Docker Certified Associate (DCA) flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

OCI runtime (runc)

The low-level component that creates namespaces and cgroups and launches the container process from an unpacked root filesystem, implementing the OCI runtime specification.

containerd role

A daemon that manages the full container lifecycle on a host: pulling and storing images, preparing snapshots, and supervising tasks started by the OCI runtime.

dockerd REST API

The Docker daemon's HTTP interface on a Unix socket or TCP port; the CLI, Compose, and orchestration tools all drive containers through it rather than talking to containerd directly.

Linux namespaces

Kernel feature that gives a process an isolated view of resources such as PIDs, network interfaces, mount points, hostname, and IPC, forming the visibility half of container isolation.

cgroups

Kernel mechanism that limits and accounts for CPU, memory, block I/O, and process counts for a group of processes; the enforcement half of container isolation.

Image layer

An immutable, content-addressed filesystem diff produced by a Dockerfile instruction such as RUN or COPY; layers are shared between images and stacked read-only under a container.

Writable container layer

A thin copy-on-write layer added when a container starts. All runtime file changes land here and are destroyed when the container is removed.

Image digest

A sha256 hash of an image's manifest, used to reference an exact image version regardless of tags; pulling by digest guarantees identical content.

ENTRYPOINT vs CMD

ENTRYPOINT defines the fixed executable; CMD provides default arguments. Arguments given to docker run replace CMD but are appended to ENTRYPOINT.

EXPOSE instruction

Documents which port the image listens on and sets metadata for tooling; it does not publish the port to the host. Publishing requires -p or --publish at run time.

Build cache invalidation

A Dockerfile layer is rebuilt when its instruction text or any parent layer changes; COPY and ADD also invalidate when the checksum of copied files changes.

Multi-stage build

A Dockerfile with several FROM statements where later stages copy artifacts from earlier ones via COPY --from, keeping compilers and build dependencies out of the final image.

.dockerignore

A file listing paths excluded from the build context sent to the daemon, reducing context size and preventing unwanted COPY of secrets or large directories.

Named volume

Storage managed by Docker under /var/lib/docker/volumes, created with docker volume create or -v name:path, and preferred over bind mounts for portable persistent data.

Bind mount

A mount that maps an existing host path directly into a container. It depends on host directory layout and is commonly used for config files and source code during development.

tmpfs mount

An in-memory mount available on Linux containers, used for scratch data or secrets that must never be written to disk; contents vanish when the container stops.

Default bridge network

The network containers join without --network. It provides connectivity but no automatic DNS by container name, so containers must use IP addresses or legacy links.

User-defined bridge network

A custom bridge created with docker network create that supplies embedded DNS, so containers resolve each other by name or alias and can be attached or detached at run time.

Host network mode

Runs the container in the host's network namespace with no port mapping; the container binds host ports directly, trading isolation for performance and simplicity.

Overlay network

A multi-host virtual network used by Swarm services that encapsulates traffic between nodes, letting containers on different hosts communicate as if on one subnet.

macvlan driver

Gives each container its own MAC address on the physical network so it appears as a distinct device; requires promiscuous mode support on the host interface.

Port publishing

Mapping a host port to a container port with -p host:container; on Linux this is implemented with iptables DNAT rules, and the host port must be free.

--memory flag

Sets a hard cgroup memory limit for the container. Exceeding it triggers the OOM killer inside the container rather than swapping or throttling.

--cpus flag

Sets the container's CPU quota as a decimal number of cores, for example --cpus=1.5. It is enforced through cgroup CPU quota and period settings.

HEALTHCHECK instruction

Defines a command whose exit code marks the container healthy or unhealthy. It does not restart the container; restart policies handle that separately.

Restart policy always

Restarts the container whenever it exits, including after daemon restart, unless it is explicitly stopped with docker stop. Stopped containers stay stopped until started again.

unless-stopped policy

Like always, but a container explicitly stopped stays stopped even after the daemon restarts, unlike the always policy which would bring it back up.

docker exec

Runs a new process inside an already running container using its namespaces, commonly used for shells and diagnostics; it fails on stopped containers.

docker inspect

Returns JSON describing a container, image, network, or volume, including config, mounts, network settings, and state, which is the primary debugging source.

Docker Trusted Registry (DTR)

The Docker Enterprise registry component that stores images, scans them for vulnerabilities, and enforces image signing policy before deployment.

Universal Control Plane (UCP)

The Docker Enterprise cluster management layer that provides a web UI, role-based access control, and deployment of Swarm services across nodes.

Docker EE vs CE

CE is the free engine with community support; EE is the commercially supported edition with certified images and plugins, a supported lifecycle, and UCP/DTR integration.

Content trust

A Docker feature using Notary to sign image tags, so clients with DOCKER_CONTENT_TRUST=1 refuse to pull or run unsigned or tampered images.