Docker DCA Dumps Questions Answers

 The mnt namespace is not disabled by default and does not need to be enabled at Docker engine runtime to be used. The mnt namespace is one of the six Linux kernel namespaces that Docker uses to isolate containers from the host system1. The mnt namespace allows a container to have its own set of mounted filesystems and root directories, which are different from the host’s2. This means that a container can access only the files and directories that are mounted inside its namespace, and not the ones that are mounted on the host or other containers. The mnt namespace is created automatically when a container is started, and it is destroyed when the container stops3.

References:

• Isolate containers with a user namespace | Docker Docs
• The mnt namespace - Docker Cookbook - Second Edition
• Container security fundamentals part 2: Isolation & namespaces

mnt is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. According to the official documentation, mnt is one of the namespaces that are enabled by default when using namespaces for isolation.

References: https://docs.docker.com/engine/security/userns-remap/#user-namespace-known-limitations

The statement is correct. In the provided Docker Compose file, a health check is defined for the service “app”. It uses curl to perform a health check on the application every 10 seconds (as specified by the “interval” parameter). If it fails three times (as specified by the “retries” parameter), then the container is marked as unhealthy. A health check is a way of checking the health of a running container and applying actions based on the result1. It can be used to monitor the status of the service and restart the container if it becomes unhealthy2. References:

• Compose file version 3 reference | Docker Docs
• Docker Compose & Health Checks – Gabriel’s World

 The command docker service create -name dns-cache -p 53:53 -constraint networking.protocol.udp=true dns-cache will not create a swarm service that only listens on port 53 using the UDP protocol. This command has several syntax errors and invalid options. The correct syntax for creating a swarm service is docker service create [OPTIONS] IMAGE [COMMAND] [ARG...]1. The correct options for specifying the service name, port mapping, and network mode are --name, --publish, and --network respectively1. The option -constraint is not a valid option for the docker service create command. To create a swarm service that only listens on port 53 using the UDP protocol, you need to use the --publish option with the protocol=udp and mode=host parameters, and the --network option with the host value23. For example, the following command creates a global service using host mode and bypassing the routing mesh2:

docker service create --name dns-cache \

--publish published=53,target=53,protocol=udp,mode=host \

--mode global \

--network host \

dns-cache

References:

• 1: docker service create | Docker Docs
• 2: Use swarm mode routing mesh | Docker Docs
• 3: Manage swarm service networks | Docker Docs