Docker in depth

Correct — ENV, LABEL, USER and CMD add history entries marked empty_layer and no filesystem layer at all, so there is nothing to merge away.

Correct — BuildKit attaches a minimal provenance attestation by default, so even a single-platform build becomes an index, and the containerd store uses that index digest as the image ID.

Correct — In name:tag@digest the tag is only there for people reading the file; the digest decides which bytes run.

Correct — A re-push from that host cannot rebuild the original index digest. docker buildx imagetools create copies the index registry-side and avoids the local store.

Correct — The containerd store drops the old image record when the tag moves, and the earlier builds' results stay in the build cache. Trim it with docker builder prune and a budget.

Correct — The ignore file decides how much of the directory is sent, and with a bind mount it also decides what the build can see. In the lab the build sent 35.01MB without the ignore file and only a few bytes of metadata with it.

Correct — The lab built without the secret and passed from cache; the same build with --no-cache failed with secret api_token: not found.

Correct — Without an output, the docker-container builder keeps the result as cache only. Pass --load or --push, and name the builder with --builder in scripts.

Correct — A docker-container builder runs its own BuildKit and supports every cache backend and output the lesson covered.

Correct — binfmt_misc does the emulation in the kernel. The default builder reads the supported platforms when dockerd starts, so only the listing lags.

Correct — containerd keeps Docker's containers in the moby namespace, and its task list shows they are running even while dockerd is stuck.

Correct — dockerd keeps its containers in moby; sudo ctr -n k8s.io containers ls lists the pod containers.

Correct — Without bip, dockerd reuses the bridge's existing address, and live-restore stops it from re-creating the bridge. With live-restore off it would be re-created from the pools. Set bip to choose the range in every case.

Correct — Once legacy-store directories exist, dockerd keeps using that store unless the containerd store is requested explicitly. The images were hidden, not deleted.

Correct — The container starts and the driver buffers and reconnects in the background, as the lab showed.

Correct — findmnt on that mount point shows the upper directory under containerd's snapshotter, and ctr -n moby snapshots info <id> describes the same snapshot.

Correct — Automatic selection skipped overlay2 without a d_type message and settled on vfs, which has no copy-on-write. Reformat with ftype=1 and alert on the driver.

Correct — --tmpfs takes raw mount options, and exec lifts the restriction. Keep the size: without one the limit is half the host's RAM.

Correct — The lab ran down -v and lab-shared was still listed. That is the reason to declare long-lived data volumes external.

Correct — NAT rules inside the container send port 53 to ports dockerd listens on. With dockerd gone, nothing answers.

Correct — ipvlan containers are told apart by IP, not MAC, which suits ports and cloud networks that accept one MAC.

Correct — Loopback is excluded from the DNAT rules, so docker-proxy accepts the connection and dials the container itself. conntrack shows the two halves.

Correct — The iptables backend set FORWARD to DROP when it enabled forwarding, and that policy still drops packets Docker's nftables rules accepted. Forwarding itself stayed on from the earlier start; on a fresh boot Docker reports an error if a network needs forwarding and it is off. Once the host forwards freely, add your own nftables rules that block forwarding between non-Docker interfaces.

Correct — DNAT carried the SYN to the container, whose kernel refused it, and docker-proxy accepted the loopback client and reset it when its own connection failed.

Correct — Two managers need both for a majority, and there are now two machines that can fail. Run three, or five to survive two failures.

Correct — The manager stays locked until the unlock key is provided. Keep the key away from the cluster, and know that losing it with every manager locked is unrecoverable.

Correct — Services start in parallel and are restarted until they stay up. The short depends_on list is accepted but orders nothing in Swarm.

Correct — Swarm applies these fields when it mounts the secret; the lab mounted the Postgres secret as UID 70 with mode 0400 that way.

Correct — Encrypted overlays use IPsec ESP between every pair of nodes, and many security group templates do not include protocol 50.

Correct — With no passwd entry HOME is /, which the app user cannot write. A container is managed with signals, so the socket is not needed.

Correct — During first start the image runs a temporary server for the init scripts. Only the real server listens on TCP, so dependants wait for it.

Correct — Test from another container on the network, as the recipe's psql tools service does, where a SCRAM password is required.

Correct — The recipe logs in as app and greps the reply for PONG, so a refused login fails the check.

Correct — A single-file bind mount follows the inode. Tools that write in place are fine; tools that rename need a directory mount or a recreated container.

Correct — The first start creates wp with the current password, and the dump adds the site's tables.

Correct — Scratch data gets a tmpfs, data that must survive gets a volume. Run those paths before shipping.

Correct — Use exec-form CMD, handle SIGTERM, and run an init process so the signal reaches the app.

Correct — Those belong to the run configuration (Compose, Swarm, Kubernetes), so check the running container, not only the image.

Correct — The lab's first run stopped at the scan and the build registry's catalog was empty: the failed image exists only on the build machine.

Correct — imagetools create copies the index and what it references, and Cosign's signature and attestation live in a separate artifact under that tag. On a registry with the referrers API there is no such tag, and oras cp -r copies the image with its referrers.