Docker and Containers

• A. To permanently store application data on disk
• B. To package an application and its dependencies into an isolated, portable unit ✓
• C. To replace the host operating system kernel entirely
• D. To manage physical network hardware in a data center

Why: A Docker container bundles an application together with its libraries, runtime, and configuration so it runs consistently across different environments. It is isolated from other containers and the host, making it portable.

• A. A container is a read-only template, and an image is a running instance of it
• B. An image is a read-only template, and a container is a runnable instance created from that image ✓
• C. Images and containers are the same thing used interchangeably
• D. A container must be built before an image can be created

Why: An image is a read-only blueprint containing the application and its dependencies. When you run an image, Docker creates a container, which is a live, writable instance of that image.

• A. docker fetch
• B. docker pull ✓
• C. docker download
• D. docker get

Why: The docker pull command retrieves an image from a registry such as Docker Hub. docker fetch, docker download, and docker get are not standard Docker CLI commands.

• A. docker-compose.yml
• B. Dockerfile ✓
• C. container.json
• D. build.config

Why: A Dockerfile is a text file containing step-by-step instructions such as FROM, COPY, RUN, and CMD that Docker follows to build an image. docker-compose.yml is used for orchestrating multiple services, not for building a single image.

• A. docker run -p 8080:80 nginx ✓
• B. docker start nginx 8080:80
• C. docker container nginx --port 80:8080
• D. docker build -p 8080:80 nginx

Why: The docker run command creates and starts a container, and the -p flag maps host ports to container ports in the form HOST:CONTAINER. The host port comes first, so 8080:80 maps host port 8080 to container port 80.

• A. BASE
• B. FROM ✓
• C. IMAGE
• D. START

Why: The FROM instruction sets the base image for subsequent instructions in the Dockerfile. Every Dockerfile must begin with a FROM instruction (aside from ARG declarations before it).

• A. To start a container when the image is launched
• B. To execute commands in a new layer during the image build ✓
• C. To copy files from the host into the image
• D. To expose a network port to the outside world

Why: RUN executes a command inside a new layer on top of the current image during the build process, and the result is committed as a new layer. For example, RUN apt-get update installs packages at build time.

• A. docker make -t myapp:1.0 .
• B. docker create myapp:1.0 .
• C. docker build -t myapp:1.0 . ✓
• D. docker image run myapp:1.0 .

Why: The docker build command creates an image from a Dockerfile. The -t flag assigns a name and optional tag, and the trailing period sets the build context to the current directory.

• A. So that images can be run without a Dockerfile
• B. So that unchanged layers can be reused, speeding up subsequent builds ✓
• C. So that containers can share memory at runtime
• D. So that images are automatically encrypted

Why: Docker caches each instruction's resulting layer. If an instruction and its inputs have not changed, Docker reuses the cached layer instead of rebuilding it, which makes rebuilds much faster.

• A. It makes the final image smaller in size
• B. It allows dependency installation layers to be cached when only source code changes ✓
• C. It automatically removes unused files from the image
• D. It prevents the container from accessing the internet

Why: Docker invalidates a layer's cache when its inputs change. By copying dependency manifests first and installing dependencies before copying the source code, the costly install step stays cached when only application code changes.

• A. docker build
• B. docker run ✓
• C. docker pull
• D. docker create-start

Why: docker run creates and starts a new container from a specified image in a single step. docker build creates images, docker pull downloads images, and docker create-start is not a valid Docker command.

• A. -i
• B. -t
• C. -d ✓
• D. -b

Why: The -d (detached) flag runs the container in the background and returns control to the terminal. -i keeps STDIN open, -t allocates a pseudo-TTY, and -b is not a valid flag for docker run.

• A. docker ps
• B. docker images
• C. docker ps -a ✓
• D. docker container list-stopped

Why: docker ps -a shows all containers, including stopped ones. docker ps alone shows only running containers, docker images lists images rather than containers, and docker container list-stopped is not a valid command.

• A. docker kill
• B. docker stop ✓
• C. docker rm
• D. docker pause

Why: docker stop sends a SIGTERM signal, allowing the container's process to shut down cleanly, and falls back to SIGKILL after a timeout. docker kill terminates immediately, docker rm removes a container, and docker pause suspends processes without stopping the container.

• A. It sets the image name
• B. It assigns a human-readable name to the container ✓
• C. It renames the Docker host
• D. It sets the container's hostname inside the network

Why: The --name flag gives the container a custom, human-readable name that you can use in later commands instead of the auto-generated ID or name. It does not change the image name, the host machine's name, or the internal hostname by default.

• A. host
• B. bridge ✓
• C. overlay
• D. none

Why: When no network is specified, Docker attaches the container to the default bridge network, which provides a private internal network on the host and allows containers to communicate with each other by IP address.

• A. It creates an isolated network with no external connectivity.
• B. It gives the container its own separate network stack with a private IP address.
• C. It removes the network namespace isolation so the container shares the host's network stack. ✓
• D. It connects containers across multiple Docker hosts in a cluster.

Why: With the host driver, the container does not get its own network namespace and instead uses the host's networking directly, so ports exposed by the container are bound on the host's interfaces without needing -p mappings.

• A. docker network add app-net
• B. docker network create app-net ✓
• C. docker create network app-net
• D. docker bridge new app-net

Why: The correct syntax is 'docker network create <name>'. Other subcommands like 'docker network ls' and 'docker network rm' follow the same pattern.

• A. They allow containers to resolve each other by container name through built-in DNS. ✓
• B. They automatically assign public IP addresses to containers.
• C. They remove the need for port publishing entirely.
• D. They encrypt all traffic between containers by default.

Why: User-defined bridge networks provide automatic DNS-based service discovery, so containers on the same network can reach each other by name. The default bridge network does not offer this feature.

• A. -p 80:8080 ✓
• B. --expose 8080:80
• C. -P 8080
• D. --network 80:8080

Why: The -p flag uses the format host_port:container_port, so -p 80:8080 maps host port 80 to container port 8080. The --expose flag only documents ports and does not publish them.

• A. To limit the CPU usage of a container
• B. To persist data generated by and used by containers beyond the container's lifecycle
• C. To build Docker images faster
• D. To network containers together on the same host

Why: Volumes store data outside the container's writable layer, so the data survives when the container is removed.

• A. docker volume create app-data ✓
• B. docker container create app-data
• C. docker image create app-data
• D. docker mount app-data

Why: The docker volume create command creates a new named volume that Docker manages.

• A. It is automatically moved to a volume
• B. It is backed up to the Docker Hub registry
• C. It is permanently deleted along with the container ✓
• D. It remains available to any new container automatically

Why: The writable layer is tied to the container, so removing the container deletes its data unless that data was stored in a volume or bind mount.

• A. -p db-data:/var/lib/mysql
• B. -v db-data:/var/lib/mysql ✓
• C. -e db-data:/var/lib/mysql
• D. -d db-data:/var/lib/mysql

Why: The -v (or --volume) flag maps a volume or host path to a path inside the container using the format name:container_path.

• A. Bind mounts cannot store data, while named volumes can
• B. Named volumes are managed by Docker and stored in Docker's storage area, while bind mounts map a specific host file or directory ✓
• C. Bind mounts are only available on Windows hosts
• D. Named volumes can only be used with a single container at a time

Why: Named volumes are created and managed by Docker, whereas bind mounts link an exact path on the host filesystem into the container.

• A. To build individual Docker images from a Dockerfile
• B. To define and run multi-container applications using a single YAML file ✓
• C. To push Docker images to a remote registry
• D. To monitor resource usage of running containers

Why: Docker Compose lets you define the services, networks, and volumes of a multi-container application in one docker-compose.yml file and start them together with a single command.

• A. docker compose run --all
• B. docker compose start
• C. docker compose up -d ✓
• D. docker compose build --detach

Why: The command docker compose up -d creates and starts all defined services, with the -d flag running them in detached (background) mode.

• A. containers
• B. images
• C. services ✓
• D. networks

Why: Under the top-level services key, you define each container (called a service) along with its image or build context, ports, environment variables, and other settings.

• A. It copies files from one service to another
• B. It expresses startup order so one service starts before another ✓
• C. It shares environment variables between services
• D. It limits the CPU usage of a dependent service

Why: depends_on controls the order in which services are started. It only waits for the dependency to start, not for it to be fully ready, unless combined with health checks.

• A. docker compose stop
• B. docker compose delete
• C. docker compose down ✓
• D. docker compose clean

Why: docker compose down stops the running containers and removes the containers and networks that Compose created, while leaving named volumes intact unless the -v flag is used.

• A. To store running container logs
• B. To define the steps for building a Docker image ✓
• C. To manage network connections between hosts
• D. To schedule containers across a cluster

Why: A Dockerfile is a text file containing ordered instructions (such as FROM, COPY, RUN) that Docker uses to build an image.

• A. docker run -i nginx
• B. docker run -d nginx ✓
• C. docker run --rm nginx
• D. docker run -t nginx

Why: The -d (detach) flag runs the container in the background and returns control to the terminal immediately.

• A. Non-root users get faster disk access
• B. It limits the damage an attacker can do if they escape or compromise the container ✓
• C. Docker does not allow root processes to bind to ports
• D. It reduces the image size automatically

Why: If a process running as root is compromised, the attacker may gain elevated privileges. Running as a non-root user reduces the potential impact.

• A. It deletes the container and its image
• B. It sends a graceful shutdown signal to a running container ✓
• C. It pauses the container's memory state permanently
• D. It removes all stopped containers from the host

Why: docker stop sends SIGTERM to the main process, allowing a graceful shutdown, and falls back to SIGKILL after a timeout. The container itself is not deleted.

• A. Using the latest tag for every base image
• B. Installing all available development tools in the image
• C. Using minimal official base images and scanning images for known vulnerabilities ✓
• D. Disabling all logging inside the container

Why: Smaller base images contain fewer packages that can carry vulnerabilities, and regular image scanning identifies known CVEs before deployment.