Docker in depth

Correct — layers are content-addressed and shared; the config records entrypoint, env, and ports.

Correct — ENV only changes metadata (the config), adding a zero-byte layer — no filesystem change.

Correct — download-use-delete must happen in ONE RUN so the file never becomes its own layer.

Correct — deps then reinstall only when the manifest changes; a code edit reuses the cached install.

Correct — A/C/D entries reflect copy-on-write changes since it started.

Correct — which is why containers start instantly and why big-file writes are costly on the overlay.

Correct — only the artifact is copied into a clean final stage.

Correct — this is how only the finished binary reaches the small final image.

Correct — a digest (sha256) is the content itself and is immutable.

Correct — a mutable tag can point at different bytes over time; pin by digest to prevent it.

Correct — useful for air-gapped transfer; load reads it back on the far side.

Correct — removes untagged layers and cache without deleting base images your next build needs.

Correct — the OCI runtime that makes the Linux calls, then exits; the shim stays as parent.

Correct — with live-restore they keep running while dockerd is down, then reconnect.

Correct — the same runtime, minus the Docker daemon in front of it.

Correct — the single source of truth for daemon-wide configuration.

Correct — json-file does not rotate unless you set max-size/max-file.

Correct — bounds each log file and how many rotations are kept.

Correct — the daemon serves the CLI — validate with dockerd --validate and keep a backup.

Correct — namespaces give the private view; cgroups cap resources.

Correct — the namespace hides host processes and remaps the tree.

Correct — the same idea as a Kubernetes pod’s shared network.

Correct — 137 = 128 + SIGKILL(9); raise the limit or fix the leak.

Correct — it caps how many processes the container may create.

Correct — cap it in daemon.json or per container to avoid a disk-full outage.

Correct — docker logs works with file/journald drivers; remote drivers ship elsewhere.

Correct — volumes write to the backing store and persist independently.

Correct — volumes (managed), bind mounts (host path), tmpfs (RAM).

Correct — a typo then hands the container an empty folder; --mount errors instead.

Correct — -v silently creates missing dirs; --mount fails loudly.

Correct — the standard pattern: mount both, tar the volume into the host directory.

Correct — the volume masks that subpath, keeping the container’s installed dependencies.

Correct — memory-backed and gone on stop — nothing to recover from disk.

Correct — a union filesystem stacking lower (image) and upper (writable) dirs.

Correct — reads fall through to lowerdir; writes copy up into upperdir.

Correct — volumes bypass the union/CoW machinery for direct writes.

Correct — without d_type, overlay2 misbehaves; docker info shows "Supports d_type".

Correct — relocates images/containers/volumes off the root partition.

Correct — create a user-defined bridge (or use Compose) and names resolve.

Correct — Docker’s embedded DNS on user-defined networks.

Correct — it can bind any host port and see host traffic; reserve for cases that need it.

Correct — bind 127.0.0.1 or firewall it to avoid exposing "local" ports.

Correct — binds the loopback so only the host itself can reach it.

Correct — a container reaches only networks it is attached to; the DB, absent from frontend, is unreachable there.

Correct — so you connect by name, never a hardcoded IP.

Correct — powerful, but needs promiscuous mode and is often blocked on cloud networks.

Correct — it must bind 0.0.0.0; ss -tlnp inside reveals the localhost bind.

Correct — gives nslookup/curl/ss without touching the target image.

Correct — the most common cause — they are on different networks so the name never resolves.

Correct — reveals a 127.0.0.1 bind that makes a mapped port unreachable.

Correct — -P can auto-publish EXPOSEd ports, but EXPOSE itself is documentation.

Correct — --link was point-to-point, brittle, and injected the linked container’s config.

Correct — an even count buys nothing, and two managers is worse than one.

Correct — you must restore quorum before changes take effect.

Correct — draining reschedules its tasks elsewhere and stops new placement.

Correct — the swarm reconciles reality to the declared replicas.

Correct — it grows automatically as nodes join.

Correct — a failed task aborts and reverts the whole update.

Correct — build+push first, then deploy.

Correct — label the nodes, then constrain the service to matching labels.

Correct — a container on node-1 reaches one on node-2 as if on one LAN.

Correct — so an external LB can target all nodes without tracking replicas.

Correct — encrypted in Raft at rest, never on disk, absent from docker inspect.

Correct — tasks pick up the new file as they are replaced; then remove the old secret.

Correct — survives recreate and bypasses overlay CoW — the only durable choice.

Correct — keeps the value out of inspect, logs, and the process environment.

Correct — eliminates the "app booted before the DB was ready" race.

Correct — slim (Debian/glibc) uses prebuilt manylinux wheels — faster builds, fewer bugs.

Correct — a classic mass-exploited misconfig; require a password and do not publish it.

Correct — only NGINX gets a host port; it proxies to the app by service name.

Correct — first-run bootstrap for users/schema/seed — not migrations.

Correct — so a leaked app credential cannot administer the whole server.

Correct — keeps the container’s installed dependencies while source stays live.

Correct — services reach each other by name on the stack network.

Correct — root+kernel bug = host compromise; a secret in any layer is leaked to all who can pull.

Correct — the shell form wraps it in /bin/sh, which swallows SIGTERM so stop hangs then kills.

Correct — prefer isolated DinD or a daemonless builder (BuildKit, Kaniko).

Correct — a scanner that blocks every merge gets disabled; gate on what is actionable.

Correct — each image ties to the exact commit that built it — good for rollback and audit.

Correct — no root-equivalent socket or dind privilege needed.

Correct — a Kubernetes policy can reject anything unsigned or signed by the wrong identity.

Correct — kept out of the repo and out of logs.