PDF DCA Study Guide

= This is not a way to configure the Docker engine to use a registry without a trusted TLS certificate. There is no such option as IGNORE_TLS in the daemon.json configuration file. The daemon.json file is used to configure various aspects of the Docker engine, such as logging, storage, networking, and security1. To use a registry without a trusted TLS certificate, you need to either add the certificate to the trusted root certificates of the system, or configure the Docker engine to allow insecure registries2. To add the certificate to the trusted root certificates, you need to copy the certificate file to the /etc/docker/certs.d// directory on every Docker host2. To configure the Docker engine to allow insecure registries, you need to add the registry hostname or IP address to the “insecure-registries” array in the daemon.json file3. For example:

{ “insecure-registries” : [“myregistry.example.com:5000”] }

Note that using insecure registries is not recommended, as it exposes you to potential man-in-the-middle attacks and data corruption3. You should always use a registry with a trusted TLS certificate, or use Docker Content Trust to sign and verify your images4. References:

Daemon configuration file | Docker Docs

Verify repository client with certificates | Docker Docs

Test an insecure registry | Docker Docs

Content trust in Docker | Docker Docs

= This strategy will not successfully accomplish this. A PersistentVolumeClaim (PVC) is a request for storage by a user that is automatically bound to a suitable PersistentVolume (PV) by Kubernetes1. A PV is a piece of storage in the cluster that has been provisioned by an administrator or dynamically provisioned using StorageClasses1. A hostPath is a type of volume that mounts a file or directory from the host node’s filesystem into a pod2. It is mainly used for development and testing on a single-node cluster, and not recommended for production use2.

The problem with this strategy is that it assumes that the hostPath /data on the node is the same as the /data directory on your laptop. This is not necessarily true, as the node may be a different machine than your laptop, or it may have a different filesystem layout. Also, the hostPath volume is not portable across nodes, so if your pod is scheduled on a different node, it will not have access to the same /data directory2. Furthermore,the storageClass parameter is not applicable for hostPath volumes, as they are not dynamically provisioned3.

To mount the /data directory on your laptop into a container, you need to use a different type of volume that supports remote access, such as NFS, Ceph, or GlusterFS4. You also need to make sure that your laptop is accessible from the cluster network and that it has the appropriate permissions to share the /data directory. Alternatively, you can usea tool like Skaffold or Telepresence to sync your local files with your cluster56. References:

Persistent Volumes | Kubernetes

Volumes | Kubernetes

Storage Classes | Kubernetes

Kubernetes Storage Options | Kubernetes Academy

Skaffold | Easy and Repeatable Kubernetes Development

Telepresence: fast, local development for Kubernetes and OpenShift microservices

 A DTR security scan will detect licenses for known third party binary components. This is because DTR security scan uses a database of vulnerabilities and licenses that is updated regularly from Docker Server1. DTR security scan can identify the components and versions of the software packages that are present in the image layers, and report any known vulnerabilities or licenses associated with them2. This can help users to comply with the licensing requirements and avoid potential legal issues3. References:

Set up vulnerability scans | Docker Docs

Scan images for vulnerabilities | Docker Docs

Container Security 101 — Scanning images for Vulnerabilities

 The command docker network create -d overlay -o encrypted=true  will ensure that overlay traffic between service tasks is encrypted. This command creates an overlay network with the encryption option enabled, which means that Docker will create IPSEC tunnels between all the nodes where tasks are scheduled for services attached to the overlay network. These tunnels use the AES algorithm in GCM mode and manager nodes automatically rotate the keys every 12 hours1. This way, thedata exchanged between containers on different nodes on the overlay network is secured. References:

Overlay network driver