--- title: "Docker: Containerization Fundamentals" description: "Test your knowledge of Docker fundamentals with this comprehensive quiz covering containers, images, Dockerfiles, networking, volumes, Docker Compose, and containerization best practices." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/quizzes/post/docker-containerization-fundamentals-quiz --- # Docker: Containerization Fundamentals Welcome to the Docker Basics Quiz! This quiz is designed to test your understanding of fundamental Docker concepts, containerization, and best practices. Each question is multiple-choice, and you'll find hints to help you along the way. Good luck! ## Questions ### 1. Which Dockerfile instruction specifies the base image for a new container? - `SOURCE` - The SOURCE keyword is used in shell scripting or SQL to import data, but Docker uses FROM to pull a base image. - **`FROM`** ✅ - Correct! The FROM instruction initializes a new build stage and sets the Base Image for all subsequent instructions. - `BASE` - While "base image" is the conceptual term, BASE is not a valid syntax keyword in a Dockerfile. - `ROOT` - ROOT usually refers to the administrative user or the top-level directory, not the image source instruction. **Hint:** It is almost always the first line of the file. ### 2. Which command is used to build an image from a Dockerfile? - `docker create` - This command creates a writeable container layer but does not process a Dockerfile to create an image. - **`docker build`** ✅ - Correct! "docker build" reads the instructions in a Dockerfile to automate the creation of a container image. - `docker commit` - This creates an image from a container changes, but it does not utilize a Dockerfile directly. - `docker update` - Update is used to change the configuration of existing containers, not to generate new images. **Hint:** Think of "constructing" something. ### 3. What is the primary difference between CMD and ENTRYPOINT? - `CMD` defines variables while `ENTRYPOINT` defines paths - Environment variables are handled by ENV; both CMD and ENTRYPOINT relate to execution. - **`ENTRYPOINT` sets the executable; `CMD` sets default arguments** ✅ - Correct! ENTRYPOINT defines the main binary, while CMD provides defaults that the user can override. - `CMD` executes at build time; `ENTRYPOINT` executes at runtime - Both instructions define runtime behavior; neither executes during the build process itself. - `ENTRYPOINT` is optional; `CMD` is mandatory for all images - Neither is strictly mandatory, though at least one is typically required for a functional service container. **Hint:** One is easily overridden by CLI arguments, the other is the "fixed" executable. ### 4. Which command displays the list of currently running containers? - `docker images` - This lists the static templates stored on your host, not the active container instances. - **`docker ps`** ✅ - Correct! Standing for "process status," this command shows all active containers. - `docker stats` - This command shows a live data stream of resource usage rather than a simple list of containers. - `docker logs` - Logs show the output history of a specific container, not the status of all containers. **Hint:** Think of "process status". ### 5. What does the -d flag do when running a container? - Deletes the container automatically upon exit - Automatic deletion is handled by the --rm flag, not the -d flag. - **Starts the container in detached background mode** ✅ - Correct! The -d flag runs the container in the background, freeing your terminal session. - Enables interactive mode with a pseudo-terminal - Interactive mode and terminals are enabled using the -i and -t flags respectively. - Download updates for the image before starting - Docker usually checks for images locally first; updating is handled via docker pull. **Hint:** It allows the container to run in the background. ### 6. Which instruction allows you to set environmental variables within a Dockerfile? - `VAR` - While VAR is common in programming, Docker requires specific keywords for layer persistence. - `SET` - SET is used in Windows environments but is not a valid Dockerfile instruction for variables. - **`ENV`** ✅ - Correct! The ENV instruction sets variables that persist during the container runtime. - `ARG` - ARG defines variables used only during the build process; they do not exist in the running container. **Hint:** Short for Environment. ### 7. What is a Docker "Layer"? - An isolated virtual network segment - Networking is handled by drivers; layers are part of the storage and filesystem architecture. - **A read-only filesystem change from a command** ✅ - Correct! Images are composed of a stack of read-only layers representing filesystem differences. - A security wrapper around the host kernel - Security is provided by namespaces and cgroups; layers are specifically for file storage. - A snapshot of the system memory state - Memory snapshots are a VM feature; Docker layers only track persistent disk changes. **Hint:** Every instruction in a Dockerfile creates one. ### 8. How do you stop all running Docker containers at once? - `docker stop --all` - The stop command does not support a native --all flag; IDs must be passed manually or via subshell. - **`docker stop $(docker ps -q)`** ✅ - Correct! This command retrieves all active IDs and passes them to the stop command. - `docker system halt` - There is no "halt" subcommand in the Docker CLI; stopping must target specific containers. - `docker kill --force` - The kill command requires specific container identifiers and does not target all instances by default. **Hint:** It involves nesting a command inside "docker stop". ### 9. Which Docker network driver is the default for standalone containers? - `Overlay` - Overlay networks are primarily used for multi-host communication in Swarm or Kubernetes. - **`Bridge`** ✅ - Correct! The bridge driver is the default for containers running on a single Docker host. - `Host` - The host driver bypasses network isolation, which is not the default behavior for containers. - `None` - The none driver disables all external networking, providing isolation but no connectivity. **Hint:** Think of a physical network connector. ### 10. What is the purpose of a Docker ".dockerignore" file? - Prevents specific build errors from stopping the process - Ignore files only affect file transfers; they cannot suppress syntax or execution errors. - **Excludes local files from being sent to the build context** ✅ - Correct! This keeps images small by excluding unnecessary local files like logs or git data. - Restricts the container from accessing external IP ranges - Network restrictions are handled via firewalls or network drivers, not ignore files. - Hides the resulting image from being seen on Docker Hub - Visibility is managed via registry repository settings, not a local configuration file. **Hint:** Prevents sending unnecessary files to the Docker daemon. ### 11. Which command allows you to enter a running container and start a shell? - `docker attach` - Attach connects to the primary process (PID 1), which is often not an interactive shell. - **`docker exec -it /bin/bash`** ✅ - Correct! The exec command runs a new process, such as a shell, inside an existing container. - `docker connect` - The connect command is used for networking, not for starting interactive terminal sessions. - `docker open` - Open is not a valid Docker CLI command for accessing container internals. **Hint:** You "execute" a command inside it. ### 12. What is the command to delete a specific Docker image? - `docker rm` - The rm command is used for containers; deleting images requires the rmi variant. - **`docker rmi`** ✅ - Correct! Standing for "Remove Image," this deletes the image from local storage. - `docker delete` - Docker uses the "remove" (rm) naming convention rather than "delete" for its objects. - `docker drop` - Drop is often used in database contexts; Docker uses rmi to purge image data. **Hint:** Short for Remove Image. ### 13. What is a "Volume" in Docker? - A method for limiting container disk usage - Usage limits are called quotas; volumes are used for persistent data storage. - **A persistent storage area managed by Docker** ✅ - Correct! Volumes persist data independently of the container’s lifecycle. - A collection of compressed image layers - Layers form the image structure; volumes are external to those read-only layers. - A virtualized network bandwidth controller - Bandwidth is managed via network policies; volumes are strictly a filesystem concept. **Hint:** The preferred mechanism for persisting data. ### 14. In "docker run -p 8080:80 nginx", which port is the host port? - 80 - Port 80 is the internal port where the application listens inside the container. - **8080** ✅ - Correct! The first number in the mapping refers to the port on the host machine. - Both ports act as host ports - Mapping requires one host port and one container port to bridge the two environments. - The host port is randomly assigned - Because 8080 is explicitly defined, it is not random; random assignment uses -P. **Hint:** The format is :. ### 15. Which instruction defines the directory where subsequent commands will be executed? - `SETDIR` - SETDIR is not a recognized Docker instruction; use WORKDIR for this purpose. - **`WORKDIR`** ✅ - Correct! WORKDIR sets the path for all following RUN, CMD, and COPY instructions. - `CD` - The CD command only affects a single RUN layer and does not persist to subsequent instructions. - `PATH` - PATH is an environment variable used to find binaries, not to set the current working directory. **Hint:** Think of "change directory". ### 16. What is "Multi-stage building"? - Compiling images for multiple CPU types - This describes multi-platform builds; multi-stage building focuses on size optimization. - **Using separate stages to reduce final image size** ✅ - Correct! It allows you to build an app in one stage and copy only the binary to the final image. - Running the build process on multiple hosts - Building is usually done on one host; stages refer to the internal structure of one Dockerfile. - Automating the push to various registries - This is a CI/CD workflow concept, not a feature of the Dockerfile build stages. **Hint:** Using multiple FROM statements in one Dockerfile. ### 17. Which command is used to see the metadata (IP, Config, etc.) of a container? - `docker logs` - Logs show the standard output of the app, not the system configuration metadata. - **`docker inspect`** ✅ - Correct! It returns a detailed JSON object containing all configuration details. - `docker info` - The info command displays system-wide settings for the Docker engine, not specific containers. - `docker meta` - Metadata is retrieved via inspect; "meta" is not a valid subcommand in Docker. **Hint:** You "examine" or "inspect" the details. ### 18. What is the purpose of "Docker Hub"? - A local graphical tool for image editing - Docker Hub is a cloud service; local management is done with Docker Desktop. - **A public registry for sharing container images** ✅ - Correct! It acts as a central repository for downloading and sharing images. - A dashboard for monitoring container RAM - Monitoring is handled by tools like Prometheus; Hub is for storage and versioning. - The primary engine that executes containers - The execution engine is the Docker Daemon; Hub is an external storage service. **Hint:** A central "library" for Docker. ### 19. What is "Copy-on-Write" (CoW)? - A command to duplicate files from the host - This is the COPY instruction; CoW is a filesystem management strategy. - **A strategy that copies files only when modified** ✅ - Correct! Files are only copied to the writable layer if they are changed by the container. - A script that backups container data daily - CoW is a real-time storage optimization, not a backup or scheduling tool. - A network protocol for syncing containers - CoW is strictly related to storage and the Union File System, not networking. **Hint:** How Docker handles changes to files in image layers. ### 20. Which command pulls an image from a registry without running it? - `docker run` - The run command pulls, creates, and starts a container all in one step. - **`docker pull`** ✅ - Correct! Pull downloads the image to your local machine without creating a container. - `docker fetch` - While intuitive, fetch is not a Docker command; pull is the correct terminology. - `docker import` - Import creates an image from a local file archive, not from a remote registry. **Hint:** Think of "tugging" or "fetching". ### 21. What does "docker system prune" do? - Updates the Docker engine to the latest version - Engine updates are managed by the host OS; prune only removes unused Docker data. - **Removes unused data like stopped containers** ✅ - Correct! Prune is a cleanup tool used to reclaim disk space from unused objects. - Deletes all active and running containers - Prune only removes stopped containers and unused networks; it ignores active ones. - Optimizes the host kernel for containerization - Prune focuses on data deletion; it does not modify the underlying host operating system. **Hint:** A "cleanup" command. ### 22. Which Dockerfile instruction is used to document intended ports? - `PUBLISH` - Publishing is a runtime action (-p); there is no PUBLISH keyword for Dockerfiles. - **`EXPOSE`** ✅ - Correct! EXPOSE documents which ports the application intends to use for communication. - `LISTEN` - While web servers use LISTEN, Docker uses EXPOSE to signal port intent in the metadata. - `PORT` - PORT is frequently used as an environment variable but is not a valid Dockerfile instruction. **Hint:** It doesn't actually open the port on the host. ### 23. What is a "Dangling Image"? - An image with a critical security vulnerability - Vulnerabilities are unrelated to whether an image is considered "dangling." - **An image that has no name tag or reference** ✅ - Correct! These are usually the result of building a new version of an existing image. - An image that is currently in the process of pulling - Pulling images are not dangling; they are incomplete downloads in the local cache. - An image that is corrupted and cannot be started - Dangling refers only to the lack of a name tag, not the functional integrity of the image. **Hint:** An image with no name or tag. ### 24. Which command starts a previously stopped container? - `docker run` - The run command creates a brand new container instance instead of resuming an old one. - **`docker start`** ✅ - Correct! Start resumes an existing, stopped container using its original ID. - `docker resume` - Resume is used in some virtualization tools, but Docker uses the start command. - `docker up` - The up command is specific to Docker Compose and manages groups of containers. **Hint:** Opposite of stop. ### 25. What is the default user in most Docker images if not specified? - `admin` - Admin is common in Windows, but Linux-based images default to the root user. - **`root`** ✅ - Correct! By default, processes inside a container run with root administrative privileges. - `default` - While there is a default state, there is no user actually named "default" in standard images. - `docker` - The "docker" user is sometimes created manually for security, but it is not the engine default. **Hint:** The most powerful user. ### 26. Which command logs you into a Docker registry? - `docker auth` - Auth refers to the mechanism, but the specific command to enter credentials is login. - **`docker login`** ✅ - Correct! This command authenticates your local CLI with a remote registry. - `docker signin` - Signin is generally used for web interfaces; command-line tools use the login verb. - `docker access` - Access is not a valid Docker subcommand for managing registry credentials. **Hint:** Very intuitive name. ### 27. What is Docker Compose used for? - Modifying the layers of a single image - Images are modified via Dockerfiles; Compose manages how containers interact. - **Running multi-container apps using YAML files** ✅ - Correct! Compose allows you to define and start complex multi-container stacks easily. - Automatically updating the host OS security - Compose manages containers, not the underlying host operating system or its security. - Converting VM images into Docker containers - Migration is a separate process; Compose is for orchestration, not format conversion. **Hint:** Defining and running multi-container applications. ### 28. Which flag is used to name a container during "docker run"? - -t - The -t flag stands for TTY and provides a terminal, but it does not name the container. - **--name** ✅ - Correct! This flag allows you to assign a custom, human-readable name to the container. - --id - IDs are generated automatically by the engine and cannot be manually assigned via flags. - -n - The short -n flag is not used for naming; the full --name parameter is required. **Hint:** Double hyphen followed by the word. ### 29. What is the purpose of the "HEALTHCHECK" instruction? - To monitor the RAM usage of the host server - Host health is monitored by external tools; HEALTHCHECK is for the containerized app. - **To check if the application inside is functional** ✅ - Correct! It verifies that the service is actually working, not just that the process is alive. - To scan the image layers for security risks - Vulnerability scanning is performed by tools like Scout, not by the HEALTHCHECK instruction. - To restart the Docker daemon if it crashes - Daemon stability is managed by the OS (systemd), not by instructions inside a Dockerfile. **Hint:** Tells Docker how to test if the container is still working. ### 30. What command shows the history of an image? - `docker logs` - Logs show what happened after the container started, not how the image was built. - **`docker history`** ✅ - Correct! This command displays the layers and commands used to create the image. - `docker layers` - While layers are being shown, the actual command to view them is history. - `docker inspect` - Inspect shows the current configuration state but does not list the build steps chronologically. **Hint:** Shows the layers and commands that created the image.