BR-ANAC-DOV-MOD-1 flashcards

35 cards. Read the term and the definition here. The deck at the top of this page is optional.

Swarm manager quorum

Managers form a Raft consensus group. A swarm needs an odd number of managers, typically three or five, so a majority survives failure. Losing quorum stops scheduling and service updates until managers recover.

Replicated versus global mode

Replicated services run a specified number of tasks placed by the scheduler. Global services run exactly one task on every eligible node, including nodes added later, which suits monitoring or logging agents.

Routing mesh

A swarm feature that publishes a service port on every node. Incoming traffic on any node is load-balanced to a healthy task, even one running on a different node.

Stack deploy

A command that reads a Compose file and creates or updates swarm services. All resources are prefixed with the stack name, allowing several stacks to coexist on one swarm.

Rolling update controls

Flags such as update-parallelism, update-delay, and update-failure-action govern how many tasks update at once, the pause between batches, and whether to pause or roll back on failure.

Placement constraints

Rules that restrict where tasks may be scheduled, matching node labels or roles. Spread preferences distribute tasks evenly across a label such as a zone to improve resilience.

Build context

The set of files sent to the build daemon at the start of a build. A .dockerignore file excludes paths, shrinking transfer size and preventing secrets from entering layers.

Multi-stage build

A Dockerfile with several FROM stages, each optionally named. Later stages copy artifacts from earlier ones with COPY --from, so compilers and build dependencies stay out of the final image.

COPY versus ADD

COPY only copies files from the build context or a prior stage. ADD also fetches remote URLs and extracts local tar archives, which is why COPY is preferred for predictability.

ENTRYPOINT and CMD

ENTRYPOINT sets the executable that always runs; CMD supplies default arguments that a runtime command can override. JSON exec form avoids a shell wrapper and passes signals directly.

Layer cache invalidation

Each instruction creates a cached layer. A changed instruction, or any change to an earlier layer, invalidates that layer and every layer built after it, forcing a rebuild of those steps.

ARG versus ENV

ARG defines build-time variables that disappear after the build. ENV sets environment variables baked into the image and visible to processes in every container started from it.

docker inspect

Returns detailed JSON about a container, image, network, or volume, including configuration, mounts, and state. The format flag with Go templates extracts a single field for scripting.

docker stats

Reports live CPU, memory, network, and block I/O usage per container. The no-stream option prints a single snapshot and exits, which suits periodic monitoring scripts.

docker exec

Runs an additional process inside an already running container, commonly an interactive shell for troubleshooting. It differs from docker run, which starts a brand-new container.

docker system prune

Removes stopped containers, unused networks, and dangling images. Adding the volumes flag also deletes unused volumes, so the command is destructive and should be reviewed before use.

docker events

Streams daemon lifecycle events such as create, start, die, and destroy. It provides a real-time audit trail and pairs well with filters on container or event type.

Image reference anatomy

A reference has the form registry/namespace/repository:tag. Missing registry defaults to Docker Hub, and a missing tag defaults to latest, so pinning tags avoids surprises.

Digest pinning

Referencing an image by its sha256 digest fixes exact content regardless of tag movement. This guarantees reproducible deployments and resists tag overwrites in the registry.

Push layer deduplication

When pushing, the client asks the registry which layers already exist and uploads only missing blobs. Shared base layers therefore transfer once across many images.

Private registry basics

The registry:2 image runs a simple private registry. Production use requires TLS termination, authentication, and persistent storage for blobs, often behind a reverse proxy.

Manifest list

A multi-architecture index mapping platforms to image manifests. At pull time the client selects the manifest matching its OS and architecture, pulling only matching layers.

daemon.json

The Docker daemon configuration file at /etc/docker/daemon.json. It sets storage driver, log driver, registry mirrors, and insecure registries; invalid JSON prevents the daemon from starting.

Docker socket access

Access to /var/run/docker.sock effectively grants root privileges, because a user can start privileged containers mounting the host filesystem. Membership in the docker group is therefore sensitive.

Remote daemon with TLS

The daemon can listen on TCP using the host flag with tlsverify. Clients present a CA, certificate, and key so the connection is mutually authenticated and encrypted.

Docker Desktop model

On macOS and Windows, Docker Desktop runs the engine inside a lightweight virtual machine and forwards the client connection, because containers require a Linux kernel.

User-defined bridge DNS

On a user-defined bridge network, containers resolve each other by name or network alias through embedded DNS. The default bridge network lacks this automatic name resolution.

Host network mode

The container shares the host network namespace directly, so no port mapping occurs and services bind host ports. Port conflicts with host processes become possible.

Overlay networks

Overlay networks connect containers across multiple swarm nodes, encapsulating traffic between hosts. They support encryption and are used by services and the ingress routing mesh.

Embedded DNS resolver

Inside user-defined networks containers query 127.0.0.11 for name resolution. The dns and dns-search flags override which upstream resolvers are forwarded for external names.

Kernel sharing isolation

Containers share the host kernel and rely on namespaces for visibility isolation plus cgroups for resource limits. A kernel vulnerability can therefore affect every container on the host.

Linux capabilities

Fine-grained privileges split from root. Dropping all capabilities and adding back only what is needed, such as binding a low port, shrinks the attack surface of a container.

Read-only root filesystem

Mounting the container root filesystem read-only prevents runtime tampering with binaries. Writable locations are supplied explicitly through tmpfs mounts or volumes.

Volumes versus bind mounts

Volumes are created and managed by Docker under its data directory and are portable across hosts. Bind mounts reference an existing host path and depend on host layout.

tmpfs mount

A memory-backed mount that never touches disk and disappears when the container stops. It suits scratch space and sensitive data that should not persist.