Black Forest Commandos: The Evolution of Docker Commandos

Black Forest Commandos (previously known as Docker Commandos) is a narrative-driven education framework I use to teach modern container security features through story, visuals, and hands-on exercises.

You can try it as a DIY workshop:

Black Forest Commandos: Asgard Mission DIY v1.5.2

Hands-on workshop materials for the 10 Black Forest Commandos in Asgard v1.5.2. Covering secure initialization, SBOM generation via Scout, Attestations, Hardened Images, VEX exemptions, Docker Bake, Cosign signing, and Zero-Day defense.

dockersecurity.io

Or you can check the series if you want to experience it at a conference.

---

In June 2025, I had the opportunity to conduct a workshop at WeAreDevelopers in Berlin. The workshop was called Docker Deep Dive with a Docker Captain and explained 10 different Docker commands and features. The workshop was booked within minutes, and over 100 people queued up on the delivery day to attend it. Unfortunately, only 40 could fit in the room.

Read about it here: Docker Deep Dive Workshop at WeAreDevelopers

10 Docker Commandos v1.0

After the success in Berlin, I brought the workshop home to my company JobRad in Freiburg, Germany. I renamed it to 10 Docker Commandos, as it was a play on the title 10 Docker Commands, as the word command is Kommando in German. I created a Teams background with a commando theme to advertise the workshop.

As you can see, the commandos are not really recognizable, apart from the guy in the middle that resembles me (with a red hat and orange T-shirt). And there are characters resembling Predator and Arnold Schwarzenegger.

The workshop covered the following 10 features:

• 1️⃣ Docker Init
• 2️⃣ Docker Bake
• 3️⃣ Docker SBOM
• 4️⃣ SBOM Attestations
• 5️⃣ Docker Scout
• 6️⃣ Docker Debug
• 7️⃣ Docker Model Runner
• 8️⃣ Ask Gordon
• 9️⃣ Docker MCP Toolkit
• 🔟 CAgent

The full workshop is available on GitHub: github.com/DockerSecurity-io/commandos. One can follow the README to set up the environment and run through the exercises.

Docker and Kubernetes Security

My first book, Docker and Kubernetes Security, was published in October 2025. The book starts like this:

In this book, you will learn how to secure your Docker image building process, so that Jack can't add a bitcoin miner to your app.

Jack is featured on the back cover of the book alongside Gord. Also, the frontispiece of the book features a battle scene between Jack, Gord, a man with a shield, and a CVE monster. The book is hinting that more stories are coming.

Black Forest Shadows

In December 2025, I published a 24-day advent series on container security, titled "Black Forest Shadows." The series was published both on DEV.to and Medium. The series follows stories of Gord and Jack among others, as they navigate the Black Forest in 1865 and face shadowy monsters called "CVEs". The series combines folklore with practical container security tips that mimic the in-world challenges.

Later, I decided to finish the story with 7 more chapters of pure narrative, and compiled the entire story into a book, published on Friday the 13th of March 2026, which is the 13th birthday of Docker. The book is available on Amazon as well as on buy.DockerSecurity.io.

Docker Commandos v1.3

Black Forest Shadows became the narrative backbone of the Docker Commandos universe. On the turn of the year, as I was preparing for 3 confirmed talks in the first half of 2026, I recreated the Teams background with more recognizable characters:

This version featured Gord from the Black Forest Shadows series for the first time. Also, the red-hatted commando is now recognized as Rothütle, a character from the Black Forest Shadows story. Dutch and Predator returned to the crew, as well as some pop culture characters like Big Boss, Solid Snake, and Snake Plissken from Escape from New York.

Docker Commandos in Asgard

In February 2026, I gave a talk at Jfokus in Sweden. The talk was titled Dockerize Securely: SBOMs + Attestations + Bake. As the conference was Norse-themed, I created a mission for the Docker Commandos to go to Asgard and fight the CVE monsters.

I even went further and created a comic strip for the talk, which I published as a part of the free package Docker Commandos Pack: buy.DockerCommandos.io.

The Jfokus talk is available on YouTube:

At the end of the talk, I announced that the Commandos will return at JCON Cologne in April 2026, and in Black Forest Shadows book:

Docker Commandos and JAVAPRO

JCON is organized by the same organization that publishes the Java magazine JAVAPRO. In late 2025, I submitted two article abstracts to JAVAPRO, and both were accepted. I started writing the articles right after the Jfokus talk:

• The Whispering JAR: Java Security Lessons Hidden in a Fantasy Tale
• 10 Docker Commandos: Docker Commands to Hunt the Predator

The first article is a continuation of the Black Forest Shadows story, and the second one tells the Asgard story in more detail. But, as JAVAPRO is a published magazine, and many characters from the Docker Commandos v1.3 are copyrighted, I put together a new team with original characters, making the JAVAPRO version more of an origin story for the Docker Commandos.

The team consists of:

• Agent Null: The masked tactical soldier in dark armor wearing a skull balaclava.
• Wilhelmina (Mina): An undead assassin.
• Gord: The swordsmaster in silver plate armor.
• Rothütle: The tactician in a red fedora and bright orange shirt.
• Captain Ahab: The bearded naval veteran.
• The Valkyrie: Identity specialist.
• Jack: The cyborg cowboy.
• Evie: The infiltrator.

The commandos recruit two new members in the story:

• Artemisia: Amazonian warrior and naval commander.
• RuinTan: The immortal who died and came back stronger.

The new team went for the first time to Rabobank, Utrecht, Netherlands, and the workshop was titled Docker Commandos v1.5: Asgard Mission. The Rabobank event was organized by Docker, Inc., and as I delivered the workshop, I got feedback from the Docker team that the experience could be more seamless, if I used the Docker Labspaces.

Interactive Workshop Format

The next delivery of the Docker Commandos v1.5: Asgard Mission workshop was at JCON Cologne in April 2026. The workshop was delivered in a Docker Labspace, which is an interactive environment that runs in the browser. The Labspace provides a guided experience with step-by-step instructions, and participants can run commands directly in the browser without needing to install anything locally.

The Labspace experience was possible only with collaboration with the Docker team, and Michael Irwin from Docker published a new version of the Labspace extension that made it possible for me to publish Docker Commandos as a Labspace. Visit the JCON Cologne 2026 workshop page to try it out.

Rebranding: Black Forest Commandos

In May 2026, as the Commandos became more popular, I decided to rebrand the team as Black Forest Commandos, to be safe with copyright and trademark issues. The Docker Commandos name is still used for the workshop series, but the characters and stories are now part of the Black Forest Commandos universe.

Today, Black Forest Commandos is:

• A hands-on Docker security workshop format
• A narrative universe with multiple characters and stories
• A comic-based storytelling format for DevSecOps education
• A growing fictional world that connects to Black Forest Shadows

More Commandos

There is page on the website dedicated to the Commandos. There you can find:

• Info about the characters
• The full workshop materials
• Asgard Arcade, with 4 browser-based games, including Blackjack and Asgardian Jass (which is a card game popular in Switzerland)

The Jass game was also separately developed as a mobile app, and is available on Google Play Store. The Commandos also visited:

• DevOps Days Zurich
• EnterJS in Mannheim
• JRush Livestream

The Commandos have had different missions other than the one in Asgard, and the story is still evolving. In EnterJS, they traveled through time and started fighting worms:

I also started composing music for Black Forest Commandos:

Back in Berlin

The Commandos are going back to Berlin in July 2026, for the WeAreDevelopers World Congress. They will be there as a workshop and a talk:

• Workshop: Dockerize Java Securely: SBOMs + Attestations + Bake (v1.5.3)
• Talk: Beyond SBOMs: The Future of Container Supply Chain Security

Now it's a full circle, as the Commandos started in Berlin, and now they're going back. It's just crazy how fast the Docker Commandos have evolved into Black Forest Commandos, and how many things happened around the Commandos just in the past 12 months.