Docker Certified Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Swarm manager quorum

A swarm of N managers tolerates the loss of (N-1)/2 managers; quorum is floor(N/2)+1. Three managers tolerate one failure, five tolerate two, and two tolerate none.

docker swarm join-token

Command that prints the join command and token for workers or managers, for example docker swarm join-token worker. The --rotate flag invalidates the old token.

Routing mesh

Swarm behaviour where a published port is opened on every node, so any node forwards traffic to a task even if that node runs no task of the service.

docker stack deploy

Deploys a Compose file as a stack in swarm mode, naming each object <stack>_<service>. It ignores build keys, so the images must already exist.

Node drain availability

docker node update --availability drain stops new tasks from being scheduled on the node and shuts down existing tasks so they reschedule on other nodes.

Service rollback

docker service update --rollback <service> reverts the service to the previously recorded specification, including image, environment and published ports.

CMD versus ENTRYPOINT

ENTRYPOINT sets the fixed executable started in the container; CMD supplies default arguments or a fallback command. Arguments after the image name in docker run replace CMD only.

COPY --from in multi-stage

Copies artifacts from an earlier named build stage into the final image, for example COPY --from=build /app /app, keeping compilers and source code out of the shipped image.

docker image prune -a

Removes every image not referenced by any container; without -a only dangling untagged images are removed. Adding -f skips the confirmation prompt.

Dockerfile layer cache

Each instruction produces a cached layer; when an instruction changes, that layer and all following layers rebuild. Order instructions from least to most frequently changing.

docker save and load

docker save -o file.tar image:tag exports an image with layers and metadata; docker load -i file.tar restores it. Used to move images without a registry.

Private registry container

Running registry:2 and publishing port 5000 gives a basic registry. Plain-HTTP registries must be listed in daemon.json insecure-registries before push or pull.

daemon.json location

/etc/docker/daemon.json on Linux configures dockerd; restart docker.service to apply it. Common keys are data-root, log-driver, insecure-registries and default-address-pools.

docker info output

Shows daemon state: server version, storage driver, cgroup driver and version, Docker root directory, logging driver, registry mirrors, plugins and swarm status.

Docker root directory

The filesystem path holding images, containers and volumes, defaulting to /var/lib/docker on Linux. The data-root key in daemon.json relocates it.

DOCKER_HOST variable

Environment variable that points the CLI at a chosen daemon, for example tcp://192.168.1.10:2376. docker context is the modern alternative for switching between daemons.

docker group membership

Adding a user to the docker group lets them run docker without sudo, which grants effective root access on the host because dockerd itself runs as root.

User-defined bridge DNS

Containers on a user-defined bridge resolve each other by container name or network alias through embedded DNS at 127.0.0.11; the default docker0 bridge offers no such resolution.

Publish port syntax

docker run -p hostPort:containerPort maps a host port to a container port, for example -p 8080:80. The -P flag publishes all EXPOSEd ports to random host ports.

Overlay network driver

A multi-host network driver available only in swarm mode that lets services communicate across nodes. Adding --attachable lets standalone containers join the same network.

macvlan driver

Assigns each container its own MAC address so it appears as a physical device on the underlying network and can obtain an address from the existing DHCP server.

Host network mode

--network host removes network isolation by sharing the host namespace; -p is ignored and the application binds directly to ports on the host.

no-new-privileges option

--security-opt no-new-privileges prevents processes inside the container from gaining extra privileges through setuid or setgid binaries.

Dropping capabilities

--cap-drop ALL removes every Linux capability from the container; only required ones are restored, such as --cap-add NET_BIND_SERVICE to bind ports below 1024.

Docker Content Trust

DOCKER_CONTENT_TRUST=1 makes the CLI pull and push only Notary-signed images; unsigned or tampered images are rejected at pull time.

Swarm secrets storage

docker secret create stores a secret encrypted in the Raft log; service tasks receive it read-only at /run/secrets/<name> instead of through environment variables.

Daemon TLS port

A secured dockerd listens on TCP 2376 with --tlsverify plus CA, certificate and key files; unencrypted daemon traffic uses 2375 and should never be exposed.

Named volume mount

docker run -v myvol:/data mounts a named volume at /data; Docker creates it if absent and keeps its content in /var/lib/docker/volumes/myvol/_data.

Bind mount with --mount

--mount type=bind,source=/host/path,target=/container/path mounts a host directory and fails if the source is missing, unlike -v which auto-creates it root-owned.

overlay2 storage driver

The default storage driver on modern Linux Docker; it stores layers under /var/lib/docker/overlay2 and shares unchanged layers between images using hard links.

tmpfs mount

--tmpfs /run or --mount type=tmpfs,target=/run mounts memory-backed storage in the container; data is lost when the container stops and never touches host disk.

Anonymous volume

A volume created without a name when a container image declares VOLUME and no -v flag is given; it survives container removal and accumulates until pruned.