DCA Quality Assurance & Improvement 3 — Questions and Answers
Question 1: A team uses 'docker diff' on a running container. What does this command reveal that supports quality assurance?
- Differences between the container image and the latest registry version
- Files added, changed, or deleted inside the container's writable layer at runtime (Correct answer)
- Differences between two image tags
- The network configuration delta from the base image
Correct answer: Files added, changed, or deleted inside the container's writable layer at runtime
'docker diff' lists filesystem changes (A=added, C=changed, D=deleted) in the container's writable layer compared to the image, helping identify unexpected runtime mutations.
Question 2: Which practice best reduces the attack surface of a production Docker image for a compiled Go application?
- Use the official golang:latest image as the final stage
- Use a multi-stage build and copy only the binary into a 'FROM scratch' final image (Correct answer)
- Add all debugging tools for incident response
- Use Alpine Linux with all packages installed
Correct answer: Use a multi-stage build and copy only the binary into a 'FROM scratch' final image
A 'FROM scratch' final stage containing only the statically compiled binary eliminates all OS packages, reducing CVE exposure to nearly zero.
Question 3: What is the purpose of signing Docker images with 'docker trust sign'?
- It encrypts image layers at rest in the registry
- It creates a cryptographic signature so consumers can verify the image has not been tampered with (Correct answer)
- It locks the image so it cannot be deleted from the registry
- It generates a checksum file stored alongside the image tarball
Correct answer: It creates a cryptographic signature so consumers can verify the image has not been tampered with
Docker Content Trust (DCT) uses Notary to create digital signatures, allowing clients to verify image integrity and publisher identity before pulling.
Question 4: In Docker Swarm, what does setting '--rollback-parallelism 0' on a service accomplish?
- Disables automatic rollback entirely
- Rolls back all tasks simultaneously instead of one at a time (Correct answer)
- Pauses rollback between each task for manual approval
- Sets rollback delay to zero seconds
Correct answer: Rolls back all tasks simultaneously instead of one at a time
A parallelism of 0 means all tasks are rolled back at the same time, which is the fastest but most disruptive rollback strategy.
Question 5: A QA engineer wants to verify that a Docker image's layers are reproducible given the same Dockerfile and context. Which build feature helps achieve reproducible builds?
- BuildKit's --secret flag
- BuildKit's build caching with fixed base image digests pinned in FROM (Correct answer)
- docker build --squash
- docker build --compress
Correct answer: BuildKit's build caching with fixed base image digests pinned in FROM
Pinning the base image by digest (e.g., FROM ubuntu@sha256:...) ensures the exact same base is used every time, making builds reproducible across environments.
Question 6: Which 'docker service ls' output field indicates a service has not reached its desired replica count?
- MODE shows 'replicated/failed'
- The REPLICAS column shows a value less than desired, e.g., '2/3' (Correct answer)
- IMAGE shows 'pending'
- PORTS shows '0.0.0.0:0'
Correct answer: The REPLICAS column shows a value less than desired, e.g., '2/3'
The REPLICAS column format is 'running/desired'; a mismatch like '2/3' immediately signals that one replica is not healthy or scheduled.
Question 7: What does enabling Docker's 'live-restore' daemon option improve from a quality/availability standpoint?
- It allows containers to continue running even when the Docker daemon is stopped or restarted (Correct answer)
- It automatically restores containers from a registry backup on crash
- It keeps image layers in RAM for faster pull times
- It enables rolling restarts of containers during daemon upgrades only
Correct answer: It allows containers to continue running even when the Docker daemon is stopped or restarted
'live-restore' keeps containers running when the daemon goes down for maintenance or upgrades, reducing unplanned downtime during daemon updates.
DCA Quality Assurance & Improvement 3
A team uses 'docker diff' on a running container.
What does this command reveal that supports quality assurance?