Docker Certified Associate key terms

Docker's built-in clustering feature that joins multiple hosts into one virtual system, scheduling services across manager and worker nodes and continuously reconciling the running tasks with the desired state.

A host that participates in a Docker Swarm cluster. Managers control cluster state and scheduling, while workers receive and run tasks assigned by managers.

A Swarm node that stores cluster state through Raft and makes scheduling decisions. A majority of managers must be available for the cluster to accept changes.

A declarative Swarm object describing an application's image, replicas, ports, and networks. Swarm keeps the requested number of tasks running to match this definition.

The smallest unit Swarm schedules: one container instance created from a service definition and assigned to a node, with its own lifecycle and status.

A set of related Swarm services defined in a Compose file and deployed together, sharing networks and configuration as a single application.

The majority of manager nodes that must agree before Swarm commits a change. Without quorum, the cluster cannot schedule services or update state.

A deployment method that replaces service tasks in small batches according to parallelism and delay settings, keeping the application available during the change.

A text file of build instructions that Docker executes in order to create an image, with each instruction producing or modifying a filesystem layer or image metadata.

A read-only filesystem difference produced by a Dockerfile instruction. Layers are cached, shared between images, and stacked to form the container's root filesystem.

Reusable intermediate results from earlier builds. Docker reuses a cached layer when the instruction and its inputs are unchanged, avoiding repeated work.

A Dockerfile pattern with several FROM stages, where build tools remain in earlier stages and only required artifacts are copied into the final, smaller runtime image.

A readable label such as latest or 1.2 attached to an image name. Tags select which image version a pull, run, or build command uses.

A content-based SHA256 identifier for an image manifest. Pulling by digest guarantees the exact same image content because the identifier cannot be changed like a tag.

A server that stores and distributes container images through an HTTP API. Docker Hub is public, while organizations often run private registries for controlled access.

A named collection of related image tags inside a registry, grouping versions of one application, such as an nginx repository containing several release tags.

The host runtime made of the Docker daemon, containerd, and runc plus a command-line client. It builds images and runs containers on a machine.

The background service dockerd that accepts Docker API requests and manages images, containers, networks, and volumes on a host.

A container runtime daemon that handles image transfer and container lifecycle. Docker Engine uses it between the Docker daemon and the low-level OCI runtime.

A small OCI-compatible runtime that creates Linux containers by setting up namespaces, cgroups, and mounts, then starting the container process.

The Docker daemon's configuration file, usually /etc/docker/daemon.json. It sets options such as storage driver, log driver, registry mirrors, and default address pools.

The default local network type on a standalone Docker host. Containers on the same bridge can communicate, and published ports expose services outside the host.

A custom bridge network created by the user. It provides automatic name resolution between containers and better isolation than Docker's default bridge network.

A network mode where the container shares the host's network namespace. It has no isolation and published port mappings are ignored.

A Swarm-scoped virtual network spanning multiple hosts. It encapsulates traffic so tasks on different nodes communicate as if on one local network.

The default Swarm overlay network implementing the routing mesh. Published ports are accepted on every node and forwarded to a task wherever it runs.

Mapping a host port to a container port with -p or ports. Docker adds NAT rules so external clients can reach the containerized service.

Docker's internal DNS service on user-defined networks. It resolves container names and network aliases to current container IP addresses automatically.

Linux kernel features that isolate a container's view of processes, mounts, networking, and users, making each container appear to have its own system.

Linux control groups that limit and account for CPU, memory, and I/O used by container processes, preventing one container from consuming all host resources.

Fine-grained Linux privileges that can be added or dropped for a container. Removing unnecessary capabilities reduces what a compromised process can do.

A Linux system-call filter. Docker applies a default profile that blocks risky calls, and custom profiles can further restrict what a container is allowed to request.

Sensitive values such as passwords or keys managed by Swarm and mounted into services at runtime as in-memory files, avoiding images and environment variables.

A signing and verification feature using Notary. When enabled, Docker only pulls or runs images whose publisher signatures can be verified.

Docker-managed persistent storage that lives outside a container's writable layer. Volumes can be mounted into one or more containers and survive container removal.

A host file or directory mounted directly into a container. Changes appear immediately on both sides, and the host path must already exist.

An in-memory filesystem mounted into a container. It is fast and disappears when the container stops, making it suitable for temporary or sensitive data.

The Docker component that implements the layered container filesystem, such as overlay2 or btrfs. It controls copy-on-write behavior and image layer storage.

The preferred Docker storage driver on modern Linux. It stacks read-only image layers under a writable container layer using the overlay filesystem.

A filesystem behavior where containers share read-only image layers and copy a file into their writable layer only when it is modified.