Test yourself
Docker for beginners
Final exam · 12 questions · answers explained as you pick
Docker basics
3 questions
01The main thing that makes a container lighter and faster to start than a virtual machine is that it…
Incorrect — containers do not rely on compressing your app; the difference is architectural.
Incorrect — containers are isolated — via namespaces and cgroups — they just isolate differently than a VM.
Correct — no guest OS to boot means seconds to start and megabytes on disk, unlike a VM’s full kernel.
Incorrect — containers use less, not more — there is no second operating system to run.
02What is the relationship between an image and a container?
Incorrect — they are distinct: one is the template, the other the running instance.
Correct — like a recipe and the meal, or a class and an object — one image can start many containers.
Incorrect — it is the other way around — the image is the template.
Incorrect — a stopped container is still a container; an image is the template it was created from.
03After docker stop web, the container is…
Incorrect — stop does not delete — you would need docker rm for that.
Correct — a stopped container keeps its writable layer and logs; docker ps -a still lists it.
Incorrect — stop halts the process; it is no longer running.
Incorrect — stopping does not create an image; that would be docker commit or build.
3 questions · explanations appear as you answer
Working with containers
3 questions
01You run a web server but cannot reach it at localhost. The most likely reason is…
Incorrect — a corrupt image would fail to start, not just be unreachable.
Incorrect — they can — once you publish a port with -p.
Correct — without -p the container’s port is only reachable inside Docker’s network, not from your host.
Incorrect — ps only lists containers; it has nothing to do with reachability.
02docker exec -it web sh is used to…
Correct — exec runs a new command (here, a shell) inside a container that is already up.
Incorrect — that is docker run; exec attaches to a running one.
Incorrect — exec does not build anything.
Incorrect — that is docker cp; exec gives you a shell.
03Why is passing a database password with -e considered unsafe for real secrets?
Incorrect — length is not the issue; exposure is.
Correct — anything that can inspect the container can read the value — use mounted files or a secrets manager.
Incorrect — they are not encrypted; the app reads them in plaintext, and so can others.
Incorrect — they work fine — they are just the wrong place for sensitive values.
3 questions · explanations appear as you answer
Building your own images
3 questions
01Why put COPY package.json + install BEFORE COPY . . in a Dockerfile?
Incorrect — order does not change final size; it changes cache behavior.
Correct — Docker rebuilds from the first changed layer down; deps-first means edits to source reuse the cached install.
Incorrect — it is perfectly allowed; the reason is caching, not a rule.
Incorrect — multi-arch is unrelated to instruction order.
02A secret you COPY into one layer and delete in a later layer is…
Incorrect — deleting in a later layer does not remove it from the earlier one.
Incorrect — anyone with the image can recover it, regardless of repo visibility.
Correct — layers are stacked and kept; a secret in any layer ships in the image. Never COPY secrets in.
Incorrect — Docker does not encrypt layer contents.
03Why write CMD as a JSON array (["nginx","-g","daemon off;"]) rather than a plain string?
Correct — the string form wraps it in /bin/sh, which swallows SIGTERM, so docker stop hangs then kills it.
Incorrect — readability aside, the real reason is signal handling and PID 1.
Incorrect — the string (shell) form is allowed — it just behaves worse for signals.
Incorrect — the form has no effect on image size.
3 questions · explanations appear as you answer
Data, networking & Compose
3 questions
01Where should a database keep its data so it survives docker rm?
Incorrect — that layer is deleted with the container — the data would be lost.
Correct — named volumes are managed by Docker and survive container removal, which is exactly what stateful data needs.
Incorrect — images are read-only templates; running data does not belong baked into them.
Incorrect — env vars hold small config values, not a database’s data.
02Two containers on the same user-defined network can reach each other by…
Incorrect — IPs work but change on restart; user-defined networks add name resolution.
Incorrect — -p is for reaching a container from the host; internal traffic needs no publishing.
Correct — user-defined bridge networks resolve container names automatically — web can reach db as “db”.
Incorrect — volumes share files, not network connectivity.
03What does docker compose up do that starting containers by hand does not?
Correct — Compose brings up the whole stack — network, volumes, all services — reproducibly from one YAML file.
Incorrect — Compose is single-host; spreading across machines is orchestration (Swarm/Kubernetes).
Incorrect — Compose does not scan; that is a separate tool.
Incorrect — Compose can build from a Dockerfile — it does not replace it.
3 questions · explanations appear as you answer