feat(root04): author Containers & Docker

Adds all 8 ROOT 04 modules (why containers exist, images & containers, Docker CLI, container
networking, container storage, Dockerfile & image build, Docker Compose, containers →
Kubernetes) — 43 activities, using the nested Docker Engine Phase 6D built and tested. Modules
1, 2, and 8 are conceptual (no lab by design) — the honest bridge module (M8) explicitly names
what Kubernetes adds beyond what this course already taught, without re-teaching Kubernetes
itself.

Adds 5 new hands-on Docker scenarios plus 2 MCQs, all against the real nested Docker Engine:
docker-cli-basics (run/exec/inspect a real container), docker-container-networking (a genuine
"works internally, unreachable from host" port-publishing failure, diagnosed and fixed by
recreating the container with the correct `-p` flag), docker-container-storage (a real
destroy/recreate cycle proving named-volume persistence, not just described), docker-build-image
(a real Dockerfile, a real build, a real custom image run), and docker-compose-multiservice (a
real two-service Compose application with a real published port). All tested end-to-end via the
real scenario-validation API, including negative tests.

Wires rootnode-containers-assessment (2 required + 4 random-draw scenarios) using the existing
Phase 3B assessment engine.

This completes the entire ROOT_ Foundations sequence (ROOT 01-04) — see
docs/PHASE6E_ROOT_FOUNDATIONS_COMPLETION.md.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

scenarios/data/docker-cli-basics.json

@@ -0,0 +1,38 @@
+{
+  "id": "docker-cli-basics",
+  "title": "Run, Exec Into, and Inspect a Real Container",
+  "category": "Containers",
+  "isolation_type": "shared_namespace",
+  "difficulty": "Easy",
+  "type": "task",
+  "weight": 5,
+  "description": "## Run, Exec Into, and Inspect a Real Container\n\n**Your task:**\n\n1. Run a container named `cli-lab-app` from the `nginx:alpine` image, in the background (detached)\n2. Use `docker exec` to run a command INSIDE the running container that creates `/tmp/marker.txt` containing exactly `hello-from-exec`\n3. Record the running container's ID to `/srv/docker-cli-lab/container-id.txt`\n4. Use `docker logs` and `docker inspect` to confirm it's actually running — you don't need to write those findings anywhere, just use them to verify your own work",
+  "hints": [
+    {
+      "title": "Running and execing",
+      "body": "`docker run -d --name <name> <image>` starts a container in the background under a name you choose instead of a random one. `docker exec <name> <command>` runs a NEW command inside an ALREADY-running container — different from `docker run`, which starts a brand new container.",
+      "command": "docker run -d --name cli-lab-app nginx:alpine\ndocker exec cli-lab-app sh -c 'echo hello-from-exec > /tmp/marker.txt'"
+    },
+    {
+      "title": "Recording the container ID",
+      "body": "`docker ps -q -f name=<name>` prints just the ID of a container matching that name filter.",
+      "command": "mkdir -p /srv/docker-cli-lab\ndocker ps -q -f name=cli-lab-app > /srv/docker-cli-lab/container-id.txt"
+    }
+  ],
+  "setup_commands": [
+    { "command": "mkdir -p /srv/docker-cli-lab" },
+    { "command": "docker rm -f cli-lab-app 2>/dev/null; true" },
+    { "command": "docker pull nginx:alpine" }
+  ],
+  "validation": {
+    "commands": [
+      { "description": "cli-lab-app is running from the correct image", "command": "docker inspect cli-lab-app --format '{{.Config.Image}} {{.State.Running}}' 2>/dev/null", "expected_output": "nginx:alpine true", "match": "exact" },
+      { "description": "the marker file was actually created inside the container via exec", "command": "docker exec cli-lab-app cat /tmp/marker.txt 2>/dev/null", "expected_output": "hello-from-exec", "match": "exact" },
+      { "description": "the container ID was correctly recorded and matches the real running container", "command": "[ \"$(cat /srv/docker-cli-lab/container-id.txt 2>/dev/null)\" = \"$(docker ps -q -f name=cli-lab-app)\" ] && echo match || echo mismatch", "expected_output": "match", "match": "exact" }
+    ]
+  },
+  "default_namespace": "default",
+  "teardown_commands": [
+    { "command": "docker rm -f cli-lab-app 2>/dev/null; rm -rf /srv/docker-cli-lab" }
+  ]
+}