Top 30 Intermediate Docker & Kubernetes Concepts Quiz

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   Which statement accurately describes a key characteristic of Linux namespaces?

   • aTheir primary purpose is to provide robust hardware-level security isolation for highly untrusted workloads.
   • bEach namespace operates with its own dedicated operating system kernel, separate from the host.
   • cThey enable processes to have isolated views of system resources while sharing the host's single kernel.
   • dThey allow processes within different namespaces to freely access each other's network interfaces and process IDs.
   Show the answer

   Answer: c · They enable processes to have isolated views of system resources while sharing the host's single kernel.

   Linux namespaces provide isolated environments for resources like process IDs and network interfaces, but they all share the host's single kernel. This is a fundamental difference from virtual machines, which run their own independent kernels. The card explicitly states that namespaces are not a sole security boundary for untrusted code.

   Read the full bite: Linux Namespaces: A Virtual Slice of the OS

2. Question 2 of 30

   What is the primary problem that Linux cgroups were designed to solve in a multi-tenant server environment?

   • aEnsuring that processes can communicate securely across different isolation boundaries.
   • bIsolating network traffic to prevent interference between different tenants on the same host.
   • cPreventing a single application from consuming all available CPU or memory, thus starving other processes.
   • dProviding a mechanism for applications to dynamically request more resources as needed.
   Show the answer

   Answer: c · Preventing a single application from consuming all available CPU or memory, thus starving other processes.

   The card explicitly states that cgroups were introduced because 'a single runaway process could consume all available CPU or memory, starving every other process and crashing the system.' While cgroups are related to container isolation, their primary role is resource limiting, not network traffic isolation or secure communication.

   Read the full bite: Linux cgroups: Resource Fences for Processes

3. Question 3 of 30

   Which component in a Kubernetes node is directly responsible for pulling container images and setting up their isolated execution environment?

   • aThe container runtime, which executes containers based on instructions from the kubelet
   • bThe kubectl command-line tool, used by developers to deploy applications
   • cThe Kubernetes API Server, which orchestrates all cluster operations
   • dThe kubelet, which manages Pods on the node and communicates with the runtime
   Show the answer

   Answer: a · The container runtime, which executes containers based on instructions from the kubelet

   The container runtime is the low-level engine that directly pulls images and creates isolated container environments using features like namespaces and cgroups. The kubelet acts as a 'transmission,' translating Kubernetes commands into instructions for the runtime, but does not perform the execution itself.

   Read the full bite: Container Runtime: The Engine That Runs Your Containers

4. Question 4 of 30

   A team avoids public Docker images in their non-Docker runtime, believing the format is proprietary to Docker. Which statement corrects this misunderstanding?

   • aDocker images are OCI-compliant bundles that run on any compliant runtime without conversion.
   • bThe OCI Runtime Specification guarantees identical performance and resource usage across all compliant engines.
   • cNon-Docker runtimes must use a compatibility shim to translate Docker image metadata before execution.
   • dDocker images contain proprietary extensions that make them incompatible with standard OCI runtimes.
   Show the answer

   Answer: a · Docker images are OCI-compliant bundles that run on any compliant runtime without conversion.

   The card calls this belief a footgun, emphasizing that Docker images are OCI-compliant bundles executable by any compliant runtime, much like USB-C devices work with any compliant charger. Option C invents a translation step that the standard eliminates, and option B confuses interface compatibility with performance guarantees.

   Read the full bite: OCI: The USB-C of Containers

5. Question 5 of 30

   What fundamental problem are Docker Volumes primarily designed to solve?

   • aThe loss of data written inside a container's filesystem when the container is removed.
   • bThe difficulty of sharing application source code between multiple containers.
   • cThe need to reduce the size of Docker images by storing large binaries externally.
   • dThe challenge of providing temporary, isolated storage that is automatically purged upon container exit.
   Show the answer

   Answer: a · The loss of data written inside a container's filesystem when the container is removed.

   Docker Volumes exist because data written directly into a container's filesystem is lost when the container is removed, which is problematic for stateful applications. Option D describes the ephemeral nature of containers, which is the problem volumes counteract, not what they provide.

   Read the full bite: Docker Volumes: Persistent Data for Ephemeral Containers

6. Question 6 of 30

   For multi-service applications on a single host, why are user-defined bridge networks preferred over the default bridge network?

   • aThey automatically expose all container ports to the Docker host without explicit mapping.
   • bThey provide an internal DNS service for containers to resolve each other by name.
   • cThey allow containers to directly access the host's network interfaces for better performance.
   • dThey offer enhanced security isolation between individual containers.
   Show the answer

   Answer: b · They provide an internal DNS service for containers to resolve each other by name.

   The card explicitly states that user-defined bridge networks are superior because they provide an internal DNS service, allowing containers to find each other by name, which is essential for multi-service applications. The default bridge network lacks this feature, making it brittle due to changing IP addresses.

   Read the full bite: Docker Networking: How Containers Talk to Each Other

7. Question 7 of 30

   To maximize Docker build cache efficiency, how should Dockerfile instructions be ordered?

   • aGroup all RUN commands together at the end to reduce the total number of image layers.
   • bUse the --no-cache flag for every build to ensure all layers are always fresh.
   • cArrange instructions from least frequently changing to most frequently changing, top to bottom.
   • dPlace instructions that modify application source code (e.g., COPY .) at the very beginning.
   Show the answer

   Answer: c · Arrange instructions from least frequently changing to most frequently changing, top to bottom.

   The card advises placing infrequently changing instructions at the top and frequently changing ones as late as possible to optimize cache. Placing frequently changing instructions early, as in option D, is identified as a 'footgun' that invalidates the cache for subsequent steps unnecessarily.

   Read the full bite: Docker Build Cache: Don't Rebuild What Hasn't Changed

8. Question 8 of 30

   What is the primary function of a .dockerignore file in a Docker project?

   • aTo optimize the caching of layers during the Docker image build process.
   • bTo specify which files should be copied into the final Docker image.
   • cTo reduce the overall size of the final Docker image.
   • dTo prevent specific files from being included in the build context sent to the Docker daemon.
   Show the answer

   Answer: d · To prevent specific files from being included in the build context sent to the Docker daemon.

   The .dockerignore file's main role is to instruct the Docker client to omit specified files and directories from the build context before it's archived and sent to the daemon. While this can lead to smaller final images (C) if those files would have been copied, its direct and primary function is to filter the build context itself, improving build speed and security.

   Read the full bite: The .dockerignore File: Keep Your Build Context Lean

9. Question 9 of 30

   In a Docker Compose application, how should one service (e.g., 'web') typically refer to another service (e.g., 'database') to establish a connection?

   • aBy using the IP address assigned to the 'database' container.
   • bBy using the public IP address of the Docker host machine.
   • cBy using 'localhost' as the hostname.
   • dBy using the service name 'database' as the hostname.
   Show the answer

   Answer: d · By using the service name 'database' as the hostname.

   Docker Compose creates a private network with a built-in DNS service, allowing services to communicate by using their defined service names as hostnames. The card explicitly states that using 'localhost' is a footgun, as it refers to the container itself, not other services.

   Read the full bite: Docker Compose Networking: How Services Talk to Each Other

10. Question 10 of 30

    What type of configuration is generally NOT recommended to be managed directly via environment variables in docker-compose.yml or .env files for production deployments?

    • aHostnames or ports for internal service communication within the Compose network.
    • bDatabase connection strings that vary between development and staging environments.
    • cFeature flags that control application behavior in different environments.
    • dSensitive production credentials, such as private API keys or database passwords.
    Show the answer

    Answer: d · Sensitive production credentials, such as private API keys or database passwords.

    The card explicitly advises against storing sensitive production secrets directly in docker-compose.yml or .env files for production, recommending dedicated secrets management tools instead. The other options describe valid and recommended uses for environment variables in Docker Compose.

    Read the full bite: Environment Variables in Docker Compose

11. Question 11 of 30

    A developer uses depends_on to ensure a web app starts after its database. What problem might still occur?

    • aThe web app might attempt to connect to the database before it's ready to accept connections.
    • bThe database container might not be stopped gracefully when docker compose down is run.
    • cThe web app's container might not be able to access the database container's network.
    • dThe database service might not start at all if another service has a circular dependency.
    Show the answer

    Answer: a · The web app might attempt to connect to the database before it's ready to accept connections.

    The card states that depends_on only waits for the container to start, not for the application inside to be ready. Therefore, the web app could try to connect before the database is fully initialized. For true readiness, a healthcheck with condition: service_healthy is needed, which is not guaranteed by depends_on alone.

    Read the full bite: Docker Compose: Control Startup with `depends_on`

12. Question 12 of 30

    To ensure a Docker Compose service's image is rebuilt from its Dockerfile after changes, which command is necessary?

    • adocker build followed by docker-compose up
    • bdocker-compose up
    • cThe image is automatically rebuilt upon Dockerfile modification
    • ddocker-compose up --build
    Show the answer

    Answer: d · docker-compose up --build

    The `docker-compose up --build` command explicitly instructs Compose to rebuild images defined with a `build:` key. Running `docker-compose up` without `--build` will use existing images, even if the Dockerfile has been modified, which is a common 'footgun'.

    Read the full bite: Building Images with Docker Compose

13. Question 13 of 30

    What is a key advantage of using Amazon EC2 for deploying applications, especially concerning resource management?

    • aIt completely eliminates the need for any operating system or software configuration.
    • bIt ensures that all application data is automatically replicated across all AWS regions globally.
    • cIt allows dynamic scaling of computing resources to match fluctuating demand.
    • dIt provides a fixed, upfront cost model, simplifying budget planning for infrastructure.
    Show the answer

    Answer: c · It allows dynamic scaling of computing resources to match fluctuating demand.

    The card emphasizes EC2's ability to "add or remove server instances to match demand" for "fluctuating computing needs," which is dynamic scaling. EC2 operates on a pay-per-use model, meaning costs are variable rather than fixed upfront.

    Read the full bite: Amazon EC2: Rentable Virtual Servers on AWS

14. Question 14 of 30

    What is the primary advantage of configuring a Virtual repository in Google Cloud's Artifact Registry?

    • aIt exclusively stores private, company-specific artifacts uploaded directly.
    • bIt serves as a caching proxy to improve the reliability and speed of public upstream repositories.
    • cIt automatically scans all stored artifacts for potential security vulnerabilities.
    • dIt provides a unified endpoint for accessing artifacts from multiple underlying repositories.
    Show the answer

    Answer: d · It provides a unified endpoint for accessing artifacts from multiple underlying repositories.

    A Virtual repository's main benefit is to group multiple standard and remote repositories behind a single endpoint, simplifying artifact access for developers. Option B describes a Remote repository, which is a component that a Virtual repository can group, but not the primary advantage of the Virtual repository itself.

    Read the full bite: Artifact Registry: Google's Universal Package Manager

15. Question 15 of 30

    Why is using an image digest crucial for production deployments, especially compared to using a mutable tag?

    • aDigests encrypt the image content, enhancing security during transmission.
    • bDigests guarantee that the exact, tested version of an image is deployed, preventing unintended updates.
    • cDigests result in smaller image sizes and faster deployment times due to optimized hashing algorithms.
    • dDigests automatically pull the most recent and secure version of an image available in the registry.
    Show the answer

    Answer: b · Digests guarantee that the exact, tested version of an image is deployed, preventing unintended updates.

    Digests provide an immutable reference, ensuring that the specific, tested version of an image is consistently deployed, which is vital for reproducibility and stability in production. Option D is incorrect because digests prevent automatic updates; they pin an image to a specific, unchanging version, which is the opposite of automatically pulling the 'most recent' version.

    Read the full bite: Image Digest: The Immutable Image Identifier

16. Question 16 of 30

    A company's CI/CD system frequently pulls public Docker images, leading to slow builds and rate limit issues. Which statement accurately describes the role of a Docker Registry Mirror in this scenario?

    • aIt ensures all image pulls are verified for authenticity using Docker Content Trust before caching.
    • bIt acts as a read-only cache for public images, speeding up subsequent pulls and avoiding rate limits.
    • cIt allows the CI/CD system to host its own private, custom-built images locally.
    • dIt enables docker push operations to store frequently used public images on the local network.
    Show the answer

    Answer: b · It acts as a read-only cache for public images, speeding up subsequent pulls and avoiding rate limits.

    A Docker Registry Mirror is specifically designed as a read-only pull-through cache for public images, which speeds up subsequent pulls and helps avoid rate limits, as stated in the card. Option C describes the function of a full-fledged private registry, not a mirror, which cannot host private images.

    Read the full bite: Docker Registry Mirror: A Local Cache for Faster Pulls

17. Question 17 of 30

    How do Kubernetes components, such as the scheduler or controller manager, typically interact with the cluster's state stored in etcd?

    • aThey use a dedicated etcd client to bypass the API server for faster state synchronization.
    • bThey write their desired state directly to etcd and read observed state from it.
    • cThey directly query etcd's leader node to retrieve the current desired state.
    • dThey communicate with the Kubernetes API server, which acts as the sole intermediary for all etcd operations.
    Show the answer

    Answer: d · They communicate with the Kubernetes API server, which acts as the sole intermediary for all etcd operations.

    The card explicitly states that the Kubernetes API server is the primary client for etcd, mediating all reads and writes. Other components interact with the cluster state by communicating with the API server, not by directly accessing etcd, which ensures validation and consistency.

    Read the full bite: etcd: Kubernetes's Single Source of Truth

18. Question 18 of 30

    How does the Kubelet primarily receive instructions for managing Pods on its assigned node?

    • aBy retrieving Pod specifications from the cluster's etcd database.
    • bBy continuously watching the Kubernetes API server for Pod assignments.
    • cBy receiving direct commands from the kubectl command-line utility.
    • dBy directly monitoring local configuration files for Pod definitions.
    Show the answer

    Answer: b · By continuously watching the Kubernetes API server for Pod assignments.

    The Kubelet's core function involves continuously watching the API server for Pods scheduled to its node. It does not directly read local files, receive commands from kubectl, or query etcd; these interactions are mediated by the API server.

    Read the full bite: Kubelet: The Node Agent of Kubernetes

19. Question 19 of 30

    A web application is running but temporarily loses its connection to the backend database. To prevent new requests from being routed to this unhealthy instance without restarting it, which Kubernetes probe should be configured to fail?

    • aThe Startup probe, to ensure the application initializes correctly.
    • bBoth Liveness and Readiness probes, to ensure full isolation and recovery.
    • cThe Readiness probe, to temporarily remove the pod from service endpoints.
    • dThe Liveness probe, to signal the need for a container restart.
    Show the answer

    Answer: c · The Readiness probe, to temporarily remove the pod from service endpoints.

    The Readiness probe is designed to stop sending traffic to a pod when it's not ready to serve requests, such as when a database connection is lost, without restarting the container. A Liveness probe failure would cause an unnecessary restart, as the application itself is still running and capable of recovery once again connecting to the database.

    Read the full bite: Kubernetes Probes: Liveness, Readiness, and Startup

20. Question 20 of 30

    Which statement accurately describes the execution behavior of Init Containers in a Kubernetes Pod?

    • aThey start after the main application containers to perform post-startup cleanup tasks.
    • bThey execute in a defined sequence, and each must complete successfully before the next or the main application starts.
    • cThey are primarily used for logging and metrics collection during the application's runtime.
    • dThey run concurrently with the main application containers to provide auxiliary services.
    Show the answer

    Answer: b · They execute in a defined sequence, and each must complete successfully before the next or the main application starts.

    Init containers are designed to run sequentially and must complete successfully before the main application containers are started, acting as a pre-flight checklist. Options A and C describe sidecar containers, which run alongside the main application for ongoing tasks, while option A incorrectly states they run after the main application.

    Read the full bite: Init Containers: Setup Tasks Before Your Main App Runs

21. Question 21 of 30

    To prevent a Kubernetes CronJob from initiating a new task while a previous instance is still running, which configuration is most critical?

    • aSetting the activeDeadlineSeconds in the jobTemplate to terminate long-running pods.
    • bConfiguring the concurrencyPolicy to define how overlapping job executions are managed.
    • cSpecifying a successfulJobsHistoryLimit to clean up old successful tasks.
    • dEnsuring the schedule allows ample time for task completion before the next trigger.
    Show the answer

    Answer: b · Configuring the concurrencyPolicy to define how overlapping job executions are managed.

    The card highlights concurrency as a 'footgun' and explicitly mentions that setting the 'concurrencyPolicy' to 'Forbid' is a 'critical configuration' to prevent new tasks from starting if a previous one is still running. While a well-chosen schedule is beneficial, the 'concurrencyPolicy' directly controls the CronJob's behavior regarding overlapping executions, unlike 'activeDeadlineSeconds' which only terminates individual pods within a job.

    Read the full bite: Kubernetes CronJob: Scheduled Tasks in Your Cluster

22. Question 22 of 30

    What is the primary advantage of using Kubernetes Ingress for exposing multiple services compared to using a separate Service of type LoadBalancer for each?

    • aIt provides native support for routing non-HTTP/S protocols such as raw TCP or UDP.
    • bIt automatically assigns a unique public IP address to each service it exposes.
    • cIt primarily encrypts all internal cluster traffic between different microservices.
    • dIt consolidates external HTTP/S traffic routing for multiple services through a single entry point, reducing infrastructure costs and management overhead.
    Show the answer

    Answer: d · It consolidates external HTTP/S traffic routing for multiple services through a single entry point, reducing infrastructure costs and management overhead.

    Ingress's core purpose is to consolidate external HTTP/S traffic routing for multiple services through a single entry point, which significantly reduces costs by minimizing the number of expensive cloud load balancers. Option B is incorrect because Ingress aims to reduce the number of public IP addresses, not assign one to each service.

    Read the full bite: Kubernetes Ingress: The Cluster's Smart Receptionist

23. Question 23 of 30

    Which of the following is the primary advantage of using an Ingress Controller for exposing applications in a Kubernetes cluster?

    • aIt encrypts all internal network traffic between pods, enhancing cluster security.
    • bIt automatically scales backend services based on traffic load and resource utilization.
    • cIt enables advanced HTTP/S routing from a single public endpoint, reducing cost and complexity.
    • dIt provides a dedicated external IP address for each individual service, simplifying access.
    Show the answer

    Answer: c · It enables advanced HTTP/S routing from a single public endpoint, reducing cost and complexity.

    The card states an Ingress Controller provides "a single, intelligent, and cost-effective entry point for all external HTTP and HTTPS traffic" and is used for "host-based routing... and path-based routing." Option D is incorrect because the card explicitly mentions that exposing services with "a unique LoadBalancer per service is expensive and complex," which an Ingress Controller aims to avoid by providing a single entry point.

    Read the full bite: Ingress Controller: Your Cluster's Smart Reverse Proxy

24. Question 24 of 30

    What inherent characteristic of a Kubernetes LoadBalancer Service makes it potentially expensive when exposing many applications?

    • aIt provisions a dedicated cloud load balancer for each individual service.
    • bIt requires manual configuration of NodePorts for each exposed service.
    • cIt frequently changes its public IP address, incurring re-configuration costs.
    • dIt only supports internal-only IP addresses, requiring additional proxying.
    Show the answer

    Answer: a · It provisions a dedicated cloud load balancer for each individual service.

    The card states, "Each LoadBalancer Service typically provisions a new, dedicated, and billable cloud load balancer, which gets expensive quickly." This dedicated provisioning per service is the primary reason for potential high costs. LoadBalancer Services provide stable public IPs and automatically handle NodePort configuration, making those options incorrect.

    Read the full bite: Kubernetes LoadBalancer: Your App's Public Entry Point

25. Question 25 of 30

    What is the main advantage of using a projected volume for configuration over traditional environment variables?

    • aIt is the recommended method for managing extremely large configuration files efficiently.
    • bIt guarantees immediate application of configuration changes to running Pods.
    • cIt offers enhanced encryption and security for sensitive configuration data compared to Secrets.
    • dIt enables configuration updates to be applied to a running Pod without requiring a restart.
    Show the answer

    Answer: d · It enables configuration updates to be applied to a running Pod without requiring a restart.

    The card states that projected volumes provide a way to "push configuration updates to running Pods without a restart," which is their primary benefit over environment variables. Option B is incorrect because the card explicitly mentions that "updates aren't instant; there's a delay."

    Read the full bite: Projected Volumes: Mount Config as Live Files

26. Question 26 of 30

    Which task is NOT suitable for the Kubernetes Downward API?

    • aA microservice querying the status of other Pods in its Deployment.
    • bA service registering itself using its own Pod's IP address.
    • cAn application adjusting its behavior based on its assigned CPU limits.
    • dA logging agent adding the Pod's namespace to its structured output.
    Show the answer

    Answer: a · A microservice querying the status of other Pods in its Deployment.

    The Downward API is designed solely for a Pod to gain information about itself, such as its own name, IP, or resource limits. It cannot be used to query information about other Pods or any other Kubernetes objects; such cluster-wide information requires interacting with the main Kubernetes API server.

    Read the full bite: The Kubernetes Downward API: Pod Self-Awareness

27. Question 27 of 30

    What is the primary reason to mark a Kubernetes Secret or ConfigMap as immutable?

    • aTo enable direct, in-place modification of configuration values by cluster operators.
    • bTo enhance the encryption of sensitive data within the Secret or ConfigMap.
    • cTo reduce the load on the Kubernetes API server by eliminating constant polling for changes.
    • dTo allow Pods to automatically update their configuration without needing a redeployment.
    Show the answer

    Answer: c · To reduce the load on the Kubernetes API server by eliminating constant polling for changes.

    The card explicitly states that immutable objects reduce API server load by eliminating the need for Kubernetes to constantly check for updates. Option D is incorrect because immutable objects prevent automatic updates; changes require creating a new object and rolling out new Pods.

    Read the full bite: Immutable Secrets & ConfigMaps: Write-Once Configuration

28. Question 28 of 30

    When managing Kubernetes configurations across dev, staging, and production, which tool is best for applying minor, declarative environment-specific changes to a shared base without complex templating?

    • aHelm, because it provides powerful templating capabilities for all environments.
    • bA custom CI/CD pipeline script that uses sed to modify YAML files.
    • cDirectly using kubectl apply -f with separate YAML files for each environment.
    • dKustomize, as it uses overlays to patch a base configuration declaratively.
    Show the answer

    Answer: d · Kustomize, as it uses overlays to patch a base configuration declaratively.

    Kustomize is specifically designed for applying slight, declarative variations to a base configuration using overlays, which aligns with the scenario described. Helm, while powerful, is intended for configurations requiring complex logic or conditionals, which Kustomize aims to avoid.

    Read the full bite: Kustomize: Template-Free Kubernetes Configuration

29. Question 29 of 30

    For which scenario is configuring a custom Kubernetes ServiceAccount for a Pod most appropriate?

    • aWhen the application running in the Pod requires programmatic interaction with the Kubernetes API.
    • bWhen the Pod needs to store sensitive configuration data securely within its filesystem.
    • cWhen the Pod's application needs to access a database outside the cluster.
    • dWhen the Pod needs to expose a secure HTTPS endpoint to external clients.
    Show the answer

    Answer: a · When the application running in the Pod requires programmatic interaction with the Kubernetes API.

    The card states that a custom ServiceAccount is used "whenever a Pod needs to programmatically interact with the Kubernetes API." While a ServiceAccount can enable a Pod to read Secrets (which store sensitive data), its core purpose is authentication to the API, not the secure storage of data within the Pod's filesystem itself.

    Read the full bite: Kubernetes ServiceAccounts: Identity for Pods

30. Question 30 of 30

    In which scenario would you typically not use a StorageClass for Kubernetes storage provisioning?

    • aWhen enabling self-service storage for development teams.
    • bWhen integrating pre-existing, manually managed storage resources.
    • cWhen dynamically creating storage volumes for stateful applications.
    • dWhen abstracting underlying storage infrastructure from applications.
    Show the answer

    Answer: b · When integrating pre-existing, manually managed storage resources.

    The card states that StorageClasses are not typically used when working with pre-existing, manually provisioned storage volumes; instead, PersistentVolume objects would be created manually. The other options describe key benefits or use cases for StorageClasses.

    Read the full bite: Kubernetes StorageClass: A Menu for Your Data