Docker Certified Associate

The Docker Certified Associate (DCA) is the vendor credential for core Docker and container fundamentals — not Kubernetes, not a specific cloud, just Docker itself: building images correctly, running Swarm-mode orchestration, wiring up networking and storage, and locking a container pipeline down. It predates this course's own containers & orchestration lesson and Docker tool page by several years, and it has lived through a genuine ownership change in that time: Docker, Inc. split its business in November 2019, and the enterprise half DCA's content was largely built around — Swarm at scale, Universal Control Plane, Docker Trusted Registry — went to a different company, Mirantis. What follows is a full profile of the exam as it has been documented, but read the second section before you trust anything else on this page: an explicit flag to verify who administers this exam today, and whether it's still being offered at all, before you spend a cent registering for it.

What the DCA is, and who it's for

☺ Like you're 10: A 90-minute, 55-question, closed-book multiple-choice exam about Docker specifically — no live terminal, unlike the CKA, even though almost everything it asks about is operational.

Docker, Inc. first opened the Docker Certified Associate for registration in late 2018 and took it to general availability in early 2019, as the company's own entry-level credential for the platform it created. Unlike the CKA, it is entirely knowledge-based: 55 multiple-choice questions in 90 minutes, delivered online with remote proctoring, no live daemon in front of you and nothing graded on end state. That's a real gap between what the exam tests and how it tests it — the six domains below are almost entirely operational skills (build this, wire this network, mount this volume, roll this service update), but the exam checks whether you can recognize the correct command or concept from a list, not whether your fingers can type it correctly under a clock.

It targets people who build and ship containers day to day and the operators who keep a Docker or Swarm fleet running underneath them — less a Kubernetes-cluster-administrator credential than a "do you actually know Docker itself, cold" one. Docker's own historical candidate guidance recommended 6–12 months of hands-on Docker experience before sitting it, though nothing enforces that formally; there is no prerequisite exam or credential required to register.

A program that changed hands: Docker, Inc. → Mirantis — verify before you spend anything

☺ Like you're 10: In November 2019, Docker sold the entire enterprise half of its business — including the Swarm-at-scale tooling this exam is built around — to a different company, Mirantis. Whether Mirantis still runs this exact certification today is the first thing to check, not the last.

This part is well documented and not in dispute: in November 2019, Docker, Inc. sold its Docker Enterprise platform business — Docker Enterprise Engine, Universal Control Plane (UCP), and Docker Trusted Registry (DTR), along with the enterprise customer contracts attached to them — to Mirantis. Docker, Inc. kept Docker Desktop, Docker Hub, Compose, and the developer-facing CLI tooling, and re-focused as a smaller company built around individual developers rather than enterprise container platforms. Mirantis subsequently rebranded the products it acquired: UCP became Mirantis Kubernetes Engine (MKE), and DTR became Mirantis Secure Registry (MSR) — names you'll see on newer study material that older DCA guides won't mention at all.

DCA's own domain list — Swarm orchestration at production scale, an enterprise registry, installation and configuration of a multi-node platform — lines up far more closely with the half of the business that went to Mirantis than with the Docker Desktop and Docker Hub half that stayed with Docker, Inc. Consistent with that, Mirantis's own training portal has been the most commonly reported home for DCA registration since the split. That is the most defensible current answer this page can give you, and it is exactly the kind of fact this section exists to make you re-check rather than accept.

The official domain breakdown

☺ Like you're 10: Six topics, and — like the CKA and unlike the Terraform Associate — Docker's own exam guide did publish a percentage weight for each one.

Docker, Inc.'s own DCA exam guide published six domains with explicit weights summing to 100%. These numbers have been stable and widely corroborated across the program's lifetime, though — consistent with everything above — confirm they're still the current structure with whoever administers the exam today before you build a study plan around them down to the percentage point.

Note the shape: Orchestration alone is 25%, tied with Image/Registry work as the two domains worth the most study time, and together they're 45% of the exam — nearly half. The wording below is a study-oriented reconstruction of Docker's long-published domain structure, not a verbatim quote; confirm the exact current sub-bullet text with whoever's running the exam before treating any single phrase as exam-verbatim.

Orchestration: this exam means Swarm, not Kubernetes

☺ Like you're 10: The single biggest surprise for anyone studying this after this course's own Kubernetes-heavy material: DCA's orchestration domain is Docker Swarm — a different, older, simpler orchestrator — not Kubernetes at all.

This is the distinction that trips up the most people coming from this course specifically. Containers & orchestration, the CKA, and the CKAD are all Kubernetes-first. DCA's 25%-weighted Orchestration domain is not — it's built around Docker Swarm mode, Docker's own simpler, built-in orchestrator: initializing a swarm, joining nodes as managers or workers, deploying multi-container applications as services and stacks, rolling updates, scaling, and swarm-native secrets. If your only orchestration experience is kubectl, budget real study time here — the concepts rhyme (declarative desired state, a control plane reconciling it) but the commands, objects, and vocabulary are entirely different.

# initialize a swarm on a manager node, then join workers/managers from other hosts
docker swarm init --advertise-addr 10.0.0.5
docker swarm join-token worker              # prints the join command to run on worker nodes
docker swarm join-token manager             # prints the join command for additional managers

# a "service" is Swarm's unit of deployment — a desired-state spec Swarm reconciles across the cluster
docker service create --name web --replicas 3 --publish 8080:80 nginx:1.27
docker service ls
docker service ps web                       # which node is each of the 3 replicas actually running on?

# rolling update: Swarm updates instances in controlled batches, not all at once
docker service update --image nginx:1.28 --update-parallelism 1 --update-delay 30s web
docker service scale web=5                  # imperative scale, no separate autoscaler object

# a "stack" deploys a whole multi-service application from a Compose file, Swarm-native
docker stack deploy -c docker-compose.yml myapp
docker stack services myapp

# secrets are swarm-native, encrypted at rest in the raft log, mounted as in-memory files — not env vars
docker secret create db_password ./db_password.txt
docker service create --name api --secret db_password myapp/api:1.4

The overlay networking that makes multi-host Swarm services reachable, and the routing mesh that lets any node in the swarm answer a published port for a service running elsewhere, are covered in the networking section below.

Images, Dockerfiles, and registries — what already overlaps with this course

☺ Like you're 10: This domain is the one you've likely already half-studied — building good images and knowing where they live is core material this course covers whether or not you're chasing a certification.

The 20%-weighted Image Creation, Management, and Registry domain is the least surprising of the six if you've already worked through the Docker tool page: Dockerfile instructions and layer caching, multi-stage builds to keep a shipped image small, tagging conventions, pushing to and pulling from a registry, and the difference between a public registry like Docker Hub and a private one. On the enterprise side, this domain is also where Docker Trusted Registry — now Mirantis Secure Registry — questions have historically lived: image scanning, replication between registries, and role-based access to repositories.

The exam expects you to know the practical difference between a resource-style build artifact (an image, immutable once built and tagged) and the registry that stores it, plus the vocabulary around image signing and provenance that this course covers in more depth than DCA's own guide does at supply-chain security & SBOM. Full Dockerfile syntax, multi-stage build patterns, and layer-cache mechanics are already covered end to end on the Docker tool page — this domain doesn't need a separate code sample here because that page's is the same material.

Installation, networking, security, and storage — the rest of the operational core

☺ Like you're 10: The four remaining domains, worth 55% combined — how you set the engine up, how containers reach each other, how you lock things down, and where data actually lives when a container stops.

Installation and Configuration (15%) covers installing and configuring the Docker Engine itself, editing daemon behavior through /etc/docker/daemon.json, and — on the enterprise side — backing up and restoring a Swarm's raft consensus data, since losing every manager node without a backup means losing the cluster's entire state.

Networking (15%) covers Docker's built-in network drivers: the default bridge network for single-host containers, user-defined bridge networks for better container-to-container DNS resolution, and — for Swarm specifically — the overlay driver that lets containers on different physical hosts reach each other, plus the routing mesh, which lets a published port answer on every node in the swarm regardless of which node the container actually landed on.

docker network create --driver overlay --attachable app-net
docker service create --name api --network app-net --replicas 3 myapp/api:1.4
# any node in the swarm can now answer requests on api's published port —
# that's the routing mesh, not a load balancer you configured yourself

Security (15%) covers Docker Content Trust for signing and verifying images, running containers as a non-root user, the isolation Linux namespaces and cgroups actually provide (and don't — a container is not a VM), and, on the enterprise side, role-based access control inside UCP/MKE.

export DOCKER_CONTENT_TRUST=1        # now docker push/pull require and verify signatures
docker push myrepo/app:1.2           # fails closed if the image isn't signed by a trusted key

Storage and Volumes (10%), the smallest domain, covers the three ways data survives (or doesn't) past a container's lifetime: named volumes managed by Docker, bind mounts to a specific host path, and tmpfs mounts that never touch disk at all.

docker volume create app-data
docker run -d --name db -v app-data:/var/lib/postgresql/data postgres:16
docker run -d --name web -v $(pwd)/html:/usr/share/nginx/html:ro nginx:1.27   # bind mount, host path
docker volume inspect app-data       # where does Docker actually keep this on the host?

How to prepare using this course

☺ Like you're 10: Two lessons cover most of it directly; the Swarm-specific half has no dedicated page here and is the part you'll need to learn mostly from hands-on practice and the vendor's own material.

The honest gap: this course was built Kubernetes-forward, so roughly half of DCA's weight — Orchestration and a chunk of Networking — has no direct page here. The other half — images, registries, security, and the Docker Engine fundamentals underneath everything — is already well covered. Plan to spend real hands-on time with a throwaway multi-node Swarm (three small VMs or cloud instances are enough) running the exact commands in the Orchestration section above; there's no substitute for having actually typed docker service update against a real cluster.

Exam logistics — and why verifying them matters more here than on any other cert in this course

☺ Like you're 10: Every certification's details drift over time. This one has drifted further than most, because the company running it changed entirely at least once.

Where it sits, and who should consider it

☺ Like you're 10: A fast, narrow, single-tool exam like the Terraform Associate — but with a real question mark over its current availability that neither of the other two certifications this course covers has.

Of the certifications profiled in depth across this course, DCA is closest in shape to the Terraform Associate: knowledge-based, one vendor's tool, no hands-on lab component, roughly an hour and a half rather than the CKA's two hours of live cluster work. What sets it apart isn't its format — it's the program-status uncertainty this whole page has flagged, which neither Terraform Associate nor the CKA currently carries to the same degree.

Consider it if: your organization runs Docker Swarm in production — it's a smaller footprint than Kubernetes today but far from extinct, especially in smaller shops that never needed Kubernetes' full complexity — and you want a formal check on Docker fundamentals broader than what a Kubernetes-only role would cover. Consider skipping it if: your organization runs Kubernetes rather than Swarm, in which case the CKA or CKAD will transfer far more directly to your actual job and to more employers; or if, after checking, you find the program is no longer actively administered — in which case treat this page as a study reference for genuinely useful Docker knowledge rather than exam prep, and put your certification budget toward the certifications page's other options instead.