DCA DCA Docker Security 2 — Questions and Answers
Question 1: What does the `--cap-drop ALL` flag do when running a container?
- Removes the container from all networks
- Drops all Linux capabilities from the container process (Correct answer)
- Disables all bind-mounted volumes
- Prevents the container from forking child processes
Correct answer: Drops all Linux capabilities from the container process
The `--cap-drop ALL` flag removes all Linux capabilities from the container, which can then be selectively restored with `--cap-add`.
Question 2: Which Linux feature is used by Docker to enforce CPU and memory resource limits on containers?
- Namespaces
- Seccomp profiles
- cgroups (control groups) (Correct answer)
- AppArmor policies
Correct answer: cgroups (control groups)
Linux cgroups (control groups) limit, prioritize, and monitor resource usage including CPU, memory, and I/O for Docker containers.
Question 3: How are Docker secrets passed to a container in Swarm mode?
- As environment variables visible in docker inspect
- As files mounted under /run/secrets/ inside the container (Correct answer)
- Embedded in the container image layer
- Via the docker run -e flag at service creation
Correct answer: As files mounted under /run/secrets/ inside the container
Docker secrets are mounted as in-memory tmpfs files at /run/secrets/<secret_name> inside the container, never exposed in environment variables or image layers.
Question 4: What format is used to define a custom seccomp profile for a Docker container?
- A JSON profile file (Correct answer)
- A YAML configuration file
- An INI-style configuration file
- A Docker Compose extension file
Correct answer: A JSON profile file
Docker seccomp profiles are defined in JSON format, specifying the default action and the list of allowed or denied system calls.
Question 5: What does the `--read-only` flag do when running a Docker container?
- Prevents the container from reading files on the host
- Makes the container's root filesystem read-only (Correct answer)
- Restricts the container's network to read-only monitoring
- Prevents pulling updated versions of the container image
Correct answer: Makes the container's root filesystem read-only
The `--read-only` flag mounts the container's root filesystem as read-only, preventing any process from writing to it.
Question 6: What Linux mandatory access control (MAC) systems can Docker integrate with for additional container security?
- Only SELinux on Red Hat-based systems
- Only AppArmor on Debian-based systems
- Both AppArmor and SELinux, depending on the host OS (Correct answer)
- Neither; Docker uses its own MAC system
Correct answer: Both AppArmor and SELinux, depending on the host OS
Docker can integrate with both AppArmor (on Ubuntu/Debian hosts) and SELinux (on RHEL/CentOS hosts) to apply mandatory access control policies to containers.
DCA DCA Docker Security 2
What does the `--cap-drop ALL` flag do when running a container?