Top 30 Docker & Kubernetes Concepts Quiz

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   A developer needs to deploy a microservices application with minimal resource usage and fast startup times. Which technology is generally preferred and why?

   • aContainers, because they share the host OS kernel, reducing overhead.
   • bVirtual Machines, due to their superior kernel-level isolation for each microservice.
   • cVirtual Machines, because they provide complete hardware emulation for each service.
   • dContainers, as they allow running different operating systems for each microservice.
   Show the answer

   Answer: a · Containers, because they share the host OS kernel, reducing overhead.

   Containers are preferred for microservices due to their low overhead and fast startup times, achieved by sharing the host OS kernel. VMs, while offering strong isolation, incur significant resource overhead by emulating a full OS.

   Read the full bite: VMs vs. Containers: Houses vs. Apartments

2. Question 2 of 30

   What is Docker's primary method for resolving the 'Works on My Machine' problem?

   • aIt bundles the application with all its specific dependencies into a portable, consistent unit.
   • bIt provides a full virtual machine for each application, ensuring complete environment isolation.
   • cIt forces developers to write code that has no external dependencies, making it universally portable.
   • dIt automatically updates all system libraries and runtimes on deployment servers to match the developer's machine.
   Show the answer

   Answer: a · It bundles the application with all its specific dependencies into a portable, consistent unit.

   The card explicitly states Docker solves this by "packaging an application with all of its dependencies... into a single, isolated unit called a container image." This ensures the environment is consistent everywhere. While related to isolation, containers are distinct from full virtual machines, which are heavier and emulate entire hardware systems.

   Read the full bite: The 'Works on My Machine' Problem

3. Question 3 of 30

   Which statement accurately describes a key characteristic of Linux namespaces?

   • aTheir primary purpose is to provide robust hardware-level security isolation for highly untrusted workloads.
   • bEach namespace operates with its own dedicated operating system kernel, separate from the host.
   • cThey enable processes to have isolated views of system resources while sharing the host's single kernel.
   • dThey allow processes within different namespaces to freely access each other's network interfaces and process IDs.
   Show the answer

   Answer: c · They enable processes to have isolated views of system resources while sharing the host's single kernel.

   Linux namespaces provide isolated environments for resources like process IDs and network interfaces, but they all share the host's single kernel. This is a fundamental difference from virtual machines, which run their own independent kernels. The card explicitly states that namespaces are not a sole security boundary for untrusted code.

   Read the full bite: Linux Namespaces: A Virtual Slice of the OS

4. Question 4 of 30

   What is the primary problem that Linux cgroups were designed to solve in a multi-tenant server environment?

   • aEnsuring that processes can communicate securely across different isolation boundaries.
   • bIsolating network traffic to prevent interference between different tenants on the same host.
   • cPreventing a single application from consuming all available CPU or memory, thus starving other processes.
   • dProviding a mechanism for applications to dynamically request more resources as needed.
   Show the answer

   Answer: c · Preventing a single application from consuming all available CPU or memory, thus starving other processes.

   The card explicitly states that cgroups were introduced because 'a single runaway process could consume all available CPU or memory, starving every other process and crashing the system.' While cgroups are related to container isolation, their primary role is resource limiting, not network traffic isolation or secure communication.

   Read the full bite: Linux cgroups: Resource Fences for Processes

5. Question 5 of 30

   Which component in a Kubernetes node is directly responsible for pulling container images and setting up their isolated execution environment?

   • aThe container runtime, which executes containers based on instructions from the kubelet
   • bThe kubectl command-line tool, used by developers to deploy applications
   • cThe Kubernetes API Server, which orchestrates all cluster operations
   • dThe kubelet, which manages Pods on the node and communicates with the runtime
   Show the answer

   Answer: a · The container runtime, which executes containers based on instructions from the kubelet

   The container runtime is the low-level engine that directly pulls images and creates isolated container environments using features like namespaces and cgroups. The kubelet acts as a 'transmission,' translating Kubernetes commands into instructions for the runtime, but does not perform the execution itself.

   Read the full bite: Container Runtime: The Engine That Runs Your Containers

6. Question 6 of 30

   A team avoids public Docker images in their non-Docker runtime, believing the format is proprietary to Docker. Which statement corrects this misunderstanding?

   • aDocker images are OCI-compliant bundles that run on any compliant runtime without conversion.
   • bThe OCI Runtime Specification guarantees identical performance and resource usage across all compliant engines.
   • cNon-Docker runtimes must use a compatibility shim to translate Docker image metadata before execution.
   • dDocker images contain proprietary extensions that make them incompatible with standard OCI runtimes.
   Show the answer

   Answer: a · Docker images are OCI-compliant bundles that run on any compliant runtime without conversion.

   The card calls this belief a footgun, emphasizing that Docker images are OCI-compliant bundles executable by any compliant runtime, much like USB-C devices work with any compliant charger. Option C invents a translation step that the standard eliminates, and option B confuses interface compatibility with performance guarantees.

   Read the full bite: OCI: The USB-C of Containers

7. Question 7 of 30

   What is the primary reason Union File Systems, like Docker's OverlayFS, can exhibit performance overhead for write-intensive applications?

   • aEach modification to an existing file from a lower layer triggers a copy-on-write operation.
   • bAll write operations are first buffered in memory before being committed to disk, causing delays.
   • cThey require frequent re-merging of all layers for every write operation.
   • dThe system must synchronize changes across all containers sharing the same base image.
   Show the answer

   Answer: a · Each modification to an existing file from a lower layer triggers a copy-on-write operation.

   The card states that "The copy-on-write mechanism adds performance overhead for every initial write to a file that exists in a lower layer." This means files from read-only layers must first be copied to the writable layer before they can be modified, which is an extra I/O operation. Distractor A is incorrect because lower layers are read-only and not re-merged on write; changes are isolated to the top writable layer.

   Read the full bite: Union File Systems: Docker's Layered Magic

8. Question 8 of 30

   The OCI Runtime Spec primarily standardizes container execution by defining:

   • aHigh-level APIs for container orchestration systems like Kubernetes.
   • bA universal container image format for distribution.
   • cA set of user-facing commands for managing container lifecycles directly.
   • dThe structure of a filesystem bundle and a config.json for runtime instructions.
   Show the answer

   Answer: d · The structure of a filesystem bundle and a config.json for runtime instructions.

   The OCI Runtime Spec defines the 'filesystem bundle' (a directory containing the root filesystem and a config.json) and the config.json file itself, which specifies how a low-level runtime should execute the container. Option B describes the OCI Image Spec, while options C and D refer to higher-level abstractions or user-facing tools, which the Runtime Spec is explicitly not.

   Read the full bite: OCI Runtime Spec: The 'How to Run' Standard for Containers

9. Question 9 of 30

   Which scenario best illustrates the primary benefit of a container runtime shim?

   • aMultiple containers share the same shim process to reduce system resource consumption.
   • bThe container's filesystem and configuration are prepared by the shim before execution.
   • cA container daemon crashes, but all running containers continue to operate unaffected.
   • dA developer can run a container directly using runc without involving a higher-level daemon.
   Show the answer

   Answer: c · A container daemon crashes, but all running containers continue to operate unaffected.

   The primary benefit of a runtime shim is to decouple the container daemon from the container's lifecycle, allowing the daemon to restart or crash without terminating running containers. Option B is incorrect because the daemon (e.g., containerd) prepares the container's filesystem and configuration, not the shim.

   Read the full bite: Container Runtime Shim: Decoupling the Container Lifecycle

10. Question 10 of 30

    What is the immediate consequence when a process, protected by an active seccomp profile, attempts to execute a forbidden system call?

    • aThe system call is re-routed to a secure, isolated sandbox for execution.
    • bThe system call is logged as a security event and allowed to proceed.
    • cThe process's user ID is automatically changed to a less privileged one.
    • dThe kernel immediately terminates the offending process.
    Show the answer

    Answer: d · The kernel immediately terminates the offending process.

    The card states that any attempt by a process to use a syscall not on the allowlist causes the kernel to terminate the process. Seccomp is an enforcement mechanism, not merely an audit tool that logs events.

    Read the full bite: seccomp: A Kernel-Level Allowlist for Syscalls

11. Question 11 of 30

    What is the primary functional distinction between stopping a container and removing it?

    • aRemoving a container initiates a graceful shutdown process, while stopping it immediately terminates all running processes within it.
    • bA stopped container is completely inactive and consumes no disk space, but a removed container's data is only cleared after a system restart.
    • cStopping a container releases its allocated memory and CPU, while removing it ensures its image is no longer cached.
    • dStopping a container allows it to be restarted later with its preserved internal state, whereas removing it permanently deletes the container instance and any data not on a volume.
    Show the answer

    Answer: d · Stopping a container allows it to be restarted later with its preserved internal state, whereas removing it permanently deletes the container instance and any data not on a volume.

    The card explicitly states that stopping a container retains its state, allowing it to be restarted, while removing it permanently deletes the container and its non-volume data. Option A is incorrect because 'stop' sends a graceful shutdown signal (SIGTERM), not an immediate termination, and 'rm' deletes an already stopped container, it doesn't initiate the shutdown process itself.

    Read the full bite: Container Lifecycle: From Create to Remove

12. Question 12 of 30

    Which core problem in software development does a Dockerfile primarily address?

    • aAutomating the testing of application features before deployment.
    • bOptimizing application performance by compiling code more efficiently.
    • cGuaranteeing that an application's runtime environment is identical everywhere it runs.
    • dManaging source code versions and collaboration among developers.
    Show the answer

    Answer: c · Guaranteeing that an application's runtime environment is identical everywhere it runs.

    The card explicitly states Dockerfiles exist "To solve the classic 'it works on my machine' problem" and "ensure that an application and its dependencies are packaged together and run consistently everywhere." This aligns perfectly with guaranteeing an identical runtime environment. While Docker is used in CI/CD (which includes testing automation), the Dockerfile's direct role is defining the environment, not the testing process itself.

    Read the full bite: The Dockerfile: A Recipe for Your Container

13. Question 13 of 30

    What is the primary reason to avoid using the "latest" tag for Docker images in production or CI/CD pipelines?

    • aIt always refers to an unstable, unverified development build, unsuitable for production.
    • bThe image associated with the "latest" tag can be updated at any time, leading to non-reproducible builds and unexpected behavior.
    • cUsing "latest" requires more storage as Docker keeps a full history of all images it has ever pointed to.
    • dThe "latest" tag is automatically purged by Docker after a set duration, causing deployments to fail.
    Show the answer

    Answer: b · The image associated with the "latest" tag can be updated at any time, leading to non-reproducible builds and unexpected behavior.

    The card explicitly states that the image 'latest' points to can change without warning, leading to unexpected failures or behavior drift, making builds non-reproducible. This mutability is the core issue, not that it's inherently unstable or automatically purged.

    Read the full bite: Docker Image Tagging: Versioning for Containers

14. Question 14 of 30

    What fundamental problem are Docker Volumes primarily designed to solve?

    • aThe loss of data written inside a container's filesystem when the container is removed.
    • bThe difficulty of sharing application source code between multiple containers.
    • cThe need to reduce the size of Docker images by storing large binaries externally.
    • dThe challenge of providing temporary, isolated storage that is automatically purged upon container exit.
    Show the answer

    Answer: a · The loss of data written inside a container's filesystem when the container is removed.

    Docker Volumes exist because data written directly into a container's filesystem is lost when the container is removed, which is problematic for stateful applications. Option D describes the ephemeral nature of containers, which is the problem volumes counteract, not what they provide.

    Read the full bite: Docker Volumes: Persistent Data for Ephemeral Containers

15. Question 15 of 30

    For multi-service applications on a single host, why are user-defined bridge networks preferred over the default bridge network?

    • aThey automatically expose all container ports to the Docker host without explicit mapping.
    • bThey provide an internal DNS service for containers to resolve each other by name.
    • cThey allow containers to directly access the host's network interfaces for better performance.
    • dThey offer enhanced security isolation between individual containers.
    Show the answer

    Answer: b · They provide an internal DNS service for containers to resolve each other by name.

    The card explicitly states that user-defined bridge networks are superior because they provide an internal DNS service, allowing containers to find each other by name, which is essential for multi-service applications. The default bridge network lacks this feature, making it brittle due to changing IP addresses.

    Read the full bite: Docker Networking: How Containers Talk to Each Other

16. Question 16 of 30

    To maximize Docker build cache efficiency, how should Dockerfile instructions be ordered?

    • aGroup all RUN commands together at the end to reduce the total number of image layers.
    • bUse the --no-cache flag for every build to ensure all layers are always fresh.
    • cArrange instructions from least frequently changing to most frequently changing, top to bottom.
    • dPlace instructions that modify application source code (e.g., COPY .) at the very beginning.
    Show the answer

    Answer: c · Arrange instructions from least frequently changing to most frequently changing, top to bottom.

    The card advises placing infrequently changing instructions at the top and frequently changing ones as late as possible to optimize cache. Placing frequently changing instructions early, as in option D, is identified as a 'footgun' that invalidates the cache for subsequent steps unnecessarily.

    Read the full bite: Docker Build Cache: Don't Rebuild What Hasn't Changed

17. Question 17 of 30

    What is the primary function of a .dockerignore file in a Docker project?

    • aTo optimize the caching of layers during the Docker image build process.
    • bTo specify which files should be copied into the final Docker image.
    • cTo reduce the overall size of the final Docker image.
    • dTo prevent specific files from being included in the build context sent to the Docker daemon.
    Show the answer

    Answer: d · To prevent specific files from being included in the build context sent to the Docker daemon.

    The .dockerignore file's main role is to instruct the Docker client to omit specified files and directories from the build context before it's archived and sent to the daemon. While this can lead to smaller final images (C) if those files would have been copied, its direct and primary function is to filter the build context itself, improving build speed and security.

    Read the full bite: The .dockerignore File: Keep Your Build Context Lean

18. Question 18 of 30

    What problem do Docker multi-stage builds primarily solve for application deployment?

    • aThe performance overhead of running applications within a containerized environment.
    • bThe excessive size of Docker images due to included build-time dependencies.
    • cThe difficulty of integrating continuous integration/continuous deployment pipelines.
    • dThe complexity of managing multiple Dockerfiles for different environments.
    Show the answer

    Answer: b · The excessive size of Docker images due to included build-time dependencies.

    The card clearly states that multi-stage builds exist because "creating small Docker images was clumsy" and they "keeps images small by excluding build-time dependencies," dramatically reducing the final image size. While consolidating Dockerfile logic (D) is a side benefit, the primary problem addressed is image bloat.

    Read the full bite: Docker Multi-stage Builds: Slimmer, Faster Images

19. Question 19 of 30

    What is the primary benefit of integrating Docker image scanning into a CI/CD pipeline?

    • aIt encrypts sensitive configuration data within the image for enhanced security.
    • bIt verifies the functional correctness and performance of the application code.
    • cIt acts as a gate to prevent images with known security flaws from reaching deployment.
    • dIt automatically patches identified vulnerabilities in base images and libraries.
    Show the answer

    Answer: c · It acts as a gate to prevent images with known security flaws from reaching deployment.

    The card states that in a CI/CD pipeline, scanning acts as a gate to automatically fail builds containing critical vulnerabilities, preventing them from being deployed. Option D is incorrect because scanning identifies vulnerabilities; it does not automatically remediate or patch them.

    Read the full bite: Docker Image Scanning: A Background Check for Your Code

20. Question 20 of 30

    What is the main limitation of using Docker Compose alone for production environments?

    • aIt cannot define complex multi-service applications.
    • bIt does not support persistent data storage for stateful services.
    • cIt lacks features for high availability and automatic scaling.
    • dIt requires manual network configuration for inter-service communication.
    Show the answer

    Answer: c · It lacks features for high availability and automatic scaling.

    The card explicitly states that Docker Compose should not be used alone for production because it lacks high-availability, fault tolerance, load balancing, and auto-scaling. The other options describe functionalities that Docker Compose is designed to handle, such as defining multi-service applications, managing networks, and supporting persistent data via volumes.

    Read the full bite: The docker-compose.yml File: Your App's Blueprint

21. Question 21 of 30

    What is the primary benefit of defining services in a Docker Compose file for an application?

    • aIt enables automatic scaling and high availability for production deployments.
    • bIt eliminates the need for Dockerfiles by allowing direct container creation from source code.
    • cIt provides a declarative way to manage multiple interconnected containers as a single application.
    • dIt offers a web-based dashboard for monitoring and controlling individual container processes.
    Show the answer

    Answer: c · It provides a declarative way to manage multiple interconnected containers as a single application.

    The card states that Docker Compose's purpose is to "manage multi-container applications declaratively" and allows you to "spin up a complete, interconnected environment with a single command." Option A describes features of production orchestration tools like Kubernetes, which the card explicitly states Compose is not.

    Read the full bite: Docker Compose Services: Defining Your App's Components

22. Question 22 of 30

    For which scenario is Docker Compose most effectively utilized?

    • aDeploying and managing a large-scale, fault-tolerant application across multiple production servers.
    • bBuilding and pushing Docker images to a remote registry for distribution.
    • cMonitoring the performance and resource usage of individual Docker containers in production.
    • dOrchestrating a multi-service application stack for local development and automated testing.
    Show the answer

    Answer: d · Orchestrating a multi-service application stack for local development and automated testing.

    Docker Compose is explicitly designed for orchestrating multi-container applications in local development environments and for automated testing, simplifying the setup of complex service dependencies. It is not recommended for large-scale production deployments, which require more advanced cluster orchestrators.

    Read the full bite: Docker Compose: Orchestrate Multi-Container Apps Locally

23. Question 23 of 30

    In a Docker Compose application, how should one service (e.g., 'web') typically refer to another service (e.g., 'database') to establish a connection?

    • aBy using the IP address assigned to the 'database' container.
    • bBy using the public IP address of the Docker host machine.
    • cBy using 'localhost' as the hostname.
    • dBy using the service name 'database' as the hostname.
    Show the answer

    Answer: d · By using the service name 'database' as the hostname.

    Docker Compose creates a private network with a built-in DNS service, allowing services to communicate by using their defined service names as hostnames. The card explicitly states that using 'localhost' is a footgun, as it refers to the container itself, not other services.

    Read the full bite: Docker Compose Networking: How Services Talk to Each Other

24. Question 24 of 30

    What type of configuration is generally NOT recommended to be managed directly via environment variables in docker-compose.yml or .env files for production deployments?

    • aHostnames or ports for internal service communication within the Compose network.
    • bDatabase connection strings that vary between development and staging environments.
    • cFeature flags that control application behavior in different environments.
    • dSensitive production credentials, such as private API keys or database passwords.
    Show the answer

    Answer: d · Sensitive production credentials, such as private API keys or database passwords.

    The card explicitly advises against storing sensitive production secrets directly in docker-compose.yml or .env files for production, recommending dedicated secrets management tools instead. The other options describe valid and recommended uses for environment variables in Docker Compose.

    Read the full bite: Environment Variables in Docker Compose

25. Question 25 of 30

    A developer uses depends_on to ensure a web app starts after its database. What problem might still occur?

    • aThe web app might attempt to connect to the database before it's ready to accept connections.
    • bThe database container might not be stopped gracefully when docker compose down is run.
    • cThe web app's container might not be able to access the database container's network.
    • dThe database service might not start at all if another service has a circular dependency.
    Show the answer

    Answer: a · The web app might attempt to connect to the database before it's ready to accept connections.

    The card states that depends_on only waits for the container to start, not for the application inside to be ready. Therefore, the web app could try to connect before the database is fully initialized. For true readiness, a healthcheck with condition: service_healthy is needed, which is not guaranteed by depends_on alone.

    Read the full bite: Docker Compose: Control Startup with `depends_on`

26. Question 26 of 30

    To ensure a Docker Compose service's image is rebuilt from its Dockerfile after changes, which command is necessary?

    • adocker build followed by docker-compose up
    • bdocker-compose up
    • cThe image is automatically rebuilt upon Dockerfile modification
    • ddocker-compose up --build
    Show the answer

    Answer: d · docker-compose up --build

    The `docker-compose up --build` command explicitly instructs Compose to rebuild images defined with a `build:` key. Running `docker-compose up` without `--build` will use existing images, even if the Dockerfile has been modified, which is a common 'footgun'.

    Read the full bite: Building Images with Docker Compose

27. Question 27 of 30

    What is the primary benefit of using Docker Compose profiles?

    • aTo manage configurations for fundamentally different application stacks within a single compose.yaml file.
    • bTo apply major configuration changes, like resource limits or network settings, uniformly across the majority of services in a project.
    • cTo define and selectively activate optional groups of services, such as debugging tools or environment-specific setups, from a unified compose.yaml.
    • dTo ensure that all services defined in the compose.yaml file are always launched together, simplifying deployment.
    Show the answer

    Answer: c · To define and selectively activate optional groups of services, such as debugging tools or environment-specific setups, from a unified compose.yaml.

    Profiles are designed to enable or disable subsets of services (e.g., debugging tools, dev-specific setups) within a single compose.yaml file, reducing complexity. Option A describes a scenario where separate compose.yaml files are explicitly recommended instead of profiles.

    Read the full bite: Docker Compose Profiles: Activate Service Groups

28. Question 28 of 30

    What is the primary benefit of using extended Docker Compose files for different environments?

    • aTo automatically deploy and manage container orchestration on platforms like Kubernetes.
    • bTo define entirely distinct applications that share no common services.
    • cTo manage environment-specific configuration variations for a single application efficiently.
    • dTo enforce identical resource limits and network settings across all development and production services.
    Show the answer

    Answer: c · To manage environment-specific configuration variations for a single application efficiently.

    The card states that extending Compose files provides a "clean, DRY (Don't Repeat Yourself) way to manage these variations" for a single application across different environments. Option B is incorrect because the card advises against using this for entirely separate applications. Option A is incorrect as Compose is not an orchestrator like Kubernetes, but can be outgrown by it. Option D is incorrect because the purpose is to manage variations, not to enforce identical settings.

    Read the full bite: Extending Compose Files for Different Environments

29. Question 29 of 30

    When using Docker Compose Secrets, how does an application inside a service typically retrieve the sensitive information?

    • aIt reads the secret value from an environment variable automatically set by Compose.
    • bIt accesses a file mounted by Compose into a specific directory within the container.
    • cIt fetches the secret from a dedicated Compose secrets API endpoint.
    • dIt retrieves the secret directly from the docker-compose.yml file at runtime.
    Show the answer

    Answer: b · It accesses a file mounted by Compose into a specific directory within the container.

    Docker Compose Secrets are mounted as files into the container's filesystem at /run/secrets/<secret_name>, which the application then reads. Option A is a common misconception; applications must read secrets from these files, not directly from environment variables, to maintain security.

    Read the full bite: Docker Compose Secrets: Keep Credentials Out of Your Code

30. Question 30 of 30

    What is Docker Hub's primary role within the Docker ecosystem?

    • aTo provide a visual tool for building Docker images from Dockerfiles.
    • bTo manage the runtime execution and networking of Docker containers on a host machine.
    • cTo enable the automated deployment and scaling of multi-container applications.
    • dTo act as a central, public registry for sharing and discovering container images.
    Show the answer

    Answer: d · To act as a central, public registry for sharing and discovering container images.

    Docker Hub is explicitly defined as a "central repository for finding, storing, and sharing pre-built software containers." It serves as the primary distribution channel for both official and community-contributed images, making it a central registry. The other options describe functions of other Docker components or related technologies like orchestration.

    Read the full bite: Docker Hub: The Central Repository for Containers