CKA Container Fundamentals 3 — Questions and Answers
Question 1: Which signal does Docker send to a container process by default when stopping a container with 'docker stop'?
- SIGKILL
- SIGTERM (Correct answer)
- SIGHUP
- SIGINT
Correct answer: SIGTERM
Docker sends SIGTERM first to allow the process to shut down gracefully, then sends SIGKILL after the stop timeout if the process hasn't exited.
Question 2: What is a container's PID 1 significant for?
- PID 1 always runs as root regardless of the USER directive
- PID 1 receives signals and is responsible for reaping zombie processes (Correct answer)
- PID 1 is the only process that can open network sockets
- PID 1 determines the container's cgroup hierarchy
Correct answer: PID 1 receives signals and is responsible for reaping zombie processes
PID 1 in a container receives signals sent to the container and must properly handle signal forwarding and reaping zombie child processes to avoid resource leaks.
Question 3: What is the effect of setting 'imagePullPolicy: Never' on a Kubernetes Pod?
- The image is always pulled from the registry
- Kubernetes only uses a locally cached image and fails if not found (Correct answer)
- The image is pulled only if it is not already present locally
- The container runs without any image
Correct answer: Kubernetes only uses a locally cached image and fails if not found
With imagePullPolicy: Never, Kubernetes will not attempt to pull the image from a registry and will fail if the image is not already present on the node.
Question 4: Which container runtime interface (CRI) component is responsible for managing image storage on a node?
- kubelet
- containerd's image service (Correct answer)
- kube-proxy
- etcd
Correct answer: containerd's image service
The CRI image service, implemented by runtimes like containerd, handles pulling, listing, removing, and managing image layers on the node.
Question 5: What does a non-zero exit code from a container's main process indicate to Kubernetes?
- The container is healthy and completed successfully
- The container exited with an error, potentially triggering a restart (Correct answer)
- The container is paused and waiting for input
- The container exceeded its resource limits
Correct answer: The container exited with an error, potentially triggering a restart
A non-zero exit code signals failure; depending on the pod's restartPolicy, Kubernetes may restart the container to recover from the error.
Question 6: How does Docker implement copy-on-write (COW) for container layers?
- It copies the entire image to a new location for each container
- It copies a file from a lower read-only layer to the writable layer only when it is modified (Correct answer)
- It writes all changes directly to the original image layers
- It creates a full snapshot of the filesystem at container start
Correct answer: It copies a file from a lower read-only layer to the writable layer only when it is modified
Copy-on-write means a file is copied up from a read-only image layer to the container's writable layer only when that file is first modified, saving disk space.
Question 7: What is the role of the container shim process (e.g., containerd-shim) in the container lifecycle?
- It compiles container images from Dockerfile instructions
- It keeps the container running and reports its exit status even if containerd restarts (Correct answer)
- It enforces network policies between containers
- It manages secret injection into the container environment
Correct answer: It keeps the container running and reports its exit status even if containerd restarts
The shim process sits between containerd and the container runtime (runc), allowing containerd to be restarted or upgraded without affecting running containers.
CKA Container Fundamentals 3
Which signal does Docker send to a container process by default when stopping a container with 'docker stop'?