Free Practice Questions for Docker DCA Exam

A Kubernetes node is allocated a /26 CIDR block (64 unique IPs) for its address space. This means that the node can assign up to 64 IP addresses to its resources, such as pods and containers. If every pod on this node has exactly two containers in it, then each pod will need two IP addresses, one for each container. Therefore, the node can support up to 32 pods, since 64 / 2 = 32. The other options are incorrect because they either exceed the available IP addresses or do not account for the number of containers per pod. References:

•CIDR Blocks and Container Engine for Kubernetes - Oracle

•How kubernetes assigns podCIDR for nodes? - Stack Overflow

= The strategy of creating a PersistentVolume with hostPath and a PersistentVolumeClaim to mount the /data directory on your laptop into a container will not work, because hostPath volumes are only suitable for single node testing or development. They are not portable across nodes and do not support dynamic provisioning. If you want to mount a local directory from your laptop into a Kubernetes pod, you need to use a different type of volume, such as NFS, hostPath CSI, or minikube. Alternatively, you can copy the files from your laptop to the container using kubectl cp command. References:

Volumes | Kubernetes

Configure a Pod to Use a PersistentVolume for Storage | Kubernetes

Mount a local directory to kubernetes pod - Stack Overflow

Kubernetes share a directory from your local system to kubernetes container - Stack Overflow

How to Mount a Host Directory Into a Docker Container

= Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server12. DCT does not enable mutual TLS between the Docker client and server, which is a different security mechanism that ensures encrypted and authenticated communication between the client and the server3. DCT is based on digital signatures and The Update Framework (TUF) to provide trust over arbitrary collections of data1. References:

Content trust in Docker | Docker Docs

Docker Content Trust: What It Is and How It Secures Container Images

Protect the Docker daemon socket | Docker Docs

The answer depends on whether you want to access the container from the host’s network or from other containers on the same network. EXPOSE and --publish have different effects on the container’s port visibility. References: Docker run reference, Dockerfile reference, Docker networking overview

Label constraints can be used to schedule containers to meet the security policy requirements. Label constraints allow you to specify which nodes a service can run on based on the labels assigned to the nodes1. For example, you can label the nodes that are intended for development with env=dev and the nodes that are intended for production with env=prod. Then, you can use the --constraint flag when creating a service to restrict it to run only on nodes with a certain label value. For example, docker service create --name dev-app --constraint 'node.labels.env == dev' ... will create a service that runs only on development nodes2. Similarly, docker service create --name prod-app --constraint 'node.labels.env == prod' ... will create a service that runsonly on production nodes3. This way, you can ensure that development and production containers are running on separate nodes in a given Swarm cluster. References:

Add labels to swarm nodes

Using placement constraints with Docker Swarm

Multiple label placement constraints in docker swarm

= A Dockerfile does not store persistent data between deployments of a container. A Dockerfile is a text document that contains instructions for building a Docker image. A Docker image is a read-only template that defines the layers and configuration of a container. A Docker container is an isolated and ephemeral instance of a Docker image that runs on the Docker Engine. Docker containers are not meant to store persistent data, as any changes made to the container’s filesystem are lost when the container is removed. To store persistent data between deployments of a container, you need to use volumes or bind mounts. Volumes and bind mounts are ways to attach external storage to a container, so that the data is preserved even if the container is deleted. Volumes are managed by Docker and stored in a location on the host system that is independent of the container’s lifecycle. Bind mounts are files or directories on the host system that are mounted into a container. References:

Persist container data

Dockerfile reference

Docker MySQL Persistence

Persist the DB

Docker - Dockerfile, persist data with VOLUME

 The set of commands docker port inspect and docker container inspect will not identify the published port(s) for a container. The reason is that there is no such command as docker port inspect. The correct command to inspect the port mappings of a container is docker port1. The command docker container inspect can also show the port mappings of a container, but it will display a lot of other information as well, so it isnot as concise as docker port2. To identify the published port(s) for a container, you can use either of these commands:

docker port CONTAINER will list all the port mappings of the container1.

docker port CONTAINER PRIVATE_PORT will list only the port mapping of the specified private port of the container1.

docker container inspect --format=' { {.NetworkSettings.Ports}}' CONTAINER will list only the port mappings of the container in a JSON format23.

For example, if you have a container named web that publishes port 80 to port 8080 on the host, you can use any of these commands to identify the published port:

$ docker port web

80/tcp -> 0.0.0.0:8080

$ docker port web 80

0.0.0.0:8080

$ docker container inspect --format=' { {.NetworkSettings.Ports}}'web

map[80/tcp:[map[HostIp:0.0.0.0 HostPort:8080]]]

docker port

docker container inspect

How can I grab exposed port from inspecting docker container?

= The command docker inspect nodes will not list all nodes in a swarm cluster from the command line. This command is invalid, as docker inspect requires one or more object names or IDs as arguments1. To list all nodes in a swarm cluster, you need to use the docker node ls command from a manager node2. This command will display the ID, hostname, status, availability, manager status, and engine version of each node in the swarm2. You can also use the -f or --filter flag to filter the nodes by various criteria, such as role, label, or name2. References:

1: docker inspect | Docker Docs

2: docker node ls | Docker Docs

Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notaryserver1. DCT is enabled by setting the environment variable DOCKER_CONTENT_TRUST=1 on the Docker client. When DCT is enabled, the Docker client will only pull, run, or build images that have valid signatures for a specific tag2. However, DCT does not apply to the docker image import command, which allows users to import an image or a tarball with a repository and tag from a file or STDIN3. Therefore, if myorg/myimage:1.0 is unsigned, Docker will not block the docker image import myorg/myimage:1.0 command, even if DCT is enabled. This is because the docker image import command does not interact with a registry or a Notary server, and thus does not perform any signature verification. However, this also means that the imported image will not have any trust data associated with it, and it will not be possible to push it to a registry with DCT enabled, unless it is signed with a valid key. References:

Content trust in Docker

Automation with content trust

[docker image import]

[Content trust and image tags]