Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What is a running container, from the Linux kernel's point of view?

   1. AA small virtual machine with its own kernel
   2. BAn ordinary process with namespaces and cgroups applied
   3. CA file in /var/lib/docker
   4. DA thread inside dockerd
   Show answer

   B. Containers share the host kernel. Namespaces give the process its own view (PIDs, network, mounts, hostname) and cgroups limit its CPU and memory.

   From lesson 01 · What a container really is

2. Q2. Which component actually creates the container's namespaces and cgroups?

   1. AThe docker CLI
   2. Bdockerd
   3. Crunc (called via containerd)
   4. DThe registry
   Show answer

   C. The CLI calls dockerd's API, dockerd asks containerd to run the container, and containerd uses a low-level runtime (runc by default) to set up namespaces and cgroups and start the process.

   From lesson 01 · What a container really is

3. Q3. You run `docker run -d nginx` twice. How many copies of the nginx image are stored on disk?

   1. ATwo
   2. BOne, shared; each container only adds a thin writable layer
   3. CNone until you commit
   4. DIt depends on the port
   Show answer

   B. Image layers are read-only and shared. Each container gets its own small writable layer on top.

   From lesson 01 · What a container really is

4. Q4. A container exits immediately after `docker run -d myapp`. Where do you look first?

   1. Adocker logs myapp-container and docker ps -a for the exit code
   2. BReinstall Docker
   3. Cdocker network ls
   4. DThe registry
   Show answer

   A. A container lives as long as its main process. `docker ps -a` shows the exit code and `docker logs` shows what the process printed before it stopped.

   From lesson 01 · What a container really is

5. Q5. What does `docker stop` do?

   1. AKills the process immediately with SIGKILL
   2. BSends SIGTERM, waits (10 s by default), then SIGKILL
   3. CPauses the container
   4. DDeletes the container
   Show answer

   B. Stop is graceful first: SIGTERM so the app can shut down cleanly, then SIGKILL after the timeout (change it with -t).

   From lesson 01 · What a container really is

6. Q6. Why copy requirements.txt and run pip install BEFORE copying the rest of the source?

   1. Apip needs it first alphabetically
   2. BSo the slow dependency layer stays cached when only your code changes
   3. CIt makes the image smaller
   4. DCOPY . . would overwrite pip
   Show answer

   B. Each instruction is a cached layer. If a layer's inputs didn't change, Docker reuses it. Code changes on every commit; dependencies rarely do, so install them first.

   From lesson 02 · Images & Dockerfiles

7. Q7. What's the main benefit of a multi-stage build?

   1. AFaster pushes only
   2. BBuild tools and sources stay in the builder stage; the final image carries only the runtime and the built app
   3. CIt runs tests automatically
   4. DIt allows several CMDs
   Show answer

   B. Compilers, package caches and source code never reach the final stage, so the image is smaller and has a much smaller attack surface.

   From lesson 02 · Images & Dockerfiles

8. Q8. Image has ENTRYPOINT ["python", "app.py"] and CMD ["--port", "8000"]. What runs with `docker run img --port 9000`?

   1. Apython app.py --port 8000
   2. Bpython app.py --port 9000
   3. C--port 9000
   4. DIt fails
   Show answer

   B. Arguments after the image name replace CMD. ENTRYPOINT stays, so they're appended to it.

   From lesson 02 · Images & Dockerfiles

9. Q9. A developer's .env file with an API key ended up inside the image. What prevents this?

   1. AA .dockerignore that excludes .env, and copying only what the app needs
   2. BUsing the latest tag
   3. Cdocker image prune
   4. DRunning as root
   Show answer

   A. COPY . . sends everything in the build context unless .dockerignore excludes it. Anything copied into a layer can be extracted from the image later, even if a later layer deletes it.

   From lesson 02 · Images & Dockerfiles

10. Q10. Why use the exec form CMD ["node", "server.js"] instead of CMD node server.js?

    1. AIt's shorter
    2. BThe app runs as PID 1 and receives SIGTERM directly, so docker stop shuts it down cleanly
    3. CShell form is not allowed
    4. DIt enables caching
    Show answer

    B. Shell form wraps the command in /bin/sh -c, which usually doesn't forward signals. The app never sees SIGTERM and gets killed after the stop timeout.

    From lesson 02 · Images & Dockerfiles

11. Q11. Two containers on the DEFAULT bridge network can't reach each other by name, but on a network you created they can. Why?

    1. AThe default bridge is slower
    2. BDocker's embedded DNS only resolves container names on user-defined networks
    3. CNames only work with --link on all networks
    4. DUser-defined networks use IPv6
    Show answer

    B. User-defined networks come with Docker's embedded DNS server (127.0.0.11 inside the container). The legacy default bridge doesn't, so containers there only reach each other by IP.

    From lesson 03 · Networking & storage

12. Q12. `docker run -p 5432:5432 postgres` on a cloud VM. What's the risk?

    1. ANone, Docker ports are private
    2. BThe port is published on all host interfaces and Docker's iptables rules can bypass a host firewall like ufw
    3. CPostgres won't start
    4. DOnly IPv6 is exposed
    Show answer

    B. By default -p binds 0.0.0.0, and Docker inserts its own iptables rules that are evaluated before many host firewall rules. Bind to 127.0.0.1 or keep the database on an internal network with no -p.

    From lesson 03 · Networking & storage

13. Q13. Where should a database container keep its data?

    1. AIn the container's writable layer
    2. BIn a named volume
    3. CIn /tmp
    4. DIn the image
    Show answer

    B. The writable layer is deleted with the container. A named volume outlives containers, is managed by Docker and is easy to back up.

    From lesson 03 · Networking & storage

14. Q14. When is a bind mount the right choice?

    1. AFor production database data
    2. BFor sharing a specific host file or folder, like a config file or source code during development
    3. CFor secrets in production
    4. DNever
    Show answer

    B. Bind mounts map an exact host path. Great for config and live-reload development; for application data, named volumes are more portable and don't depend on host paths or permissions.

    From lesson 03 · Networking & storage