Quality Assurance & Improvement Flashcards

A security scan finds a critical CVE in a base image. What is the recommended remediation workflow in a Docker-based CI/CD pipeline?

Answer: Update the base image tag in the Dockerfile, rebuild, re-scan, and redeploy

The correct remediation is to update the Dockerfile to a patched base image version, rebuild from source, verify with a new scan, and redeploy to eliminate the vulnerability.

Which 'docker stats' metric is most useful for detecting a memory leak in a containerized application?

Answer: MEM USAGE / LIMIT trending upward over time

A steadily increasing MEM USAGE value that approaches the LIMIT over time is the classic signature of a memory leak in a container.

What is the effect of setting '--health-retries 1' in a Dockerfile HEALTHCHECK instruction?

Answer: The container becomes unhealthy after the very first failed health check probe

With retries=1, a single failed probe immediately transitions the container to 'unhealthy' status without additional retry attempts.

A DevOps team wants to enforce image immutability in production. Which registry feature supports this goal?

Answer: Configuring immutable tags so that a pushed tag cannot be overwritten

Immutable tags in registries like ECR or Docker Hub prevent a tag from being overwritten after it is pushed, ensuring deployed images remain unchanged.

Which command exports a container's filesystem as a tar archive for offline security auditing?

Answer: docker export

'docker export' flattens a container's filesystem (all layers merged) into a tar archive, useful for offline inspection or security auditing tools.

In Docker Swarm, what is the purpose of the '--update-monitor' duration flag on 'docker service update'?

Answer: Defines the window after each task update during which failures count against the failure ratio

'--update-monitor' sets the observation window after each task is updated; failures within this window increment the failure count used against '--update-max-failure-ratio'.

Which practice ensures that secrets passed to a Docker build do not appear in the final image's layer history?

Answer: Using BuildKit's '--secret' flag with 'RUN --mount=type=secret'

BuildKit's secret mount makes the secret available only during that RUN instruction's execution and is never committed to any image layer.