PDF DCA Study Guide

 SELinux could be blocking the operation of setting the system time from inside a Docker container. SELinux is a security mechanism that enforces mandatory access control (MAC) policies on Linux systems. It restricts the actions that processes can perform based on their security contexts, such as user, role, type, and level. By default, SELinux prevents Docker containers from accessing or modifying the host’s system time, as this could pose a security risk or cause inconsistency. To allow Docker containers to set the system time, SELinux needs to be configured with the appropriate permissions or labels, or disabled altogether. However, this is not recommended, as it could compromise the security and stability of the system. References:

• Change system date time in Docker containers without impacting host
• Change Date Inside a Docker Container
• How to Handle Timezones in Docker Containers
• 5 ways to change time in Docker container
• How to set system time dynamically in a Docker container

= SAML is a supported user authentication method for Universal Control Plane (UCP). UCP has its own built-in authentication mechanism and integrates with LDAP and Active Directory. It also supports Role Based Access Control (RBAC) and Docker Content Trust. UCP allows you to configure SAML as an authentication method and connect it to your Identity Provider (IdP). You need to provide the Entity ID and the ACS URL from UCP to your IdP, and the SAML Sign-on URL and the x509 Certificate from your IdP to UCP12. References:

• SAML | Docker Docs
• Configure Single Sign-On | Docker Docs

= The pid namespace is not a Linux kernel namespace that is disabled by default and must be enabled at Docker engine runtime to be used. The pid namespace is one of the six namespaces that are enabled by default when you run a container with Docker1. The pid namespace isolates the process ID number space, meaning that processes in different pid namespaces can have the same PID2. This allows containers to have their own init process with PID 1 and to limit the visibility and interaction of processes between containers and the host3. To disable the pid namespace, you need to use the --pid option with the docker run command and specify the host or another container as the pid mode. References:

• Docker run reference | Docker Docs
• pid_namespaces(7) - Linux manual page - man7.org
• Building containers by hand: The PID namespace - Enable Sysadmin
• [Share host and container processes with --pid | Docker Docs]

The command docker inspect nodes will not list all nodes in a swarm cluster from the command line. This is because docker inspect requires one or more names or IDs of the objects to inspect1. To list all nodes in a swarm cluster, you need to use the command docker node ls2, which will display information such as node ID, hostname, status, availability, and role3. References:

• docker inspect | Docker Docs
• docker node ls | Docker Docs
• How to list nodes in a Docker swarm cluster