Using either EXPOSE or -publish to access the container on the bridge network will not accomplish

the goal of creating a container that is reachable from its host’s network. EXPOSE is a way of

documenting which ports a container listens on, but it does not open any ports to the host1. -publish

(or -p) is a way of mapping a host port to a container port, but it does not change the network mode

of the container2. By default, Docker containers use the bridge network, which isolates them from

the host network3. To create a container that is reachable from its host’s network, you need to

usethe --network host option when running the container4. This will make the container share the

host’s network stack and have the same IP address as the host4. Reference:

1: Difference Between “expose” and “publish” in Docker | Baeldung on Ops

2: Deploy services to a swarm | Docker Docs

3: Bridge network | Docker Docs

4: Host network | Docker Docs

= The command kubectl logs deployment api does not display the events table for the deployment

object, but rather the logs of the pods that belong to the deployment. To see the events table, you

need to use the command kubectl describe deployment api, which shows the details of the

deployment, including the events1. Reference: Kubernetes Documentation, Practice Questions for

Docker Certified Associate (DCA) Exam

= This is not a way to configure the Docker engine to use a registry without a trusted TLS certificate.

There is no such option as IGNORE_TLS in the daemon.json configuration file. The daemon.json file is

used to configure various aspects of the Docker engine, such as logging, storage, networking, and

security1. To use a registry without a trusted TLS certificate, you need to either add the certificate to

the trusted root certificates of the system, or configure the Docker engine to allow insecure

registries2. To add the certificate to the trusted root certificates, you need to copy the certificate file

to the /etc/docker/certs.d// directory on every Docker host2. To configure the

Docker engine to allow insecure registries, you need to add the registry hostname or IP address to

the “insecure-registries” array in the daemon.json file3. For example:

{ “insecure-registries” : [“myregistry.example.com:5000”] }

Note that using insecure registries is not recommended, as it exposes you to potential man-in-the-

middle attacks and data corruption3. You should always use a registry with a trusted TLS certificate,

or use Docker Content Trust to sign and verify your images4. Reference:

Daemon configuration file | Docker Docs

Verify repository client with certificates | Docker Docs

Test an insecure registry | Docker Docs

Content trust in Docker | Docker Docs

= The ‘docker inspect’ command returns low-level information on Docker objects, such as containers,

images, networks, etc1 It does not show the list of historical tasks for a service. To view the list of

tasks for a service, you need to use the ‘docker service ps’ command 2. For example, to see the tasks

for the ‘http’ service, you would run ‘docker service ps http’. This would show the ID, name, image,

node, desired state, current state, and error of each task 2. Reference: Docker inspect | Docker

Docs, Docker service ps | Docker Docs

Multi-stage builds are a feature of Docker that allows you to use multiple FROM statements in your

Dockerfile. Each FROM statement creates a new stage of the build, which can use a different base

image and run different commands. You can then copy artifacts from one stage to another, leaving

behind everything you don’t want in the final image. This optimizes the image size and reduces the

attack surface by removing unnecessary dependencies and tools. For example, you can use a stage to

compile your code, and then copy only the executable file to the final stage, which can use a minimal

base image like scratch. This way, you don’t need to include the compiler or the source code in the

final image. Reference:

Multi-stage builds | Docker Docs

What Are Multi-Stage Docker Builds? - How-To Geek

Multi-stage | Docker Docs

The command docker run -v /data:/mydata -mode readonly ubuntu will not mount the

host’s /data1 directory to the ubuntu container in read-only mode. The commandhas several errors

that prevent it from working correctly. First, the host directory should be /data1 instead of /data, as

specified in the question. Second, the option flag should be --mode instead of -mode, and it should

be placed before the image name. Third, the mode value should be ro instead of readonly, as per the

Docker documentation1. The correct command should be docker run -v /data1:/mydata --mode ro

ubuntu, which will mount the host’s /data1 directory as a read-only volume at /mydata inside the

container1. Reference:

docker run | Docker Docs

= The role of Control Groups (cgroups) when used with a Docker container is not role-based access

control to clustered resources. Cgroups are a feature of the Linux kernelthat allow you to limit,

manage, and isolate resource usage of collections of processes running on a system1. Resources are

CPU time, system memory, network bandwidth, or combinations of these resources, and so

on2. Cgroups allow Docker Engine to share available hardware resources to containers and optionally

enforce limits and constraints3. Cgroups can help avoid “noisy neighbor” issues and improve the

performance and security of containers4. Role-based access control (RBAC) is a different concept that

refers to controlling access to resources based on the roles of individual users within an

organization5.

: : Lab: Control Groups (cgroups) | dockerlabs : Container security fundamentals part 4: Cgroups |

Datadog Security Labs : Docker Namespace Vs Cgroup. Namespace and Cgroup | by MrDevSecOps -

Medium : Role-based access control - Wikipedia : Control groups (cgroups) - Learn Docker -

Fundamentals of Docker 18.x …

= This strategy will not successfully accomplish this. A PersistentVolumeClaim (PVC) is a request for

storage by a user that is automatically bound to a suitable PersistentVolume (PV) by Kubernetes1. A

PV is a piece of storage in the cluster that has been provisioned by an administrator or dynamically

provisioned using StorageClasses1. A hostPath is a type of volume that mounts a file or directory

from the host node’s filesystem into a pod2. It is mainly used for development and testing on a

single-node cluster, and not recommended for production use2.

The problem with this strategy is that it assumes that the hostPath /data on the node is the same as

the /data directory on your laptop. This is not necessarily true, as the node may be a different

machine than your laptop, or it may have a different filesystem layout. Also, the hostPath volume is

not portable across nodes, so if your pod is scheduled on a different node, it will not have access to

the same /data directory2. Furthermore,the storageClass parameter is not applicable for hostPath

volumes, as they are not dynamically provisioned3.

To mount the /data directory on your laptop into a container, you need to use a different type of

volume that supports remote access, such as NFS, Ceph, or GlusterFS4. You also need to make sure

that your laptop is accessible from the cluster network and that it has the appropriate permissions to

share the /data directory. Alternatively, you can usea tool like Skaffold or Telepresence to sync your

local files with your cluster56. Reference:

Persistent Volumes | Kubernetes

Volumes | Kubernetes

Storage Classes | Kubernetes

Kubernetes Storage Options | Kubernetes Academy

Skaffold | Easy and Repeatable Kubernetes Development

Telepresence: fast, local development for Kubernetes and OpenShift microservices

The statement is incorrect because it does not mention the service name or the clusterIP address.

Traffic sent to the IP of any pod with the label app: nginx on port 8080 will not be forwarded to port

80 in that pod, unless the traffic is coming from another pod within the same cluster that knows the

pod IP. To access the service from outside the cluster, the traffic must be sent to the clusterIP address

of the service, which is assigned by Kubernetes, and the port 8080 of the service, which is defined in

the yaml file. The service will then forward the traffic to one of the selected pods on port 80.

To summarize, the correct statement should be:

Traffic sent to the clusterIP address of the service dca on port 8080 will be forwarded to port 80 in

one of the pods with the label app: nginx.

= The command ‘docker service create -name dns-cache -p 53:53/udp dns-cache’ is not correct and

will not create a swarm service that only listens on port 53 using the UDP protocol. There are two

errors in the command:

The option -name should be --name with two dashes, otherwise it will be interpreted as a short

option -n followed by an argument ame1.

The option -p or --publish will publish the service port to the host port, which means the service will

be reachable from outside the swarm2. To create a service that only listens on the internal network,

you need to use the --publish-add option with the mode=ingress flag3.

The correct command should be:

docker service create --name dns-cache --publish-add

mode=ingress,target=53,published=53,protocol=udp dns-cache

:

docker service create | Docker Docs

Publish ports on the host | Docker Docs

Publish a port for a service | Docker Docs