Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. A container keeps exiting with code 137. What does that usually mean?

   1. AThe app returned 137
   2. BIt received SIGKILL (128 + 9), very often from the kernel's OOM killer for exceeding its memory limit
   3. CThe image is corrupt
   4. DA port clash
   Show answer

   B. Exit codes above 128 are 128 + the signal number. Check docker inspect for OOMKilled: true, then raise the limit or fix the memory use.

   From lesson 10 · Security & troubleshooting

2. Q2. Why is --privileged dangerous?

   1. AIt's slower
   2. BIt gives the container all capabilities and access to host devices, so escaping to the host is trivial
   3. CIt disables logging
   4. DIt only works as root
   Show answer

   B. A privileged container can mount host disks and load kernel modules. Grant the specific capability or device it needs instead.

   From lesson 10 · Security & troubleshooting

3. Q3. `docker run -p 8080:80` fails with 'port is already allocated'. First step?

   1. ARestart Docker
   2. BFind what holds the port: docker ps --filter publish=8080 or ss -ltnp
   3. CReinstall nginx
   4. DUse --network host
   Show answer

   B. Another container or a host process already listens on 8080. Stop it, or publish on a different host port.

   From lesson 10 · Security & troubleshooting

4. Q4. /var/lib/docker is 95% full. What is the safest first clean-up?

   1. Arm -rf /var/lib/docker/overlay2/*
   2. Bdocker system df, then prune stopped containers, dangling images and build cache; cap log sizes
   3. Cdocker volume prune -a without checking
   4. DReboot
   Show answer

   B. Never delete Docker's files by hand. Measure with docker system df, prune what's safe, and check for huge container log files (fix with log rotation in daemon.json). Only prune volumes once you know no data is needed.

   From lesson 10 · Security & troubleshooting

5. Q5. The run host pulls fine by name, but you deploy with the digest. Why bother?

   1. AIt's faster
   2. BThe digest guarantees the exact image you tested runs, even if someone re-pushes the tag
   3. CCompose requires it
   4. DIt skips TLS
   Show answer

   B. Tags can move. The digest pins the content, which is what makes a deployment reproducible and auditable.

   From lesson 11 · Capstone: ship an app through a private registry

6. Q6. At the end of the capstone, which of these should the run host NOT have?

   1. AA certs.d entry for the registry
   2. BLog rotation in daemon.json
   3. Cregistry.lab.local:5000 in insecure-registries
   4. Drestart: unless-stopped on services
   Show answer

   C. The registry has a certificate the host trusts through certs.d, so there's no reason to switch verification off.

   From lesson 11 · Capstone: ship an app through a private registry