= Uninstalling the 'docker-ce' package before installing the 'docker-ee' package will not upgrade Docker Engine CE to Docker Engine EE. It will only remove the existing Docker Engine CE installation and install a new Docker Engine EE installation. This means that any existing containers, images, volumes, networks, and other Docker resources will be lost. To upgrade Docker Engine CE to Docker Engine EE without losing any data, you need to use the migration tool provided by Docker1 or follow the steps described in the Docker documentation2 or other online guides34. References:
* 1: Migrate to Engine 1.10 | Docker Docs
* 2: Install Docker Engine | Docker Docs
* 3: Switching Docker 18.09 Community Edition to Enterprise Engine with no ...
* 4: How to upgrade Docker 18.09 Community Edition to Docker Enterprise 18.09

The purpose of Docker Content Trust is not to indicate an image on Docker Hub is an official image. Docker Content Trust is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server1. Docker Content Trust uses digital signatures to ensure that the images are authentic and have not been tampered with2. Official images are a curated set of Docker repositories that are designed to be the best starting point for most users3. They are not necessarily signed by Docker Content Trust, although some of them are. To indicate an image on Docker Hub is an official image, you can look for the blue "official image" badge on the image page. References:
* Content trust in Docker | Docker Docs
* Docker Content Trust: What It Is and How It Secures Container Images
* Official Images on Docker Hub | Docker Docs
* [Docker Hub Quickstart | Docker Docs]

The statement does not describe a node in the context of a swarm mode cluster. A node is a physical or virtual machine running Docker Engine 1.12 or later in swarm mode1. An instance of the Docker CLI connected to the swarm is not a node, but a client that can interact with the swarm through the Docker API2. The Docker CLI can be used to create a swarm, join nodes to a swarm, deploy services to a swarm, and manage swarm behavior3. References: How nodes work), Docker CLI), Swarm mode overview)

= Control Groups (cgroups) are a feature of the Linux kernel that allow you to limit the access processes and containers have to system resources such as CPU, memory, disk I/O, network, and so on1. Control groups allow Docker Engine to share available hardware resources to containers and optionally enforce limits and constraints2. For example, you can use the docker run command to specify the CPU shares, memory limit, or network bandwidth for a container3. By using cgroups, you can ensure that each container gets the resources it needs and prevent resource starvation or overcommitment4. References:
* Lab: Control Groups (cgroups) | dockerlabs
* Runtime metrics | Docker Docs
* Docker run reference | Docker Docs
* Docker resource management via Cgroups and systemd

While removing push access from all other users can prevent an image from being overwritten, it's not the only way and might not be the most efficient or practical solution, especially in a collaborative environment.
Docker Trusted Registry (DTR) provides a feature called 'Immutable Tags' which can be used to prevent an image, such as 'nginx:latest', from being overwritten. Once a tag is marked as immutable, DTR will prevent any user from pushing the same tag to the repository, thus preserving the image. This allows for better version control and prevents accidental overwrites. Therefore, the solution to prevent an image from being overwritten is not just to remove push access from all other users, but to use the features provided by DTR like 'Immutable Tags'.