Docker Updated DCA Exam Questions and Answers by navy

Creating a Dockerfile for each environment, specifying ports and Docker secrets for certificates is not a way to provision configuration to containers at runtime. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build an image, not to run a container. Once an image is built, the configuration specified in the Dockerfile cannot be changed at runtime. To provision configuration to containers at runtime, you need to use a different mechanism, such as environment variables, command-line arguments, or config maps234. References:

Dockerfile reference | Docker Docs

Environment variables in Compose | Docker Docs

Override the default command | Docker Docs

Configuration management with Containers | Kubernetes

 The mnt namespace is not disabled by default and does not need to be enabled at Docker engine runtime to be used. The mnt namespace is one of the six Linux kernel namespaces that Docker uses to isolate containers from the host system1. The mnt namespace allows a container to have its own set of mounted filesystems and root directories, which are different from the host’s2. This means that a container can access only the files and directories that are mounted inside its namespace, and not the ones that are mounted on the host or other containers. The mnt namespace is created automatically when a container is started, and it is destroyed when the container stops3.

Isolate containers with a user namespace | Docker Docs

The mnt namespace - Docker Cookbook - Second Edition

Container security fundamentals part 2: Isolation & namespaces

mnt is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, mnt is one of the namespaces that are enabled by default when using namespaces for isolation.

 The command ‘kubectl get pods --all-namespaces -I env=development’ does not display all the pods in the cluster that are labeled as ‘env: development’. The reason is that the flag -I is not a valid option for kubectl get pods. The correct flag to use is --selector or -l, which allows you to filter pods by labels1. Labels are key-value pairs that can be attached to Kubernetes objects to identify, group, or select them2. For example, to label a pod with env=development, one can run:

kubectl label pods my-pod env=development

To display all the pods that have the label env=development, one can run:

kubectl get pods --selector env=development

or

kubectl get pods -l env=development

The --all-namespaces flag can be used to list pods across all namespaces3. Therefore, the correct command to display all the pods in the cluster that are labeled as ‘env: development’ is:

kubectl get pods --all-namespaces --selector env=development

or

kubectl get pods --all-namespaces -l env=development References:

kubectl Cheat Sheet | Kubernetes

Labels and Selectors | Kubernetes

kubectl get | Kubernetes

= The command docker volume inspect nginx will not display a list of volumes for a specific container. This is because docker volume inspect expects one or more volume names as arguments, nota container name1. To display a list of volumes for a specific container, you can use the docker inspect command with the --format option and a template that extracts the volume information fromthe container JSON output2. For example, to display the source and destination of the volumes mounted by the container nginx, you can use the following command:

docker inspect --format=' { {range .Mounts}} { {.Source}}: { {.Destination}} { {end}}' nginx

docker volume inspect | Docker Docs

docker inspect | Docker Docs