Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. You set log-opts max-size in daemon.json and restarted Docker, but an existing container's log keeps growing. Why?

   1. AThe setting is wrong
   2. BLogging settings apply only to containers created after the change; recreate the container
   3. CYou need to reboot
   4. Dmax-size only works with journald
   Show answer

   B. Log driver and options are fixed when a container is created. Recreate it (docker compose up -d --force-recreate, or rm + run) to pick up the new defaults.

   From lesson 08 · Configuring the daemon: daemon.json

2. Q2. Docker fails to start with 'the following directives are specified both as a flag and in the configuration file: hosts'. Fix?

   1. ADelete daemon.json
   2. BRemove the setting from one place: either drop 'hosts' from daemon.json or override the unit's -H flag with a systemd drop-in
   3. CReinstall Docker
   4. DAdd the setting twice
   Show answer

   B. Many distributions start dockerd with -H fd:// in the systemd unit. A setting may be given as a flag or in daemon.json, never both.

   From lesson 08 · Configuring the daemon: daemon.json

3. Q3. What does registry-mirrors affect?

   1. AAll registries
   2. BPulls from Docker Hub only
   3. CPushes only
   4. DOnly images with digests
   Show answer

   B. The daemon's registry-mirrors setting is used for Docker Hub (docker.io) images. Other registries need their own names in image references.

   From lesson 08 · Configuring the daemon: daemon.json

4. Q4. What does live-restore: true give you?

   1. AAutomatic image updates
   2. BContainers keep running while the daemon is stopped or restarted, e.g. during a Docker upgrade
   3. CHot-reload of all settings
   4. DAutomatic backups
   Show answer

   B. With live-restore, dockerd can go down and come back without stopping containers. It isn't compatible with Swarm mode.

   From lesson 08 · Configuring the daemon: daemon.json

5. Q5. Company VPN users lose access to 172.18.0.0/16 whenever a new Compose project starts on a laptop. Which setting prevents that?

   1. Adns
   2. Bdefault-address-pools (and bip for docker0)
   3. Cdata-root
   4. Dlog-driver
   Show answer

   B. New networks get subnets from the default address pools. Set them to ranges that don't collide with your VPN, VPCs or office networks.

   From lesson 08 · Configuring the daemon: daemon.json

6. Q6. docker pull from registry.lab.local:5000 fails with 'x509: certificate signed by unknown authority'. What is the proper fix?

   1. AAdd the registry to insecure-registries
   2. BPut the CA that signed the registry's certificate at /etc/docker/certs.d/registry.lab.local:5000/ca.crt
   3. CRestart the registry
   4. DUse docker login again
   Show answer

   B. The error means the chain doesn't lead to a CA this host trusts. Giving Docker that CA keeps full verification; insecure-registries would switch it off.

   From lesson 09 · Registry certificates & the insecure bypass

7. Q7. In /etc/docker/certs.d/<host:port>/, what do the file extensions mean?

   1. AAll three are CA files
   2. B.crt = CA certificates to trust; .cert = client certificate; .key = client private key
   3. C.crt = client cert; .key = CA
   4. DExtensions don't matter
   Show answer

   B. Docker treats *.crt as CA roots and pairs *.cert with a *.key of the same name as a client certificate for mutual TLS.

   From lesson 09 · Registry certificates & the insecure bypass

8. Q8. What exactly does listing a registry in insecure-registries do?

   1. AEncrypts traffic with a weaker cipher
   2. BDocker still tries HTTPS but ignores certificate errors, and falls back to plain HTTP if HTTPS isn't available
   3. CDisables login
   4. DOnly affects pushes
   Show answer

   B. Verification is skipped, so anyone who can intercept or impersonate the registry can serve you any image, and with HTTP fallback, credentials and layers travel unencrypted.

   From lesson 09 · Registry certificates & the insecure bypass

9. Q9. Every docker pull from Docker Hub fails with x509 on a corporate network, but works at home. Most likely cause?

   1. ADocker Hub's certificate expired
   2. BA TLS-inspecting proxy re-signs traffic with the company CA, which the host doesn't trust yet
   3. CThe daemon.json is invalid
   4. DRate limiting
   Show answer

   B. Install the company's root CA into the system trust store and restart Docker. Don't list docker.io as insecure.

   From lesson 09 · Registry certificates & the insecure bypass

10. Q10. You fixed trust with certs.d on your laptop, but Kubernetes pods on the nodes still fail with ImagePullBackOff x509. Why?

    1. AKubernetes doesn't support private registries
    2. BNodes run containerd, which uses its own per-registry hosts.toml (or the node's system trust store), not Docker's certs.d
    3. CThe pod needs privileged mode
    4. DThe image is too big
    Show answer

    B. Trust must be configured on every node that pulls, in the runtime that pulls: /etc/containerd/certs.d/<host>/hosts.toml with a ca = entry, or the CA in the node's system trust store.

    From lesson 09 · Registry certificates & the insecure bypass