Pass the Docker Certified Associate DCA Questions and answers with ExamsMirror

 The set of commands docker port inspect and docker container inspect will not identify the published port(s) for a container. The reason is that there is no such command as docker port inspect. The correct command to inspect the port mappings of a container is docker port1. The command docker container inspect can also show the port mappings of a container, but it will display a lot of other information as well, so it isnot as concise as docker port2. To identify the published port(s) for a container, you can use either of these commands:

docker port CONTAINER will list all the port mappings of the container1.

docker port CONTAINER PRIVATE_PORT will list only the port mapping of the specified private port of the container1.

docker container inspect --format=' { {.NetworkSettings.Ports}}' CONTAINER will list only the port mappings of the container in a JSON format23.

For example, if you have a container named web that publishes port 80 to port 8080 on the host, you can use any of these commands to identify the published port:

$ docker port web

80/tcp -> 0.0.0.0:8080

$ docker port web 80

0.0.0.0:8080

$ docker container inspect --format=' { {.NetworkSettings.Ports}}'web

map[80/tcp:[map[HostIp:0.0.0.0 HostPort:8080]]]

docker port

docker container inspect

How can I grab exposed port from inspecting docker container?

Adding a new user to the engineering organization in DTR will not automatically grant them read/write access to the engineering/api repository. This is because the repository permissions are not inherited from the organization level, but are configured separately for each repository. Therefore, to grant read/write access to the new user, you need to add them directly to the list of users with read/write access under the repository’s Permissions tab. References:

Docker Trusted Registry - Manage access to repositories

Docker Certified Associate (DCA) Study Guide - Domain 3: Image Creation, Management, and Registry

https://docs.docker.com/ee/dtr/user/manage-repos/#manage-access-to-repositories

https://success.docker.com/certification/study-guides/dca-study-guide#domain-3-image-creation-management-and-registry-20-of-exam

 This command will not display a list of volumes for a specific container, as it will show detailed information on the container itself, such as its configuration, network settings, state, and log path1. To display a list of volumes for a specific container, you need to use the --format option with a custom template that filters the output by the Mounts field2. For example, the following command will show the source and destination of the volumes mounted in the nginx container:

docker container inspect --format=' { {range .Mounts}} { {.Source}} -> { {.Destination}} { {end}}' nginx References:

docker container inspect | Docker Docs

How to Use Docker Inspect Command - Linux Handbook

= The ‘docker inspect’ command returns low-level information on Docker objects, such as containers, images, networks, etc1 It does not show the list of historical tasks for a service. To view the list of tasks for a service, you need to use the ‘docker service ps’ command 2. For example, to see the tasks for the ‘http’ service, you would run ‘docker service ps http’. This would show the ID, name, image, node, desired state, current state, and error of each task 2. References: Docker inspect | Docker Docs, Docker service ps | Docker Docs

= The command docker network create -d overlay --secure  will not ensure that overlay traffic between service tasks is encrypted. The --secure option is not a valid flag for the docker network create command1. To enable encryption for an overlay network, you need to use the --opt encrypted flag instead23. This will create IPSEC tunnels between the nodes where the service tasks are scheduled, using the AESalgorithm in GCM mode2. You can verify if an overlay network is encrypted by checking if the IPSEC tunnels were created using tools like netstat4. References:

1: docker network create | Docker Docs

2: Encrypt traffic on an overlay network | Docker Docs

3: Overlay network driver | Docker Docs

4: Docker: How to verify if an overlay network is encrypted - Stack Overflow

The command docker container logs nginx –volumes will not display a list of volumes for a specific container. The docker container logs command shows the logs of a container, which are usually the standard output and standard error of the main process running in thecontainer1. The –volumes flag is not a valid option for this command, and will result in an error message2. To display a list of volumes for a specific container, you can use the docker inspect command with a filter option, such as docker inspect -f '{{ .Mounts }}' nginx3. This will show the source, destination, mode, type, and propagation of each volumemounted in the container4. References: docker container logs, docker container logs nginx –volumes, docker inspect, docker inspect -f ‘{{ .Mounts }}’ nginx

Tagging the image with ‘nginx:immutable’ is not how a user can prevent an image, such as ‘nginx:latest’, from being overwritten by another user with push access to the repository.Tagging the image with ‘nginx:immutable’ will only create a new tag for the image, but it will not prevent the original tag from being overwritten. To prevent an image tag from being overwritten in Docker Trusted Registry, the user can use the DTR web UI to make the tag immutable1. This will prevent anyone from pushing a new image with the same tag, even if they have push access to the repository1. Alternatively, the user can also use the DTR API to make the tag immutable2. References: Prevent tags from being overwritten), DTR API reference)

Docker allows the use of insecure registries through a specific configuration in the Docker daemon.By listing the insecure registries in the ‘daemon.json’ configuration file under the ‘insecure-registries’ key, Docker can interact with these registries even without a trusted TLS certificate1.This is particularly useful when setting up a private Docker registry1.However, it’s important to note that this configuration bypasses the security provided by TLS, and should be used with caution1.

= The command docker run -v /data:/mydata --mode readonly ubuntu is not valid because it has some syntax errors. The correct syntax for running a container with a bind mount is docker run [OPTIONS] IMAGE [COMMAND] [ARG...]. The errors in the command are:

The option flag for specifying the volume is --volume or -v, not -v. For example, -v /data:/mydata should be --volume /data:/mydata.

The option flag for specifying the mode of the volume is --mount, not --mode. For example, --mode readonly should be --mount type=bind,source=/data,target=/mydata,readonly.

The option flag for specifying the mode of the container is --detach or -d, not --mode. For example, --mode readonly should be --detach.

The correct command for running a container with a bind mount in read-only mode is:

docker run --volume /data:/mydata --mount type=bind,source=/data,target=/mydata,readonly --detach ubuntu

This command will run a container using the ubuntu image and mount the host’s /data directory to the container’s /mydata directory in read-only mode. The container will run in the background (--detach).

 docker run reference | Docker Documentation : [Use bind mounts | Docker Documentation]

 = The command ‘docker service inspect http’ will display detailed information on the ‘http’ service, such as its ID, name, mode, replicas, container spec, networks, ports, etc. However, it will not show the list of historical tasks for the service. To view the list of tasks, you need to use the command ‘docker service ps http’, which will show the ID, name, image, node, desired state, current state, and error of each task12. References:

1: docker service inspect | Docker Docs

2: docker service ps | Docker Docs