CKA Container Fundamentals 2 — Questions and Answers
Question 1: Which Linux namespace isolates the container's filesystem mount points from the host?
- UTS namespace
- Mount namespace (Correct answer)
- Network namespace
- PID namespace
Correct answer: Mount namespace
The mount namespace isolates the set of filesystem mount points visible to a process, allowing containers to have their own filesystem hierarchy.
Question 2: What happens to container data stored in a writable layer when the container is deleted?
- It is automatically backed up to the image
- It is preserved in a named volume
- It is permanently lost (Correct answer)
- It is moved to the host filesystem
Correct answer: It is permanently lost
Data written to a container's writable layer is ephemeral and is permanently lost when the container is removed, which is why volumes are recommended for persistent data.
Question 3: Which cgroup subsystem is used to limit a container's CPU usage?
- cpu and cpuacct (Correct answer)
- memory
- blkio
- devices
Correct answer: cpu and cpuacct
The cpu and cpuacct cgroup subsystems control CPU time allocation and accounting for containers, enabling CPU limits and shares.
Question 4: What is the purpose of a container entrypoint versus a command (CMD)?
- ENTRYPOINT sets the working directory; CMD sets the user
- ENTRYPOINT defines the executable that always runs; CMD provides default arguments that can be overridden (Correct answer)
- ENTRYPOINT is used in Kubernetes only; CMD is Docker-specific
- ENTRYPOINT and CMD are functionally identical
Correct answer: ENTRYPOINT defines the executable that always runs; CMD provides default arguments that can be overridden
ENTRYPOINT defines the fixed executable to run, while CMD provides default arguments that users can override at runtime without replacing the entrypoint.
Question 5: Which OCI specification defines the format for container images?
- OCI Runtime Specification
- OCI Image Specification (Correct answer)
- OCI Distribution Specification
- OCI Network Specification
Correct answer: OCI Image Specification
The OCI Image Specification defines the format for container images, including the image manifest, image index, and layer format.
Question 6: What does the '--read-only' flag do when running a container?
- Mounts the container's volumes as read-only
- Makes the container's root filesystem read-only (Correct answer)
- Prevents the container from reading environment variables
- Disables network access for the container
Correct answer: Makes the container's root filesystem read-only
The --read-only flag mounts the container's root filesystem as read-only, preventing any writes to the container layer and improving security.
Question 7: In a multi-stage Dockerfile build, what is the primary benefit?
- Faster container startup times
- Smaller final image by discarding build-time dependencies (Correct answer)
- Support for multiple base operating systems
- Automatic caching of all build steps
Correct answer: Smaller final image by discarding build-time dependencies
Multi-stage builds allow you to use a full build environment in early stages and copy only the compiled artifacts into a minimal final image, significantly reducing image size.
CKA Container Fundamentals 2
Which Linux namespace isolates the container's filesystem mount points from the host?