Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Why does only the front-end container publish a port?

   1. AThe back end can't listen on a port
   2. BEverything reaches the back end through the front end over the private network, so exposing it would only add attack surface
   3. CDocker allows one -p per network
   4. Dgunicorn doesn't support ports
   Show answer

   B. The browser talks to nginx; nginx forwards /api/ to backend:8000 over the user-defined network. The API and its database are never directly reachable from outside the host.

   From lesson 12 · Project: Python front end + back end

2. Q2. How does nginx find the back end?

   1. ABy a hard-coded container IP
   2. BBy the name backend, resolved by Docker's embedded DNS on the shared network
   3. CThrough the host's published port
   4. DThrough /etc/hosts on the host
   Show answer

   B. The back-end container has the network alias backend (in Compose, the service name). BACKEND_URL=http://backend:8000 is filled into the nginx config when the container starts.

   From lesson 12 · Project: Python front end + back end

3. Q3. The app works with curl on the host, but a colleague's laptop gets a timeout. Which is NOT a likely cause?

   1. ABIND_ADDR=127.0.0.1 was used
   2. BThe host firewall or cloud security group blocks the port
   3. CThe laptop is on a network that can't route to the host
   4. DThe back end has no published port
   Show answer

   D. The back end is supposed to be unpublished. Remote access depends on the front end being published on a reachable address and the firewall/security group allowing the port.

   From lesson 12 · Project: Python front end + back end

4. Q4. Why is the final .NET image based on aspnet:10.0 and not sdk:10.0?

   1. AThe SDK can't run apps
   2. BThe SDK (compilers, NuGet, tooling) is only needed to build; the runtime image is much smaller and has less to patch
   3. Caspnet is faster to compile
   4. DWindows requires it
   Show answer

   B. Multi-stage builds publish with the SDK and copy only the output into the runtime image: about 230 MB here instead of well over 1 GB.

   From lesson 13 · Project: .NET front end + back end (Linux & Windows)

5. Q5. The same Dockerfile.windows image won't start on a colleague's Windows host: 'The container operating system does not match the host operating system'. Why?

   1. AWindows can't run .NET
   2. BWindows containers with process isolation need a compatible host version; use a matching tag (e.g. ltsc2022 vs ltsc2025) or Hyper-V isolation
   3. CThe port is taken
   4. DNano Server needs a licence key
   Show answer

   B. Unlike Linux containers, Windows containers depend on the host's Windows build. Pick the base tag for the host (ltsc2022, ltsc2025) or run with --isolation=hyperv.

   From lesson 13 · Project: .NET front end + back end (Linux & Windows)

6. Q6. Can a Windows host in Windows-containers mode run the Linux images from this project?

   1. AYes, always
   2. BNo: an engine runs either Linux or Windows containers; switch Docker Desktop's mode (Linux containers run in its VM)
   3. COnly with --privileged
   4. DOnly the front end
   Show answer

   B. Docker Desktop switches the whole engine between Linux containers (in a WSL 2 / Hyper-V VM) and Windows containers. Build and run each variant in the matching mode.

   From lesson 13 · Project: .NET front end + back end (Linux & Windows)

7. Q7. How does the container health check work when the runtime image has no curl?

   1. AIt doesn't; health checks need curl
   2. BThe app has a --health mode that calls its own endpoint and exits 0 or 1; HEALTHCHECK runs dotnet App.dll --health
   3. CDocker checks the port automatically
   4. DThrough the front end
   Show answer

   B. Adding curl to the image just for health checks grows it and adds packages to patch. A few lines in the app do the same job on both Linux and Windows images.

   From lesson 13 · Project: .NET front end + back end (Linux & Windows)