Level 2 exam — Docker · GUIDINEE.COM

Exam — fresh questions

12 brand-new questions: recall + application + arbitration on Dockerfile, build, tags, configuration and security.
Answer everything, then click Check: your score and explanations will appear.

2.1 · Recall

1. In a Dockerfile, what does RUN do compared to CMD?

Both launch the server CMD installs, RUN launches RUN installs during the build (frozen layer), CMD launches at start time It is the same thing

RUN = building (installing), CMD = running (starting) on every run.

2.1 · Application

2. Idir writes his first Node Dockerfile. Which order is correct?

CMD first, FROM at the end, no WORKDIR RUN node server.js then COPY, no FROM FROM with no CMD or EXPOSE, launch in RUN FROM node:20-slim, WORKDIR /app, COPY, RUN npm ci, EXPOSE, CMD

Base, folder, code, install at build time, declared port, launch at run time.

2.1 · Application

3. Idir's build fails. Where does he look first?

In the Compose .env file In the prod container logs On the Docker Hub registry In the last displayed step of the build

The last step is to blame: missing dependency, typo, network.

2.2 · Recall

4. Why place dependencies BEFORE the code in a Dockerfile?

So the image is public To preserve the cache: a code change does not replay the install To remove the CMD To skip docker login

Stable first (cached), changing after (replayed alone).

2.2 · Application

5. Idir's image exceeds 1 GB with the SDK shipped to prod. What does he do?

He puts the password in ENV He pushes to latest with no tag He removes the CMD He switches to multi-stage: tooled build, slim runtime via COPY --from=build

Build fat, ship lean: only the runnable reaches the final image.

2.2 · Arbitration

6. Idir hesitates between optimizing by gut feeling or measuring. What do you advise?

Remove the .dockerignore to go fast Ship the SDK to keep it simple Optimize blindly, it is faster Measure with docker images + history before/after, then optimize

Optimize what you measure: total size + weight per layer.

2.3 · Application

7. Idir publishes the tested 1.2.0 version. Which sequence is correct?

push with a secret in ENV, no login docker build -t moncompte/mon-app:1.2.0, login, push 1.2.0, pull elsewhere push with no build or tag, as root build with no tag then run in prod

Tag at build time (account included), authenticate, push, pull elsewhere.

2.3 · Arbitration

8. Idir's prod pulls latest and drifts on every push. Which policy does he enforce?

No tag, build on every run Rewrite 1.2.0 on every fix One immutable tag per release (1.2.0) for prod, aliases for dev Keep going with latest, it is simpler

Prod = frozen, tested tag, never rewritten; latest stays a dev comfort.

2.4 · Recall

9. What is the difference between ARG and ENV?

No difference ENV is for build then vanishes, ARG persists at run time ARG and ENV launch the server ARG is for the build then vanishes, ENV persists at run time and overrides

ARG builds (build), ENV runs (run): do not mix them up.

2.4 · Application

10. Idir serves dev (3000) and staging (8080) with the same 1.0 image. How?

Default ENV PORT=3000, -e PORT=8080 override at launch Two different images per port Hardcoded port + rebuild per environment Secret as frozen ENV in the Dockerfile

Sane default + -e override: one image, N environments.

2.5 · Application

11. Idir's image runs as root. Which hardening does he apply?

Stay root to keep it simple Remove CMD and EXPOSE Dedicated USER before CMD, ownership adjusted, whoami checked Put the secret as ENV in the Dockerfile

Two lines (dedicated USER) + check: no more default root.

2.5 · Arbitration

12. Idir must handle a sensitive key before a public push. What does he choose?

Put it as frozen ENV in the Dockerfile Copy it via COPY into the image Inject it at run time (managed secrets), excluded from the context and history Commit it in the .env pushed to git

Zero secrets in the image: injected at run time, never committed, public push is irreversible.

What's next?

Score ≥ 80%: move to Level 3 — Compose and multi-container stacks, keeping your reflexes (lean Dockerfile, frozen tags, config outside the image, non-root).
Score 60-79%: revisit the failed sections (2.1 RUN/CMD, 2.2 cache and multi-stage, 2.3 immutable tags, 2.4 ARG/ENV, 2.5 non-root and secrets) and redo the 48h challenges.
Score < 60%: rebuild Idir's app step by step (7-line Dockerfile, cache + multi-stage, push 1.0.0, ENV PORT, USER + scan), then retake the test.
In any case: keep the reflexes — RUN builds and CMD starts, stable first, frozen tags, config outside the image, zero embedded secrets.