= A DTR security scan will detect private keys copied to the image. DTR security scan is a feature of Docker Trusted Registry (DTR) that scans images to detect any security vulnerability1. DTR security scan uses the open source tool SecretScanner2 to find unprotected secrets in container images or file systems. SecretScanner can match the contents of images against a database of approximately 140 secret types, including private keys3. Therefore, if an image contains private keys, DTR security scan will report them as potential secrets and alert the user to remove them from the image. References:
* Scan images for vulnerabilities | Docker Docs
* GitHub - deepfence/SecretScanner: :unlock: Find secrets and passwords ...
* SecretScanner/deepfence_secret_scanner.py at main deepfence/SecretScanner

Explanation
= Provisioning a Docker config object for each environment is a way to provision configuration to containers at runtime. Docker configs allow services to adapt their behaviour without the need to rebuild a Docker image.
Services can only access configs when explicitly granted by a configs attribute within the services top-level element. As with volumes, configs are mounted as files into a service's container's filesystem1. Docker configs are supported on both Linux and Windows services2. References: Docker Documentation, Configs top-level element

Explanation
The action will not upgrade Docker Engine CE to Docker Engine EE. Disabling the Docker service via chkconfig or systemctl will only stop the Docker daemon from running, but it will not change the version or edition of the Docker engine1. To upgrade Docker Engine CE to Docker Engine EE, you need to follow these steps2:
* Download your Docker Enterprise license from the Docker Store).
* Install the docker-ee package from the Docker repository.
* Restart the Docker service and verify the version and edition. References: Start or stop the Docker daemon), How to upgrade Docker 18.09 Community Edition to Docker Enterprise 18.09)