Docker (advanced)plain Mode
Review all 15 questions for Docker (advanced).Plain Q&A (No XP)
#1Multiple Choice
Which Linux capability flag must be dropped to prevent a container process from changing file ownership UIDs?
#2Multiple Choice
What kernel parameter under `/sys/fs/cgroup/cpu` controls the maximum CPU microseconds allowed per quota period?
#3Multiple Choice
How does `docker run --read-only` affect application execution, and how do you allow writable temp files?
#4Multiple Choice
What occurs when a process inside a cgroups v2 memory-limited container exceeds memory + swap limit?
#5Multiple Choice
Which command attaches a ephemeral debugging container directly into a running distroless container's network namespace?
#6Multiple Choice
What security feature prevents a container process from gaining new privileges via `setuid` binaries?
#7Scenario
You are troubleshooting a production distroless Go container experiencing DNS resolution timeouts. `docker exec -it container sh` fails with 'exec: sh: executable file not found'. How do you capture packet dumps inside its network namespace live without modifying the production image?
#8Scenario
A Java microservice container running with `--memory 1g` keeps getting killed with exit code 137, even though JVM heap `-Xmx` is set to `768m`. Why is the container exceeding 1 GB RAM?
#9Scenario
Your team wants to enforce zero root access in production containers. A developer says 'I added `USER 10001` to my Dockerfile, so we are secure.' What additional security options should be set at container runtime?
#10Scenario
During high CPU traffic spikes, your container response latency increases by 500ms. CPU usage metrics show average CPU is only at 40%, but CFS throttle metrics in `/sys/fs/cgroup/cpu/cpu.stat` show thousands of `nr_throttled` periods. Why is CPU throttling occurring at 40% average load?
#11Code Fill
Complete the security option flag to disable default capability escalation in a `docker run` command:
docker run --security-opt ___:true nginx#12Code Fill
Complete the CLI flag to drop all Linux kernel capabilities from a container before explicitly re-adding `NET_BIND_SERVICE`:
docker run --cap-drop=___ --cap-add=NET_BIND_SERVICE nginx#13Code Fill
Complete the empty base image instruction used for building zero-overhead minimal static Go/Rust containers:
FROM ___
COPY --from=builder /bin/server /server
ENTRYPOINT ["/server"]#14Open Ended
Contrast Linux container user namespaces (`userns`) with default host user mapping.
#15Open Ended