DCA DCA Docker Security 1 — Questions and Answers
Question 1: What is the purpose of Docker Content Trust (DCT)?
- To encrypt container-to-container traffic
- To sign and verify the authenticity and integrity of Docker images (Correct answer)
- To control user access to Docker registries
- To scan images for OS vulnerabilities
Correct answer: To sign and verify the authenticity and integrity of Docker images
Docker Content Trust uses digital signatures via The Update Framework (TUF) to verify the integrity and publisher of Docker images.
Question 2: Which Linux feature does Docker use to filter the system calls a container can make to the kernel?
- AppArmor
- SELinux
- Seccomp (Correct answer)
- Namespaces
Correct answer: Seccomp
Docker uses seccomp (secure computing mode) profiles to restrict which system calls a container process can invoke.
Question 3: What does running a container with the `--privileged` flag do?
- Runs the container process as root on the host filesystem
- Grants the container almost all Linux capabilities and access to host devices (Correct answer)
- Makes the container filesystem read-only
- Enables Docker Content Trust for that container
Correct answer: Grants the container almost all Linux capabilities and access to host devices
The `--privileged` flag grants the container nearly all the same access to the host as native processes running outside containers.
Question 4: What is the default user that processes run as inside a Docker container if not otherwise specified?
- nobody
- www-data
- root (Correct answer)
- docker
Correct answer: root
By default, container processes run as root (UID 0) unless a different user is specified via the USER Dockerfile instruction or the --user runtime flag.
Question 5: Which Linux kernel feature does Docker primarily use to isolate container processes from the host system?
- cgroups
- namespaces (Correct answer)
- capabilities
- seccomp
Correct answer: namespaces
Linux namespaces provide isolation for PIDs, network interfaces, mount points, users, and other system resources between containers and the host.
Question 6: Which Docker feature is used to securely store and transmit sensitive data like passwords to Swarm services?
- Docker environment variables
- Docker configs
- Docker secrets (Correct answer)
- Docker volumes
Correct answer: Docker secrets
Docker secrets provide a secure mechanism for storing sensitive data, encrypted at rest and transmitted only to authorized Swarm service containers.
DCA DCA Docker Security 1
What is the purpose of Docker Content Trust (DCT)?