If installing Docker using devicemapper for storage with the Intent to run production workloads, how should devicemapper be configured
Correct Answer: A
Question 22
Is this a function of UCP? Solution: image role-based access control
Correct Answer: B
Image role-based access control is not a function of UCP. UCP has its own built-in authentication mechanism and integrates with LDAP services. It also has role-based access control (RBAC), so that you can control who can access and make changes to your cluster and applications1. However, image role-based access control is a feature of Docker Trusted Registry (DTR), which integrates with UCP and allows you to manage the images you use for your applications2. DTR lets you define granular permissions for images, such as who can push, pull, delete, or scan them3. References: Universal Control Plane overview), Docker Trusted Registry overview), Docker Access Control)
Question 23
Will this command mount the host's '/data' directory to the ubuntu container in read-only mode? Solution: 'docker run -v /data:/mydata --mode readonly ubuntu'
Correct Answer: B
= The command docker run -v /data:/mydata --mode readonly ubuntu is not valid because it has some syntax errors. The correct syntax for running a container with a bind mount is docker run [OPTIONS] IMAGE [COMMAND] [ARG...]. The errors in the command are: The option flag for specifying the volume is --volume or -v, not -v. For example, -v /data:/mydata should be --volume /data:/mydata. The option flag for specifying the mode of the volume is --mount, not --mode. For example, --mode readonly should be --mount type=bind,source=/data,target=/mydata,readonly. The option flag for specifying the mode of the container is --detach or -d, not --mode. For example, --mode readonly should be --detach. The correct command for running a container with a bind mount in read-only mode is: docker run --volume /data:/mydata --mount type=bind,source=/data,target=/mydata,readonly --detach ubuntu This command will run a container using the ubuntu image and mount the host's /data directory to the container's /mydata directory in read-only mode. The container will run in the background (--detach). docker run reference | Docker Documentation : [Use bind mounts | Docker Documentation]
Question 24
Is this a type of Linux kernel namespace that provides container isolation? Solution: Storage
Correct Answer: A
Question 25
Will this Linux kernel facility limit a Docker container's access to host resources, such as CPU or memory? Solution.capabilities
Correct Answer: A
Explanation Capabilities are a Linux kernel feature that allows processes to perform some privileged operations without having the full power of the root user1. Docker uses capabilities to limit the access of containers to host resources, such as CPU or memory2. By default, Docker drops all capabilities except those needed for the container to function properly, using a whitelist approach3. This reduces the risk of a container compromising the host system or other containers. You can also add or remove capabilities to or from a container at runtime, using the --cap-add or --cap-drop options of the docker run command4. This gives you more control over the security and functionality of your containers. References: * Capabilities | dockerlabs * Docker run reference | Docker Docs * Docker Capabilities and no-new-privileges * Runtime privilege and Linux capabilities | Docker Docs
