DCA Docker Certified Associate (DCA) Exam Questions and Answers

= The command docker network create -d overlay --secure  will not ensure that overlay traffic between service tasks is encrypted. The --secure option is not a valid flag for the docker network create command1. To enable encryption for an overlay network, you need to use the --opt encrypted flag instead23. This will create IPSEC tunnels between the nodes where the service tasks are scheduled, using the AESalgorithm in GCM mode2. You can verify if an overlay network is encrypted by checking if the IPSEC tunnels were created using tools like netstat4. References:

1: docker network create | Docker Docs

2: Encrypt traffic on an overlay network | Docker Docs

3: Overlay network driver | Docker Docs

4: Docker: How to verify if an overlay network is encrypted - Stack Overflow

= A Dockerfile does not store persistent data between deployments of a container. A Dockerfile is a text document that contains instructions for building a Docker image. A Docker image is a read-only template that defines the layers and configuration of a container. A Docker container is an isolated and ephemeral instance of a Docker image that runs on the Docker Engine. Docker containers are not meant to store persistent data, as any changes made to the container’s filesystem are lost when the container is removed. To store persistent data between deployments of a container, you need to use volumes or bind mounts. Volumes and bind mounts are ways to attach external storage to a container, so that the data is preserved even if the container is deleted. Volumes are managed by Docker and stored in a location on the host system that is independent of the container’s lifecycle. Bind mounts are files or directories on the host system that are mounted into a container. References:

Persist container data

Dockerfile reference

Docker MySQL Persistence

Persist the DB

Docker - Dockerfile, persist data with VOLUME

 Adding all the resources to the default namespace is not a way to accomplish this, because it would not isolate the resources for each application. Instead, the teams should use namespaces, which are a mechanism to organize resources in a Kubernetes cluster. Namespaces provide a scope for names of resources and a way to attach authorization and policy to a subset of the cluster. By creating a separate namespace for each application, the teams can ensure that their resources are grouped together and not accessible by other teams or applications.

= The command docker logs  will not configure a Docker container to export container logs to the logging solution, such as Splunk. This command only displays the logs of a specific container in the standard output or a file, but does not send them to any external system1. To export container logs to Splunk, you need to use the Docker Logger Drivers, which are plugins that provide logging capabilities for Docker containers2. The Splunk logging driver sends container logs to HTTP Event Collector in Splunk Enterprise and Splunk Cloud3. To use the Splunk logging driver for a specific container, you need to use the command-line flags --log-driver and --log-opt with docker run, and provide the Splunk token and URL as options3. For example:

$ docker run --log-driver=splunk --log-opt splunk-token=VALUE --log-opt splunk-url=VALUE ...

docker logs | Docker Documentation

Logging drivers | Docker Documentation

Splunk logging driver | Docker Documentation

 Namespaces are a Linux kernel feature that isolate containers from each other and from the host system. They limit the access of a container to host resources, such as CPU or memory, by creating a separate namespace for each aspect of a container, such as process IDs, network interfaces, user IDs, etc. This way, a container can only see and use the resources that belong to its own namespace, and not those of other containers or the host12. References:

Isolate containers with a user namespace | Docker Docs

Docker overview | Docker Docs

 = The command kubectl get pods --all-namespaces -label env=development is not valid because it has a syntax error. The correct syntax for listing pods with a specific label is kubectl get pods --all-namespaces --selector label=value or kubectl get pods --all-namespaces -l label=value. The error in the command is:

The option flag for specifying the label selector is --selector or -l, not -label. For example, -label env=development should be --selector env=development or -l env=development.

The correct command for listing all the pods in the cluster that are labeled as env: development is:

kubectl get pods --all-namespaces --selector env=development

This command will display the name, status, restarts, and age of the pods that have the label env: development in all namespaces.

 Labels | Kube by Example : kubectl Cheat Sheet | Kubernetes

Docker uses cgroups, a Linux kernel feature, to limit the resources a container can use.This includes CPU and memory resources12.For instance, Docker can limit a container’s CPU usage to the equivalent of a single CPU core on the Docker host system2.Similarly, Docker can limit a container’s memory usage1.However, to use these features, the Docker host must have cgroup memory and swap accounting enabled1.Therefore, cgroups can indeed limit a Docker container’s access to host resources such as CPU and memory12.

= The conditions are sufficient for Kubernetes to dynamically provision a persistentVolume, because a storageClass defines the provisioner and parameters for creating a volume on-demand. A persistentVolumeClaim that specifies a storageClass triggers the dynamic provisioning process, and Kubernetes will automatically create and bind a persistentVolume that matches the request. This eliminates the need for manual intervention by cluster administrators to provision storage volumes. References:

Dynamic Volume Provisioning | Kubernetes

Persistent volumes and dynamic provisioning | Google Kubernetes Engine …

Dynamic Provisioning and Storage Classes in Kubernetes

The networking drivers that allow you to enable multi-host network connectivity between containers are bridge, macvlan, ipvlan, and overlay. These drivers create networks that can span multiple Docker hosts, and therefore enable containers on different hosts to communicate with each other. The other drivers, such as host, user-defined, and none, create networks that are either isolated or limited to a single host. Here is a brief overview of each driver and how it supports multi-host networking:

•bridge: The bridge driver creates a network that connects containers on the same host using a Linux bridge. However, it can also be used to create a network that connects containers across multiple hosts using an external key-value store, such as Consul, Etcd, or ZooKeeper. This feature is deprecated and not recommended, as it requires manual configuration and has some limitations. The preferred driver for multi-host networking is overlay1.

•macvlan: The macvlan driver creates a network that assigns a MAC address to each container, making it appear as a physical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The macvlan driver can also use 802.1q trunking to create sub-interfaces and isolate traffic between different networks2.

•ipvlan: The ipvlan driver creates a network that assigns an IP address to each container, making it appear as a logical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The ipvlan driver can also use different modes, such as l2, l3, or l3s, to control the routing and isolation of traffic between different networks3.

•overlay: The overlay driver creates a network that connects multiple Docker daemons together using VXLAN tunnels. This allows the containers to communicate across different hosts, even if they are on different networks. The overlay driver also supports encryption, load balancing, and servicediscovery. The overlay driver is the default and recommended driver for multi-host networking, especially for Swarm services4.

 The command kubectl gel pods --all-namespaces -l 'env in (development)' does not display all the pods in the cluster that are labeled as env: development. The command has two typos that prevent it from working correctly. First, the verb should be get instead of gel. Second, the label selector flag should be -l instead of -I1. The correct command should be kubectl get pods --all-namespaces -l 'env in (development)', which will list all the pods across all namespaces that have a label env with a value development2. References:

kubectl Cheat Sheet | Kubernetes

Labels and Selectors | Kubernetes

= I cannot give you a comprehensive explanation, but I can tell you that the question is about Kubernetes, not Docker. Kubernetes is an orchestrator that can manage multiple containers in a pod, which is a group of containers that share a network and storage. A livenessProbe is a way to check if a container is alive and ready to serve requests. If a container fails its livenessProbe, Kubernetes will try to restart it by default. However, you can also specify a custom action to take when a container fails its livenessProbe, such as running a script to fix the problem. This is what the solution is referring to. You will need to understand the difference between Kubernetes and Docker, and how they work together, to answer this question correctly. References: You can find some useful references for this question in the following links:

Kubernetes Pods

Configure Liveness, Readiness and Startup Probes

Docker and Kubernetes

= Keeping a backup copy of the image on another repository is not how a user can prevent an image, such as ‘nginx:latest’, from being overwritten by another user with push access to the repository. This approach does not prevent the original image from being overwritten, it only provides a way to restore it from another source. However, this may not be reliable or efficient, as the backup repository may not be in sync with the original one, or may not be accessible at all times. To prevent an image from being overwritten by another user, the user can use the DTR web UI to make the tag immutable1. This feature allows the user to lock a specific tag, so that no one can push a new image with the same tag to the repository. This ensures that the image is always consistent and secure1. References:

Make a tag immutable | Docker Docs

They provide granular control over where pods (or in this case, containers) are scheduled, based on the labels of the nodes1.In the context of Docker Swarm, this means that you could use node affinities to ensure that development and production containers are scheduled on separate nodes, thus meeting the company’s security policy requirements12345.

= The command kubectl events deployment api is not a valid kubectl command. The correct command to display the events for a deployment object is kubectl get events --field-selector involvedObject.name=api12. This command uses a field selector to filter the events by the name of the involved object, which is the deployment called api. Alternatively, you can use kubectl describe deployment api to see the details and the events for the deployment3. References:

1: kubectl Cheat Sheet | Kubernetes

2: kubernetes - kubectl get events only for a pod - Stack Overflow

3: Kubectl: Get Events & Sort By Time - ShellHacks

The statement is not entirely correct.In Kubernetes, a service of typeClusterIProutes traffic sent to its IP address to the pods selected by its label selector1.However, the port to which the traffic is routed in the pod is determined by thetargetPortspecified in the service definition1.IftargetPortis not specified, it defaults to being the same as theportfield1. In the providedYAML snippet, there is notargetPortspecified for port 80, so we cannot confirm that the traffic will be routed to port 8080 in the pod.Therefore, without additional information about the pod configuration, we cannot verify the provided solution statement1.

n: = Using the DTR web UI to make all tags in the repository immutable is not a good way to prevent an image, such as ‘nginx:latest’, from being overwritten by another user with push access to the repository. This is because making all tags immutable would prevent any updates to the images in the repository, which may not be desirable for some use cases. For example, if a user wants to push a new version of ‘nginx:latest’ with a security patch, they would not be able to do so if the tag is immutable. A better way to prevent an image from being overwritten by another user is to use the DTR web UI to create a promotion policy that restricts who can push to a specific tag or repository1. Alternatively, the user can also use the DTR API to create a webhook that triggers a custom action when an image is pushed to a repository2. References:

Prevent tags from being overwritten | Docker Docs

Create webhooks | Docker Docs

The statement is incorrect about the health check definition based on the Docker Compose file provided. According to the Docker documentation, a health check can be specified in a Dockerfile or a Docker Compose file to tell Docker how to test a container to check that it is still working. This can be done with options such asinterval,timeout, andretries. In this case, the health checks are not set to test five seconds apart but rather ten seconds apart (interval: 10s).Theretries: 3indicates that if the health check fails, Docker will try three times before considering the container unhealthy1.

A DTR security scan will not detect image configuration poor practices, such as exposed ports or inclusion of compilers in production images. A DTR security scan is designed to discover vulnerabilities in the images based on the MITRE CVE or NIST NVD databases1. It does not check the image configuration or best practices. To check the image configuration and best practices, you can use other tools, such as Dockerfile Linter) or Docker Bench for Security). References: Vulnerability scanning must be enabled for all repositories in the Docker Trusted Registry (DTR) component of Docker Enterprise), Dockerfile Linter), Docker Bench for Security)

While creating a Dockerfile for each environment is a possible solution, it is not the most efficient or scalable way to provision configuration to containers at runtime. Docker provides several mechanisms to inject configuration into containers at runtime, such as environment variables, command line arguments, Docker secrets for sensitive data, or even configuration files mounted as volumes. These methods allow the same Docker image to be used across multipleenvironments, promoting immutability and consistency across your deployments. Creating a separate Dockerfile for each environment would mean maintaining multiple versions of the Dockerfile, which could lead to inconsistencies and is generally not a recommended practice.

= The command ‘docker service create -name dns-cache -p 53:53/udp dns-cache’ is not correct and will not create a swarm service that only listens on port 53 using the UDP protocol. There are two errors in the command:

The option -name should be --name with two dashes, otherwise it will be interpreted as a short option -n followed by an argument ame1.

The option -p or --publish will publish the service port to the host port, which means the service will be reachable from outside the swarm2. To create a service that only listens on the internal network, you need to use the --publish-add option with the mode=ingress flag3.

The correct command should be:

docker service create --name dns-cache --publish-add mode=ingress,target=53,published=53,protocol=udp dns-cache

docker service create | Docker Docs

Publish ports on the host | Docker Docs

Publish a port for a service | Docker Docs

 Capabilities are a Linux kernel feature that allows processes to perform some privileged operations without having the full power of the root user1. Docker uses capabilities to limit the access of containers to host resources, such as CPU or memory2. By default, Docker drops all capabilities except those needed for the container to function properly, using a whitelist approach3. This reduces the risk of a container compromising the host system or other containers. You can also add or remove capabilities to or from a container at runtime, using the --cap-add or --cap-drop options of the docker run command4. This gives you more control over the security and functionality of your containers. References:

Capabilities | dockerlabs

Docker run reference | Docker Docs

Docker Capabilities and no-new-privileges

Runtime privilege and Linux capabilities | Docker Docs

 Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints are a way to specify which nodes a service can run on based on the labels assigned to the nodes. Labels are key-value pairs that can be attached to any node in the swarm. For example, you can label nodes as development or production depending on their intended use. Then, you can use the --constraint option when creating or updating a service to filter the nodes based on their labels. For example, to run a service only on development nodes, you can use:

docker service create --constraint'node.labels.environment == development'...

To run a service only on production nodes, you can use:

docker service create --constraint'node.labels.environment == production'...

This way, you can ensure that development and production containers run on separate nodes in the swarm, as required by the security policy. References:

Using placement constraints with Docker Swarm

Multiple label placement constraints in docker swarm

Machine constraints in Docker swarm

How can set service constraint to multiple value

= The command ‘docker swarm nodes’ is not a valid command to list all nodes in a swarm cluster from the command line. The correct command is docker node ls, which can be run on a manager node to view the details of all the nodes in the swarm1.The docker swarm command is used to manage the swarm itself, not the nodes. For example, you can use docker swarm init to create a new swarm, or docker swarm join to add a node to an existing swarm2. References:

Manage nodes in a swarm | Docker Docs

docker swarm | Docker Docs

 Namespaces in Kubernetes are a way to create and organize virtual clusters within physical clusters where we can isolate a group of resources within a single cluster1. Namespace helps to organize resources such as pods, services, and volumes within the cluster2. By creating one namespace for each application and adding all the resources to it, the development teams can ensure that Kubernetes-specific resources, such as secrets, are grouped together for each application. This also provides a scope for names, a mechanism to attach authorization and policy, and a way to divide cluster resources between multiple users3. References:

Namespaces | Kubernetes

Kubernetes - Namespaces - GeeksforGeeks

Namespaces Walkthrough | Kubernetes

 The purpose of Docker Content Trust is not to indicate an image on Docker Hub is an official image. Docker Content Trust is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server1. Docker Content Trust uses digital signatures to ensure that the imagesare authentic and have not been tampered with2. Official images are a curated set of Docker repositories that are designed to be the best starting point for most users3. They are not necessarily signed by Docker Content Trust, although some of them are. To indicate an image on Docker Hub is an official image, you can look for the blue "official image" badge on the image page. References:

Content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

Official Images on Docker Hub | Docker Docs

[Docker Hub Quickstart | Docker Docs]

The provided Kubernetes NetworkPolicy YAML configuration indicates that the policy applies to pods with the label tier: backend in the default namespace1.The ingress rule allows traffic from pods with the label tier: api1.Therefore, a request issued from a pod bearing only the tier:frontend label to a pod bearing the tier: backend label will be blocked by this networkPolicy1.This is because the networkPolicy does not have a rule allowing ingress from pods with the tier: frontend label1. For more information on Kubernetes NetworkPolicies, you can refer to theKubernetes Documentation on Network Policies.

The command docker system events --filter splunk will not configure a Docker container to export container logs to the logging solution. The command docker system events will display real-time events from the Docker daemon, such as container creation, start, stop, etc. The --filter option will filter the events by various criteria, such as type, label, name, etc. However, there is no filter for splunk, and even if there was, it would only show the events related to Splunk, not the container logs. To configure a Docker container to export container logs to Splunk, you need to use the Splunk loggingdriver, which is a plugin that sends container logs to HTTP Event Collector in Splunk Enterprise and Splunk Cloud. You can use the --log-driver and --log-opt options when creating or running a container to specify the Splunk logging driver and its options, such as the Splunk token, URL, source, sourcetype, index, etc. Alternatively, you can configure the Splunk logging driver as the default logging driver for the Docker daemon by setting the log-driver and log-opts keys in the daemon.json file and restarting Docker. References:

docker system events

Splunk logging driver

How to send Docker containers logs to Splunk?

= The command docker inspect nodes will not list all nodes in a swarm cluster from the command line. This command is invalid, as docker inspect requires one or more object names or IDs as arguments1. To list all nodes in a swarm cluster, you need to use the docker node ls command from a manager node2. This command will display the ID, hostname, status, availability, manager status, and engine version of each node in the swarm2. You can also use the -f or --filter flag to filter the nodes by various criteria, such as role, label, or name2. References:

1: docker inspect | Docker Docs

2: docker node ls | Docker Docs

Docker Swarm requires more than one manager node to achieve fault tolerance12.A single manager node is not fault tolerant because if it goes down, the entire cluster goes down3.For a swarm to be fault-tolerant, it needs to have an odd number of manager nodes2.For example, a three-manager swarm tolerates a maximum loss of one manager2.Therefore, a configuration with one manager node for two worker nodes will not achieve fault tolerance for managers in a swarm12.

 Network is a type of Linux kernel namespace that provides container isolation. Network namespaces isolate the system resources associated with networking, such as network interfaces, IP addresses, routing tables, firewall rules, etc. Each network namespace has its own virtual network stack, and processes in different network namespaces can communicate through virtual network devices or tunnels1. Network namespaces are used by Docker to create isolated networks for containers, and allow users to customize the network configuration and connectivity of each container2. References:

network_namespaces(7) - Linux manual page

Docker network overview | Docker Documentation

 Better caching when building Docker images is an advantage of multi-stage builds. Multi-stage builds allow you to use multiple FROM statements in your Dockerfile, each starting a new stage of the build1. This can help you improve the caching efficiency of your Docker images, as each stage can use its own cache layer2. For example, if you have a stage that installs dependencies and another stage that compiles your code, you can reuse the cached layer of the dependencies stage if they don’t change, and only rebuild the code stage if it changes2. This can save you time and bandwidth when building and pushing your images. References:

Multi-stage builds | Docker Docs

What Are Multi-Stage Docker Builds? - How-To Geek

= Mounting the configuration file directly into the appropriate pod and container using the .spec.containers.configMounts key is not a valid way to provide a configuration file to a container at runtime. The .spec.containers.configMounts key does not exist in the Kubernetes API1. The correct way to provide a configuration file to a container at runtime is to use a ConfigMap2. A ConfigMap is a Kubernetes object that stores configuration data as key-value pairs. You can create a ConfigMap from a file, and then mount the ConfigMap as a volume into the pod and container. The configuration file will be available as a file in the specified mount path3. Alternatively, you can also use environment variables to pass configuration data to a container from a ConfigMap4. References:

PodSpec v1 core

Configure a Pod to Use a ConfigMap

Populate a Volume with data stored in a ConfigMap

Define Container Environment Variables Using ConfigMap Data

 = The configuration will not achieve fault tolerance for managers in a swarm, because it does not have enough managers to form a quorum. A quorum is the minimum number of managers that must be available to agree on values and maintain the consistent state of the swarm. The quorum is calculated as (N/2)+1, where N is the number of managers in the swarm. For example, a swarm with 3 managers has a quorum of 2, and a swarm with 5 managers has a quorum of 3. Having only two managers, one active and one passive, means that the quorum is also 2. Therefore, if one manager fails or becomes unavailable, the swarm will lose the quorum and will not be able to process any requests or schedule any tasks. To achieve fault tolerance, a swarm should have an odd number of managers, at least 3, and no more than 7. This way, the swarm can tolerate the loss of up to (N-1)/2 managers and still maintain the quorum and the cluster state. References:

Administer and maintain a swarm of Docker Engines

Raft consensus in swarm mode

How nodes work

= Seccomp is a Linux kernel feature that allows you to restrict the actions available within the container. By using a seccomp profile, you can limit the system calls that a container can make, thus enhancing its security and isolation. Docker has a default seccomp profile that blocks some potentially dangerous system calls, such as mount, reboot, or ptrace. You can also pass a custom seccomp profile for a container using the --security-opt option. Seccomp can limit a container’s access to host resources, such as CPU or memory, by blocking or filtering system calls that affect those resources, such as setpriority, sched_setaffinity, or mlock. References:

Seccomp security profiles for Docker

Hardening Docker Container Using Seccomp Security Profile

= Storage is not a type of Linux kernel namespace that provides container isolation. Linux namespaces are a feature of the Linux kernel that partitions kernel resources such that one set of processes sees one set of resources while another set of processes sees a different set of resources1. The feature works by having the same namespace for a set of resources and processes, but those namespaces refer to distinct resources. Since kernel version 5.6, there are 8 kinds of namespaces: mount, UTS, IPC, PID, network, user, cgroup, and time2. Each kind of namespace isolates a different aspect of the system, such as file system mounts, host and domain names, inter-process communication, process IDs, network interfaces, user and group IDs, cgroups, and system time2. Storage is not one of them. References:

1: Linux namespaces - Wikipedia

2: Namespaces — The Linux Kernel documentation

 The command docker service create -name dns-cache -p 53:53 -service udp dns-cache is not valid because it has some syntax errors. The correct syntax for creating a swarm service is docker service create [OPTIONS] IMAGE [COMMAND] [ARG...]. The errors in the command are:

There should be a space between the option flag and the option value. For example, -name dns-cache should be -name dns-cache.

The option flag for specifying the service mode is -mode, not -service. For example, -service udp should be -mode udp.

The option flag for specifying the port mapping is --publish or -p, not -p. For example, -p 53:53 should be --publish 53:53.

The correct command for creating a swarm service that only listens on port 53 using the UDP protocol is:

docker service create --name dns-cache --publish 53:53/udp dns-cache

This command will create a service called dns-cache that uses the dns-cache image and exposes port 53 on both the host and the container using the UDP protocol.

[docker service create | Docker Documentation] : [Publish ports for services | Docker Documentation]

Process ID is a type of Linux kernel namespace that provides container isolation. Linux namespaces are a feature of the Linux kernel that isolate and virtualize system resources of a collection of processes1. Process ID namespace isolates the process ID number space, meaning that processes in different PID namespaces can have the same PID2. This allows each container to have its own init process with PID 1, which is the ancestor of all other processes in the container3. Process ID namespace also affects other identifiers, such as thread IDs, parent process IDs, and session IDs4. References: Namespaces in operation), pid_namespaces), What is a PID namespace?, Linux Namespaces: PID)

= The pid namespace is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. The pid namespace is one of the six namespaces that are enabled by default when you run a container with Docker1. The pid namespace isolates the process ID number space, meaning that processes in different pid namespaces can have the same PID2. This allows containers to have their own init process with PID 1 and to limit the visibility and interaction of processes between containers and the host3. To disable the pid namespace, you need to use the --pid option with the docker run command and specify the host or another container as the pid mode. References:

Docker run reference | Docker Docs

pid_namespaces(7) - Linux manual page - man7.org

Building containers by hand: The PID namespace - Enable Sysadmin

[Share host and container processes with --pid | Docker Docs]

 In the context of a swarm mode cluster, an instance of the Docker engine participating in the swarm is indeed a node1. A node can be either a manager or a worker, depending on the role assigned by the swarm manager2. A manager node handles the orchestration and management of the swarm, while a worker node executes the tasks assigned by the manager2. A node can join or leave a swarm at any time, and the swarm manager will reconcile the desired state of the cluster accordingly1. References:

1: Swarm mode overview | Docker Docs

2: Manage nodes in a swarm | Docker Docs

Creating a Dockerfile for each environment, specifying ports and Docker secrets for certificates is not a way to provision configuration to containers at runtime. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build an image, not to run a container. Once an image is built, the configuration specified in the Dockerfile cannot be changed at runtime. To provision configuration to containers at runtime, you need to use a different mechanism, such as environment variables, command-line arguments, or config maps234. References:

Dockerfile reference | Docker Docs

Environment variables in Compose | Docker Docs

Override the default command | Docker Docs

Configuration management with Containers | Kubernetes

= This is not a way to configure the Docker engine to use a registry without a trusted TLS certificate. There is no such option as IGNORE_TLS in the daemon.json configuration file. The daemon.json file is used to configure various aspects of the Docker engine, such as logging, storage, networking, and security1. To use a registry without a trusted TLS certificate, you need to either add the certificate to the trusted root certificates of the system, or configure the Docker engine to allow insecure registries2. To add the certificate to the trusted root certificates, you need to copy the certificate file to the /etc/docker/certs.d// directory on every Docker host2. To configure the Docker engine to allow insecure registries, you need to add the registry hostname or IP address to the “insecure-registries” array in the daemon.json file3. For example:

{ “insecure-registries” : [“myregistry.example.com:5000”] }

Note that using insecure registries is not recommended, as it exposes you to potential man-in-the-middle attacks and data corruption3. You should always use a registry with a trusted TLS certificate, or use Docker Content Trust to sign and verify your images4. References:

Daemon configuration file | Docker Docs

Verify repository client with certificates | Docker Docs

Test an insecure registry | Docker Docs

Content trust in Docker | Docker Docs

= Multi-stage builds allow you to use multiple FROM statements in your Dockerfile, each starting a new stage of the build1. This can help you achieve better logical separation of Dockerfile instructions for increased readability, as well as other benefits such as smaller image size, faster build time, and reduced security risks23. By separating your Dockerfile into different stages, you can organize your instructions by their purpose, such as building, testing, or deploying your application. You can also copy only the artifacts you need from one stage to another, leaving behind the unnecessary dependencies or tools1. This can make your Dockerfile easier to read and maintain, as well as improve the performance and security of your final image. References:

Multi-stage builds | Docker Docs

What Are Multi-Stage Docker Builds? - How-To Geek

Multi-stage | Docker Docs

The statement is incorrect because it does not mention the service name or the clusterIP address. Traffic sent to the IP of any pod with the label app: nginx on port 8080 will not be forwarded to port 80 in that pod, unless the traffic is coming from another pod within the same cluster that knows the pod IP. To access the service from outside the cluster, the traffic must be sent to the clusterIP address of the service, which is assigned by Kubernetes, and the port 8080 of the service, which is defined in the yaml file. The service will then forward the traffic to one of the selected pods on port 80.

To summarize, the correct statement should be:

Traffic sent to the clusterIP address of the service dca on port 8080 will be forwarded to port 80 in one of the pods with the label app: nginx.

Docker will block the command docker container run myorg/myimage:1.0 if the image tag myorg/myimage:1.0 is unsigned and the environment variable DOCKER_CONTENT_TRUST=1 is set. The reason is that setting DOCKER_CONTENT_TRUST=1 enables Docker Content Trust (DCT), which is a feature that allows users to verify the integrity and publisher of Docker images using digital signatures1. When DCT is enabled, Docker will only pull, run, or build images that have valid signatures. If an image tag is unsigned or has an invalid signature, Docker will reject the operation and display an error message2. Therefore, to run an unsigned image with DCT enabled, you need to either disable DCT by setting DOCKER_CONTENT_TRUST=0 or use the --disable-content-trust flag, or sign the image tag with a valid key3. References:

Content trust in Docker

Determine if Docker image is signed or unsigned

Signing Images and Enabling Docker Content Trust

 Deleting the image and the image repository from Docker Trusted Registry will not completely delete the image from disk. This is because deleting a repository or a tag only removes the reference to the image, but not the image itself. The image is still stored as a blob on the disk, and can be accessed by its digest1. To completely delete the image from disk, you need to enable the deletion feature in the registry configuration, and then use the API to delete the image by its manifest2. Alternatively, you can manually delete the image files from the registry storage directory, but this is not recommended3. After deleting the image, you also need to run the garbage collector to reclaim the disk space4. References:

Docker Registry HTTP API V2

How to delete images from a private docker registry?

Remove docker image in registry by removing files/folders on server

Garbage collection

Using either EXPOSE or -publish to access the container on the bridge network will not accomplish the goal of creating a container that is reachable from its host’s network. EXPOSE is a way of documenting which ports a container listens on, but it does not open any ports to the host1. -publish (or -p) is a way of mapping a host port to a container port, but it does not change the network mode of the container2. By default, Docker containers use the bridge network, which isolates them from the host network3. To create a container that is reachable from its host’s network, you need to usethe --network host option when running the container4. This will make the container share the host’s network stack and have the same IP address as the host4. References:

1: Difference Between “expose” and “publish” in Docker | Baeldung on Ops

2: Deploy services to a swarm | Docker Docs

3: Bridge network | Docker Docs

4: Host network | Docker Docs