DCA Exam Dumps - Docker Certified Associate Questions and Answers

Creating one pod and adding all the resources needed for each application is not a good way to accomplish the goal of grouping Kubernetes-specific resources for each application. This is because pods are the smallest unit of a Kubernetes application, and they are designed to run a single container or a set of tightly coupled containers that share the same network and storage resources1. Pods are ephemeral and can be created and destroyed by the Kubernetes system at any time. Therefore, putting multiple applications in one pod would make them harder to manage, scale, and update independently. A better way to accomplish the goal is to use namespaces, which are logical clusters within a physical cluster that can isolate resources, policies, and configurations for different applications2. Namespaces can also help organize secrets, which are Kubernetes objects that store sensitive information such as passwords, tokens, and keys3. References:

• Pods | Kubernetes
• Namespaces | Kubernetes
• Secrets | Kubernetes

 Adding all the resources to the default namespace is not a way to accomplish this, because it would not isolate the resources for each application. Instead, the teams should use namespaces, which are a mechanism to organize resources in a Kubernetes cluster. Namespaces provide a scope for names of resources and a way to attach authorization and policy to a subset of the cluster. By creating a separate namespace for each application, the teams can ensure that their resources are grouped together and not accessible by other teams or applications.

References:

• What is a Container? | Docker
• Docker Certified Associate Guide | KodeKloud
• DCA Prep Guide | GitHub
• Namespaces | Kubernetes

 = Uninstalling the ‘docker-ce’ package before installing the ‘docker-ee’ package will not upgrade Docker Engine CE to Docker Engine EE. It will only remove the existing Docker Engine CE installation and install a new Docker Engine EE installation. This means that any existing containers, images, volumes, networks, and other Docker resources will be lost. To upgrade Docker Engine CE to Docker Engine EE without losing any data, you need to use the migration tool provided by Docker1 or follow the steps described in the Docker documentation2 or other online guides34. References:

• 1: Migrate to Engine 1.10 | Docker Docs
• 2: Install Docker Engine | Docker Docs
• 3: Switching Docker 18.09 Community Edition to Enterprise Engine with no …
• 4: How to upgrade Docker 18.09 Community Edition to Docker Enterprise 18.09

 The command docker inspect http will not enable you to view the list of historical tasks for the service. The docker inspect command returns low-level information on Docker objects, such as containers, images, networks, or volumes1. It does not work on services, which are higher-level objects that define the desired state of a set of tasks2. To view the list of historical tasks for a service, you need to use the docker service ps command, which shows the current and previous states of each task, as well as the node, error, and ports3. References:

• docker inspect | Docker Docs
• Services | Docker Docs
• docker service ps | Docker Docs

 The mnt namespace is not disabled by default and does not need to be enabled at Docker engine runtime to be used. The mnt namespace is one of the six Linux kernel namespaces that Docker uses to isolate containers from the host system1. The mnt namespace allows a container to have its own set of mounted filesystems and root directories, which are different from the host’s2. This means that a container can access only the files and directories that are mounted inside its namespace, and not the ones that are mounted on the host or other containers. The mnt namespace is created automatically when a container is started, and it is destroyed when the container stops3.

References:

• Isolate containers with a user namespace | Docker Docs
• The mnt namespace - Docker Cookbook - Second Edition
• Container security fundamentals part 2: Isolation & namespaces

mnt is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, mnt is one of the namespaces that are enabled by default when using namespaces for isolation.

References: https://docs.docker.com/engine/security/userns-remap/#user-namespace-known-limitations

= The pid namespace is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. The pid namespace is one of the six namespaces that are enabled by default when you run a container with Docker1. The pid namespace isolates the process ID number space, meaning that processes in different pid namespaces can have the same PID2. This allows containers to have their own init process with PID 1 and to limit the visibility and interaction of processes between containers and the host3. To disable the pid namespace, you need to use the --pid option with the docker run command and specify the host or another container as the pid mode. References:

• Docker run reference | Docker Docs
• pid_namespaces(7) - Linux manual page - man7.org
• Building containers by hand: The PID namespace - Enable Sysadmin
• [Share host and container processes with --pid | Docker Docs]

 A liveness probe is a mechanism for indicating your application’s internal health to the Kubernetes control plane. Kubernetes uses liveness probes to detect issues within your pods. When a liveness check fails, Kubernetes restarts the container in an attempt to restore your service to an operational state1. Therefore, the action taken by the orchestrator to fix the unhealthy container is to restart it. References:

• Content trust in Docker | Docker Docs
• Docker Content Trust: What It Is and How It Secures Container Images
• A Practical Guide to Kubernetes Liveness Probes | Airplane

   = Using network connect to access the container on the bridge network does not accomplish creating a container that is reachable from its host’s network. The network connect command connects a container to an existing network, but it does not expose the container’s ports to the host1. The bridge network is the default network that Docker creates for containers, and it provides isolation from the host network2. To create a container that is reachable from its host’s network, you need to use the host network driver, which disables network isolation and uses the host’s network stack directly3. Alternatively, you can use the port mapping feature to publish specific ports of the container to the host4. References:

• docker network connect | Docker Docs
• Bridge network driver | Docker Docs
• Host network driver | Docker Docs
• Publish ports on the host | Docker Docs

Creating a Dockerfile for each environment, specifying ports and Docker secrets for certificates is not a way to provision configuration to containers at runtime. A Dockerfile is a text document that contains all the commands a user could call on the command line to assemble an image1. A Dockerfile is used to build an image, not to run a container. Once an image is built, the configuration specified in the Dockerfile cannot be changed at runtime. To provision configuration to containers at runtime, you need to use a different mechanism, such as environment variables, command-line arguments, or config maps234. References:

• Dockerfile reference | Docker Docs
• Environment variables in Compose | Docker Docs
• Override the default command | Docker Docs
• Configuration management with Containers | Kubernetes

The command docker Is -a does not list all nodes in a swarm cluster from the command line, but rather lists all containers, both running and stopped, on the current node1. To list all nodes in a swarm cluster, you need to use the command docker node ls from a manager node2. This command shows the node ID, hostname, status, availability, and manager status for each node in the swarm2. You can also use the --filter option to filter the output based on various criteria2. References: Docker Documentation, docker node ls