= The command docker inspect nodes will not list all nodes in a swarm cluster from the command line. This command is invalid, as docker inspect requires one or more object names or IDs as arguments1. To list all nodes in a swarm cluster, you need to use the docker node ls command from a manager node2. This command will display the ID, hostname, status, availability, manager status, and engine version of each node in the swarm2. You can also use the -f or --filter flag to filter the nodes by various criteria, such as role, label, or name2. References:
* 1: docker inspect | Docker Docs
* 2: docker node ls | Docker Docs

Explanation
= Manually downloading the 'docker-ee' package will not upgrade Docker Engine CE to Docker Engine EE.
Docker Engine CE and Docker Engine EE are two different products with different installation methods and features. Docker Engine CE is a free and open source containerization platform, while Docker Engine EE is a subscription-based enterprise-grade platform that offers additional features such as security scanning, certified plugins, and support12. To upgrade from Docker Engine CE to Docker Engine EE, you need to uninstall Docker Engine CE and install Docker Engine EE following the official documentation3. References:
* What is the exact difference between Docker EE (Enterprise Edition), Docker CE (Community Edition)
* and Docker (Custom Support) - Stack Overflow
* Difference between Docker Community Edition (CE) vs Docker Enterprise Edition (EE) in 2020
* Install Docker Engine | Docker Docs

Explanation
Resource reservation cannot be used to schedule containers to meet the security policy requirements, because resource reservation only affects the available resources on a node and does not restrict which containers can run on which nodes. According to the official documentation, resource reservation is used to ensure that a service has enough resources to run.
References: https://docs.docker.com/engine/swarm/services/#reserve-memory-or-cpus-for-a-service

The command kubectl drain <node name> is the correct one to run on the node to gracefully terminate all pods on the node, while marking the node as unschedulable. This command will safely evict all the pods from the node before you perform maintenance on the node, such as installing patches or an OS upgrade1. It will respect the PodDisruptionBudgets you have specified, if any, and allow the pod's containers to gracefully terminate1. It will also mark the node as unschedulable, so that no new pods can be scheduled on the node until it is ready1.
The other commands are not correct because:
*docker swarm leave will make the node leave the swarm cluster, but it will not affect the Kubernetes workloads on the node2.
*docker node update -availability drain <node name> will change the availability of the node to drain, which means that no new tasks can be assigned to the node, but it will not terminate the existing pods on the node3.
*kubectl cordon <node name> will mark the node as unschedulable, but it will not evict the pods on the node4.
References:
*Safely Drain a Node | Kubernetes
*[docker swarm leave | Docker Docs]
*[docker node update | Docker Docs]
*[kubectl cordon | Kubernetes Docs]