Quality Assurance & Improvement Flashcards

A team uses 'docker diff' on a running container. What does this command reveal that supports quality assurance?

Answer: Files added, changed, or deleted inside the container's writable layer at runtime

'docker diff' lists filesystem changes (A=added, C=changed, D=deleted) in the container's writable layer compared to the image, helping identify unexpected runtime mutations.

Which practice best reduces the attack surface of a production Docker image for a compiled Go application?

Answer: Use a multi-stage build and copy only the binary into a 'FROM scratch' final image

A 'FROM scratch' final stage containing only the statically compiled binary eliminates all OS packages, reducing CVE exposure to nearly zero.

What is the purpose of signing Docker images with 'docker trust sign'?

Answer: It creates a cryptographic signature so consumers can verify the image has not been tampered with

Docker Content Trust (DCT) uses Notary to create digital signatures, allowing clients to verify image integrity and publisher identity before pulling.

In Docker Swarm, what does setting '--rollback-parallelism 0' on a service accomplish?

Answer: Rolls back all tasks simultaneously instead of one at a time

A parallelism of 0 means all tasks are rolled back at the same time, which is the fastest but most disruptive rollback strategy.

A QA engineer wants to verify that a Docker image's layers are reproducible given the same Dockerfile and context. Which build feature helps achieve reproducible builds?

Answer: BuildKit's build caching with fixed base image digests pinned in FROM

Pinning the base image by digest (e.g., FROM ubuntu@sha256:...) ensures the exact same base is used every time, making builds reproducible across environments.

Which 'docker service ls' output field indicates a service has not reached its desired replica count?

Answer: The REPLICAS column shows a value less than desired, e.g., '2/3'

The REPLICAS column format is 'running/desired'; a mismatch like '2/3' immediately signals that one replica is not healthy or scheduled.

What does enabling Docker's 'live-restore' daemon option improve from a quality/availability standpoint?

Answer: It allows containers to continue running even when the Docker daemon is stopped or restarted

'live-restore' keeps containers running when the daemon goes down for maintenance or upgrades, reducing unplanned downtime during daemon updates.