Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. What does the image name registry.lab.local:5000/shop/api:1.4 tell Docker?

   1. AOnly the tag
   2. BRegistry host:port, repository path shop/api, and tag 1.4
   3. CThat it's a local image
   4. DThe image digest
   Show answer

   B. The first part, when it contains a dot or a colon (or is localhost), is the registry. Without one, Docker assumes Docker Hub (docker.io) and, for single names, the library/ namespace.

   From lesson 06 · Registries: tag, push & pull

2. Q2. Why pin an image by digest (@sha256:...) in production?

   1. ADigests download faster
   2. BA tag can be moved to a different image; a digest always means exactly the same content
   3. CRegistries require it
   4. DIt skips authentication
   Show answer

   B. Tags are mutable pointers. A digest is the hash of the image manifest, so it can't silently change under you.

   From lesson 06 · Registries: tag, push & pull

3. Q3. After `docker login`, where is the password stored by default on Linux without a credential helper?

   1. ANowhere
   2. BBase64-encoded (not encrypted) in ~/.docker/config.json
   3. CEncrypted in /etc/docker
   4. DIn daemon.json
   Show answer

   B. Docker warns about this at login. Use a credential helper (pass, secretservice, or a cloud helper like docker-credential-ecr-login) or short-lived tokens in CI.

   From lesson 06 · Registries: tag, push & pull

4. Q4. CI pulls fail with 'toomanyrequests: You have reached your pull rate limit'. Best long-term fix?

   1. ARetry in a loop
   2. BAuthenticate pulls and/or pull through a registry mirror or cache you control
   3. CUse the latest tag
   4. DDisable TLS
   Show answer

   B. Docker Hub limits anonymous pulls per IP, and shared CI IPs hit that quickly. Logged-in pulls get higher limits; a pull-through cache or mirroring base images into your own registry removes the dependency.

   From lesson 06 · Registries: tag, push & pull

5. Q5. `docker push` says 'denied: requested access to the resource is denied'. What's the most likely cause?

   1. AThe image is too big
   2. BNot logged in to that registry, or the account has no push rights to that repository/namespace
   3. CThe daemon is down
   4. DWrong Dockerfile
   Show answer

   B. Check which registry the name points to, that you ran docker login for that exact host:port, and that the repository or project exists and your user can push to it.

   From lesson 06 · Registries: tag, push & pull

6. Q6. Why does the registry's certificate need a subjectAltName (SAN)?

   1. AIt makes the certificate valid for longer
   2. BModern TLS clients, including Docker, match the hostname only against SANs and ignore the Common Name
   3. CThe registry won't start without one
   4. DIt encrypts the private key
   Show answer

   B. Go-based clients like Docker reject certificates that only have a CN ('x509: certificate relies on legacy Common Name field'). Put every name and IP clients use into the SAN list.

   From lesson 07 · Run your own private registry

7. Q7. Which htpasswd hash format does the open-source registry accept?

   1. AMD5 (apr1)
   2. BSHA-1
   3. Cbcrypt (htpasswd -B)
   4. DPlain text
   Show answer

   C. The registry's htpasswd auth only supports bcrypt entries.

   From lesson 07 · Run your own private registry

8. Q8. You deleted a manifest through the API but disk usage didn't drop. Why?

   1. ADeletes are impossible
   2. BDeleting only removes the reference; blobs are freed by running garbage-collect
   3. CYou need to restart Docker on the clients
   4. DThe registry caches everything forever
   Show answer

   B. The DELETE removes the manifest link. Layer blobs may be shared with other images, so the registry frees them only during garbage collection, ideally in read-only mode or with the registry stopped.

   From lesson 07 · Run your own private registry

9. Q9. What does a pull-through cache registry do?

   1. AStores your private images
   2. BProxies an upstream registry such as Docker Hub and keeps a local copy of everything pulled through it
   3. CSigns images
   4. DReplaces docker login
   Show answer

   B. With proxy.remoteurl set, the registry fetches from the upstream on the first pull and serves later pulls locally, which saves bandwidth and avoids upstream rate limits.

   From lesson 07 · Run your own private registry