Project Planning & Execution Flashcards

A project architect must ensure containers in different Docker networks cannot communicate unless explicitly allowed. What feature enforces this?

Answer: By default, containers on different networks are isolated from each other

Docker network isolation is the default; containers on separate networks cannot communicate unless connected to a shared network.

When planning secrets management for a Docker Swarm project, what is the correct way to create a secret from a file?

Answer: docker secret create my_secret ./secret.txt

The 'docker secret create ' command creates a Swarm secret stored encrypted in the Raft log.

A CI pipeline must build multi-architecture Docker images for both amd64 and arm64. Which tool and command accomplishes this in one step?

Answer: docker buildx build --platform linux/amd64,linux/arm64 -t myimage --push .

Docker Buildx with the --platform flag builds multi-architecture images and can push a multi-arch manifest in a single command.

During project planning, the team decides to use Docker volumes instead of bind mounts for persistent data. What is the primary operational advantage?

Answer: Volumes are managed by Docker, making backup, migration, and sharing between containers easier

Docker-managed volumes support lifecycle operations (backup, inspect, migrate) and are decoupled from the host filesystem path.

A project requires zero-downtime deployments in Docker Swarm. Which update configuration achieves this?

Answer: --update-parallelism 1 --update-delay 10s with health checks configured

Rolling updates with parallelism of 1, a delay, and health checks ensure new tasks are healthy before old ones are removed.

When executing a containerized project in a regulated environment, which Docker feature allows you to drop Linux kernel capabilities from a container?

Answer: docker run --cap-drop

The --cap-drop flag removes specific Linux capabilities, following the principle of least privilege for container security.

A team is planning Docker image layer caching strategy in their CI system. Which Dockerfile instruction order maximizes cache reuse?

Answer: RUN dependency installation first using lockfiles, then COPY application source

Copying only the lockfile and installing dependencies before copying source code allows the dependency layer to be cached across code changes.