Task 1.4: Containerization

• AContainer images are compiled to machine code and need no libraries

  Incorrect

  Images still package the libraries and files the application needs; they are not compiled binaries.

• BContainers run without isolation from one another, which saves the memory a VM would use

  Incorrect

  Containers are isolated with kernel features; they just do not need a separate kernel for it.

• CContainers share the host kernel; each VM boots its own guest operating system

  Correct

  A container is an isolated process with the files it needs; there is no guest kernel to boot or keep in memory.

• DThe hypervisor merges identical virtual machines into one at runtime

  Incorrect

  Hypervisors do not merge guest systems; each VM keeps its own operating system.

The density difference comes from the kernel: every VM brings its own operating system, while containers are processes that share one kernel.

• ABy the tag v2.1, with imagePullPolicy set to Always in the Pod spec

  Incorrect

  Always pulls whatever v2.1 points to at start time, so a re-pushed tag would change the content.

• BBy the tag latest so the nodes agree on one name

  Incorrect

  latest is just another movable tag and changes with every push.

• CBy the tag v2.1 with imagePullPolicy set to Never

  Incorrect

  Never uses whatever copy each node already has, which can differ from node to node.

• DBy its digest, such as registry.example.com/app@sha256:<hash>

  Correct

  A digest is a hash of the image content and is immutable, while a tag can be moved to another image.

Tags are names that can be re-pointed; digests identify content. Pin a digest when the bytes must not change.

• AimagePullPolicy set to Always

  Incorrect

  The pull policy decides when to pull, not how to authenticate; the pull would still be refused.

• BAn imagePullSecrets entry that names the Secret

  Correct

  The kubelet uses the Secrets listed in imagePullSecrets to authenticate to the registry when it pulls the image.

• CenvFrom referencing the Secret

  Incorrect

  envFrom gives the values to the running container, but the image has to be pulled before any container runs.

• DA ConfigMap volume that contains the registry address

  Incorrect

  The registry is already part of the image name, and a ConfigMap carries no credentials.

Registry credentials reach the kubelet through imagePullSecrets, which reference Secrets in the same namespace as the Pod.

• AThe Container Runtime Interface (CRI)

  Correct

  CRI is the plugin interface, a gRPC protocol, through which the kubelet uses any compliant runtime without recompiling.

• BThe Container Network Interface (CNI)

  Incorrect

  CNI is how network plugins give Pods their networking. It does not run containers.

• CThe Container Storage Interface (CSI)

  Incorrect

  CSI connects storage drivers to the cluster for volumes, not runtimes.

• DThe OCI Image Specification

  Incorrect

  The image specification defines the format of an image, such as its manifest and digest; it is not the channel between the kubelet and a runtime.

The kubelet talks to its container runtime over CRI, so any runtime that implements CRI can be plugged in.

• ABuild with the --no-cache option so stale layers are not reused

  Incorrect

  That disables the cache entirely, so every build reinstalls dependencies.

• BSwitch to a smaller base image so each rebuild has fewer layers to download

  Incorrect

  A smaller base image saves size, but the install layer still follows the source copy and is rebuilt every time.

• CAdd node_modules to .dockerignore so the build context stays small

  Incorrect

  Excluding node_modules keeps the build context small, but the install layer still comes after the source copy and is rebuilt on every change.

• DCopy only the package files, run npm ci, then copy the rest of the source

  Correct

  When a layer's input changes, it and every later layer are rebuilt. Installing dependencies before the source copy keeps that layer cached until the lock file changes.

Docker reuses cached layers until an instruction's inputs change, then rebuilds from there. Order instructions from least to most frequently changing.

• ALinux namespaces

  Correct

  Namespaces give a container its own view of processes, network, mounts and more, isolating it from the host and other containers.

• BHypervisor guest kernels

  Incorrect

  That is how virtual machines isolate workloads; containers share the host kernel.

• Ciptables port rules

  Incorrect

  iptables rules route traffic to containers, but they do not isolate processes or cap resources.

• DHost swap space

  Incorrect

  Swap extends memory; it neither isolates nor limits a container.

• EControl groups (cgroups)

  Correct

  cgroups account for and limit CPU, memory and other resources per container.

A container is an ordinary process placed in its own namespaces and constrained by cgroups. No guest kernel is involved.

• AOne Pod, because they talk to each other

  Incorrect

  Communication alone does not require one Pod; Services connect separate Pods.

• BSeparate Pods, because Kubernetes runs one container per Pod

  Incorrect

  A Pod can run several tightly coupled containers that share resources, so that is not the reason; the two tiers belong apart because they scale and fail independently.

• CSeparate Pods, because the two scale and fail independently

  Correct

  Several containers belong in one Pod only when they are tightly coupled and must share resources; one container per Pod is the common case.

• DOne Pod, with the database as an init container that starts first

  Incorrect

  Regular init containers run to completion before the app containers start, so a database that has to keep serving cannot be one, and the two tiers would still be scaled and replaced together.

Group containers in one Pod only when they form a single unit, such as an app and its helper. Independent tiers belong in their own Pods.

• AA larger container writable layer

  Incorrect

  The writable layer belongs to one container and goes away with it.

• BA Docker volume mounted at the database's data directory

  Correct

  Volumes persist data beyond the lifecycle of an individual container.

• CThe --restart always option

  Incorrect

  A restart policy restarts containers; a removed container still loses its data.

• DCommitting the container to a new image after each change

  Incorrect

  Images are for software, not live database files, and commits miss data written later.

Containers are ephemeral; volumes give data a lifecycle of its own.

• AAn image is a running container that has been paused for later

  Incorrect

  Images are not running processes.

• BA container is a compressed copy of an image stored in a registry

  Incorrect

  Registries store images; containers run on hosts.

• CImage and container are two names for the same thing

  Incorrect

  They are different; one is the package, the other the running process.

• DAn image is the packaged files; a container runs from it

  Correct

  A container image is a standardized package of files, binaries, libraries and configuration, and containers run from it.

Images are what you build and ship; containers are what you run from them.

• ACopy the files over localhost with an HTTP server

  Incorrect

  That is possible but needless; shared volumes are built for this.

• BWrite the files into a ConfigMap from the application

  Incorrect

  ConfigMaps hold configuration through the API, not files produced at runtime.

• CUse the container image's file system, which is shared

  Incorrect

  Each container has its own file system from its own image.

• DMount one shared volume, such as an emptyDir, in both

  Correct

  Containers in a Pod can share volumes, so both see the same files.

Pods give their containers shared storage through volumes, alongside the shared network.