DevOps Docker Flashcards

24 sample cards from the Docker deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. Compare Docker volumes and bind mounts.

   Volumes are stored in a Docker-managed area of the host filesystem (/var/lib/docker/volumes) and are fully managed by Docker. Bind mounts map any arbitrary host path into the container and depend on the host's directory structure. Volumes are the recommended mechanism.

2. What is a tmpfs mount?

   A tmpfs mount stores data in the host's memory only (not on disk). It is non-persistent and removed when the container stops; useful for sensitive or temporary data that should not be written to disk. Linux-only.

3. What command creates a named volume and how is it attached?

   docker volume create mydata creates it; attach with docker run -v mydata:/path/in/container ... (or --mount source=mydata,target=/path).

4. What is Docker Compose?

   Docker Compose is a tool for defining and running multi-container applications using a single YAML file (compose.yaml / docker-compose.yml). It lets you configure all services, networks, and volumes and start them with one command.

5. What command starts and stops a Compose application?

   docker compose up (add -d for detached) starts all services defined in the Compose file; docker compose down stops and removes the containers, networks, and (optionally) volumes it created.

6. In a Compose file, what do the 'services', 'volumes', and 'networks' top-level keys define?

   services defines the containers (images, ports, env, dependencies); volumes declares named volumes for persistent data; networks declares custom networks that services can join. By default Compose also creates one network for the project.

7. What does the 'depends_on' key control in Compose?

   It controls the startup/shutdown order of services, ensuring a service starts after its dependencies. Note: it waits for the container to start, not for the service inside to be 'ready' (use healthchecks/conditions for readiness).

8. What is Docker Swarm?

   Docker Swarm is Docker's native clustering and orchestration tool that turns a group of Docker hosts into a single virtual host, enabling deployment, scaling, and management of services across multiple nodes.

9. What are the two node roles in a Docker Swarm?

   Manager nodes (maintain cluster state, schedule tasks, and handle orchestration via the Raft consensus algorithm) and worker nodes (execute the tasks/containers assigned by managers). A node can be both.

10. In Swarm, what is the relationship between a service, a task, and a container?

    A service is the definition of the desired state (image, replicas). The service is divided into tasks, and each task is the scheduling slot that runs exactly one container. Replicas = number of tasks/containers.

11. How does Swarm achieve high availability of the cluster state?

    Manager nodes use the Raft consensus algorithm to replicate cluster state. A majority (quorum) of managers must be available; to tolerate $f$ manager failures you need $2f+1$ managers.

12. Name three Docker security best practices.

    Run containers as a non-root user, use minimal/official trusted base images and scan them for vulnerabilities, drop unneeded Linux capabilities, keep images updated, use read-only filesystems, and never bake secrets into images (use Docker secrets).

13. Why should containers avoid running as root, and how do you change the user?

    Running as root increases the blast radius if the container is compromised, since the container root can map to host root in some configs. Use the USER instruction in the Dockerfile (or --user at runtime) to run as a non-root, least-privilege user.

14. What are Docker secrets and namespaces' role in security?

    Docker secrets securely store and deliver sensitive data (passwords, keys) to swarm services without embedding them in images or env vars. Namespaces isolate each container's processes/network/users, and user namespaces can remap container root to an unprivileged host user.

15. How do you view a container's logs and what is the default logging driver?

    docker logs <container> (add -f to follow). The default logging driver is json-file, which writes stdout/stderr to JSON files on the host; other drivers include local, syslog, journald, fluentd, and awslogs.

16. What command shows a live stream of container resource usage statistics?

    docker stats — it displays a live view of CPU %, memory usage/limit, network I/O, and block I/O for running containers. docker top shows the processes running inside a container.

17. What is a common stack for monitoring and logging Dockerized applications?

    For metrics, Prometheus + cAdvisor + Grafana (collection, container metrics, dashboards). For centralized logs, the ELK/Elastic Stack (Elasticsearch, Logstash, Kibana) or EFK (with Fluentd).

18. How does Docker fit into a CI/CD pipeline?

    CI builds a Docker image from the committed code, runs tests inside containers for consistent environments, then pushes the tagged image to a registry; CD pulls that immutable image and deploys it to staging/production, ensuring identical artifacts across stages.

19. Why are Docker images well-suited as CI/CD deployment artifacts?

    Images are immutable, versioned (by tag/digest), and self-contained, so the exact artifact tested in CI is the one deployed — eliminating environment drift and enabling reliable rollbacks by redeploying a previous tag.

20. What is container orchestration and why is it needed?

    Orchestration automates the deployment, scaling, networking, load balancing, health management, and lifecycle of containers across a cluster of machines. It is needed because manually managing many containers across many hosts is impractical.

21. What is Kubernetes and how does it relate to Docker?

    Kubernetes (K8s) is an open-source container orchestration platform for automating deployment, scaling, and management of containerized applications. It runs Docker-built (OCI) container images across a cluster and is more feature-rich than Docker Swarm.

22. What is a Pod in Kubernetes?

    A Pod is the smallest deployable unit in Kubernetes — one or more tightly coupled containers that share the same network namespace (IP/port space) and storage volumes, and are always scheduled together on the same node.

23. Compare Docker Swarm and Kubernetes.

    Swarm is simpler, integrated with Docker, and easy to set up but has fewer features. Kubernetes is more complex with a steeper learning curve but offers richer features (auto-scaling, self-healing, large ecosystem) and is the industry-standard for large-scale orchestration.

24. What is a Kubernetes Deployment and a Service?

    A Deployment declares the desired state for a set of replica Pods and manages rolling updates and self-healing. A Service provides a stable network endpoint (and load balancing) to access a dynamic set of Pods, since Pod IPs change.

What this deck covers

Docker flashcards FAQ