed agent and reviewing its workspace and network boundary in a deterministic simulated terminal.