Docker Updated DCA Exam Questions and Answers by montague

Creating one pod and adding all the resources needed for each application is not a good way to accomplish the goal of grouping Kubernetes-specific resources for each application. This is because pods are the smallest unit of a Kubernetes application, and they are designed to run a single container or a set of tightly coupled containers that share the same network and storage resources1. Pods are ephemeral and can be created and destroyed by the Kubernetes system at any time. Therefore, putting multiple applications in one pod would make them harder to manage, scale, and update independently. A better way to accomplish the goal is to use namespaces, which are logical clusters within a physical cluster that can isolate resources, policies, and configurations for different applications2. Namespaces can also help organize secrets, which are Kubernetes objects that store sensitive information such as passwords, tokens, and keys3. References:

• Pods | Kubernetes
• Namespaces | Kubernetes
• Secrets | Kubernetes

The answer depends on whether you want to access the container from the host’s network or from other containers on the same network. EXPOSE and --publish have different effects on the container’s port visibility. References: Docker run reference, Dockerfile reference, Docker networking overview

The networking drivers that allow you to enable multi-host network connectivity between containers are bridge, macvlan, ipvlan, and overlay. These drivers create networks that can span multiple Docker hosts, and therefore enable containers on different hosts to communicate with each other. The other drivers, such as host, user-defined, and none, create networks that are either isolated or limited to a single host. Here is a brief overview of each driver and how it supports multi-host networking:

•bridge: The bridge driver creates a network that connects containers on the same host using a Linux bridge. However, it can also be used to create a network that connects containers across multiple hosts using an external key-value store, such as Consul, Etcd, or ZooKeeper. This feature is deprecated and not recommended, as it requires manual configuration and has some limitations. The preferred driver for multi-host networking is overlay1.

•macvlan: The macvlan driver creates a network that assigns a MAC address to each container, making it appear as a physical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The macvlan driver can also use 802.1q trunking to create sub-interfaces and isolate traffic between different networks2.

•ipvlan: The ipvlan driver creates a network that assigns an IP address to each container, making it appear as a logical device on the network. This allows the containers to communicate with other devices on the same network, regardless of the host they are running on. The ipvlan driver can also use different modes, such as l2, l3, or l3s, to control the routing and isolation of traffic between different networks3.

•overlay: The overlay driver creates a network that connects multiple Docker daemons together using VXLAN tunnels. This allows the containers to communicate across different hosts, even if they are on different networks. The overlay driver also supports encryption, load balancing, and service discovery. The overlay driver is the default and recommended driver for multi-host networking, especially for Swarm services4.

References:

•Use bridge networks

•Use macvlan networks

•Use ipvlan networks

•Use overlay networks

= Docker Content Trust (DCT) is a feature that allows users to verify the integrity and publisher of container images they pull or deploy from a registry server, signed on a Notary server12. DCT does not enable mutual TLS between the Docker client and server, which is a different security mechanism that ensures encrypted and authenticated communication between the client and the server3. DCT is based on digital signatures and The Update Framework (TUF) to provide trust over arbitrary collections of data1. References:

• Content trust in Docker | Docker Docs
• Docker Content Trust: What It Is and How It Secures Container Images
• Protect the Docker daemon socket | Docker Docs