NCA Containerization & NGC Catalog 5 — Questions and Answers
Question 1: Which file must be configured on the host system to allow Docker to authenticate with the NGC container registry before pulling images?
- /etc/nvidia/ngc.conf
- ~/.docker/config.json (Correct answer)
- /etc/docker/daemon.json
- ~/.ngc/config
Correct answer: ~/.docker/config.json
Docker stores registry credentials in ~/.docker/config.json after running `docker login nvcr.io`, which is used for subsequent pull authentication.
Question 2: What is the purpose of the 'NVIDIA_DRIVER_CAPABILITIES' environment variable in NGC containers?
- It sets the maximum GPU memory usable by the container
- It controls which driver feature sets (compute, video, display, etc.) are exposed to the container (Correct answer)
- It specifies the GPU architecture compatibility of the container
- It defines the number of CPU cores allocated alongside GPU resources
Correct answer: It controls which driver feature sets (compute, video, display, etc.) are exposed to the container
NVIDIA_DRIVER_CAPABILITIES selects which driver module capabilities (e.g., compute, compat32, graphics, utility, video, display) are mounted into the container.
Question 3: An NGC-optimized TensorRT container is best suited for which workload phase?
- Large-scale distributed training across hundreds of GPUs
- High-throughput, low-latency model inference and deployment (Correct answer)
- Data preprocessing and ETL pipeline execution
- Hyperparameter search and neural architecture search
Correct answer: High-throughput, low-latency model inference and deployment
TensorRT containers are specifically optimized for inference, providing graph optimization, layer fusion, and precision calibration to maximize throughput and minimize latency.
Question 4: When a company needs to ensure that only their NGC API key is used to pull specific private containers, which NGC feature enforces this access control?
- NGC Team Spaces with role-based access control (Correct answer)
- Docker content trust with Notary signing
- CUDA driver-level authentication tokens
- Container image layer encryption
Correct answer: NGC Team Spaces with role-based access control
NGC Team Spaces provide organizational access management where admins can assign roles and restrict which users or API keys can access specific private registry content.
Question 5: What advantage does running NGC containers in rootless mode provide in a production security context?
- Rootless containers can access more GPUs simultaneously than root containers
- It eliminates the need for the NVIDIA Container Toolkit entirely
- It reduces the attack surface by ensuring container processes cannot gain host root privileges even if they escape the container (Correct answer)
- Rootless mode automatically applies GPU memory isolation between tenants
Correct answer: It reduces the attack surface by ensuring container processes cannot gain host root privileges even if they escape the container
Rootless container mode runs the container runtime and processes as a non-root user, limiting privilege escalation risk if a container escape vulnerability is exploited.
Question 6: Which NGC resource would a developer use to quickly deploy a ready-to-run Jupyter-based environment pre-configured with RAPIDS libraries for GPU-accelerated data science?
- An NGC AI Blueprint
- An NGC RAPIDS container image (Correct answer)
- An NGC Helm Chart for RAPIDS
- An NGC pre-trained model checkpoint
Correct answer: An NGC RAPIDS container image
The NGC RAPIDS container image provides a complete, pre-configured environment with RAPIDS (cuDF, cuML, cuGraph) and Jupyter, ready to run GPU-accelerated data science workflows.
Question 7: When deploying an NGC container in a Kubernetes pod specification, how is GPU resource allocation correctly declared?
- spec.containers[].resources.limits: {nvidia.com/gpu: '1'} (Correct answer)
- spec.containers[].gpuLimit: 1
- spec.nodeSelector: {gpu: 'nvidia'}
- spec.runtimeClassName: nvidia-gpu
Correct answer: spec.containers[].resources.limits: {nvidia.com/gpu: '1'}
GPU resources in Kubernetes are requested via `resources.limits` using the `nvidia.com/gpu` extended resource, which the NVIDIA device plugin exposes to the scheduler.
NCA Containerization & NGC Catalog 5
Which file must be configured on the host system to allow Docker to authenticate with the NGC container registry before pulling images?