Tasks
A Dockerfile to write or to fix, and a service that has to keep working. Graded on the manifest, on which instructions rebuilt, on what the image weighs, on what is still inside it, and on what the process did when it was asked to stop.
What an image is
The cache
Size
PID 1 and signals
Isolation
Limits
Forensics
An image you were handed. You do not get the Dockerfile — you get the image, the inspector and a question with a definite answer.