Covers how to build, store and run containers well outside the orchestrator: OCI images and layers, registries, tagging and digests, minimal and distroless images, and runtimes such as containerd and runc. Also explains cgroup resource limits, image scanning, Docker Compose and container logging.