Beginners' guide to managing the dock?

That kind of depends. If you're only planning on adding stock OS X apps to the Dock, then a Configuration Profile can do it.
If you need to add a bunch of 3rd party/custom apps to it, it gets trickier. You might want to do some searches on dockutil here on the forum. It should pull up a lot of threads on using it. I think there's also a new online tool for creating dock configurations that was posted, but I have not used it.

As for making sure they can't change the Dock, a Config Profile should allow you to set the Dock as "immutable" if I'm not mistaken.

Pertinent to your interests... ;)

http://errorfreeit.com.au/blog/2015/4/28/dock-master

@hkabik nice one. I had misplaced that.

Yeah me too. That was the tool I was referring to, but I couldn't find the link to it.

Dock Master if you want them to be unchangable
Dock Util if you want to allow users to alter them afterwards

It is worth noting (As I found out after tearing my hair out for an hour yesterday) that if you deploy the dock master profile with composer, but still have a dock configuration file in Casper for the size etc, only one will apply at a time, so you either get the size/settings, or the items. Makes sense really... just frustrating at 4pm in the afternoon and it isn't working :-)

dock util is a pretty big go-to option. But it's not perfect, and that's not the developer's fault. Apple unintentionally makes it complicated.

On 10.9 and later you'll be fighting cached plist files. In manual testing of dockutil you might want to add...

killall cfprefsd

...at the end of the dockutil script. That will kill the plist cache server and make your changes show up (they've been made, but not populated to the cached plist file which the OS is using.

The method I've used for deploying a custom dock at imaging is to use an empty test file. For me it's /Library/Preferences/.testfile so it's invisible. But you could put it anywhere and call it anything.

Then my dockutil script starts by checking if the file exists. If it does then the rest of the script is executed, and the last thing it does is delete the test file so the script just exits the next time it's called.

Lastly the script is kicked off at logout. So when I image a machine and log in, I get the default dock. but when I log out and back in I get the updated dock. I'm doing this because running it at Login didn't seem to work right, and doing it on enrollment, etc just didn't work for us.

Hi cwaldrip
I've been trying to use the logout option with a DockUtil script and i've added the 'killall' to the end but i still don't get an updated Dock.

My script works on login but i think the flash of the screen as the dock updates is ugly. I can't see a way just to get it to run once for each user (many people use many machines here) so that's how i ended up here looking at the logout option as this would negate the worry of the screen flash.

Out of interest can you elaborate the use of this file as i can't get my head around what it's doing?
/Library/Preferences/.testfile

Thanks very much

During imaging I have a script run that simply creates an empty file...

touch /Library/Preferences/.testfile

There's nothing in the file. I then have a log out script that runs on logout. The first thing it does is check if that file exists. If it does, then it runs the several lines of dockutil I have. Then it copies the dock to the default user account. Lastly it deletes that empty, invisible, file. The next time the script runs it checks for that empty, invisible, file. If it's not there, then the script quits.

Some people so similar things, and I may end up changing things as this was my first attempt. I know people end up creating a plist file in the receipts folder to show that whatever their job is has been run. I like the absence of things more than one additional thing - but you could create an extension that checks for the presence of your test file to show that the job has been done.

Here's the gist of my script...

#!/bin/bash

if [ -e "/Library/Preferences/.docktest-prod" ]; then

    file=/Applications/Final Cut Pro.app

    /usr/local/bin/dockutil --add /Applications/Adobe Premiere Pro CC 2014/Adobe Premiere Pro CC 2014.app --after 'Safari' --allhomes --no-restart
#Removed a lot of similar lines

    if [ -e "$file" ]; then
        /usr/local/bin/dockutil --add /Applications/Final Cut Pro.app --after 'Safari' --allhomes --no-restart
    fi

#Removed some more lines

    user=`stat -f%Su /dev/console`
    cp /Users/$user/Library/Preferences/com.apple.dock.plist /System/Library/User Template/English.lproj/Library/Preferences/

    killall cfprefsd
    killall Dock

    rm /Library/Preferences/.docktest-prod
    exit 0

    else
    exit 0
fi