Type the commands without looking, then press Enter: the check compares character for character (extra spaces ignored), so a valid variant may be rejected, open the answer then. For the other questions, answer before revealing: the recall effort is what makes it stick.
Rappel actif
Restitue de mémoire, sans support.
Contrast containers and VMs on four points: operating system, isolation, startup time and resource usage.
VM Container OS full guest OS + own kernel shares the host kernel Isolation hardware level, strong OS level (namespaces, cgroups), weaker Startup seconds to minutes (OS boot) milliseconds to seconds (no OS boot) Resources gigabytes per VM megabytes, ~its processes Name the six Linux namespaces from the course and what each isolates.
Namespace Isolates PID processes NET network interfaces MNT filesystem / mount points USER users / groups IPC IPC resources UTS hostname Trace
docker run nginxthrough dockerd, containerd and runc, in order.- CLI sends the request to the Docker API.
- dockerd checks whether the image is present.
- The image is pulled from the registry if needed.
- dockerd asks containerd to create and start the container.
- containerd invokes runc with the OCI bundle.
- runc sets up namespaces and cgroups on the kernel, then starts the process.
In short: dockerd decides, containerd manages, runc creates.
Tape la commande
Écris la commande exacte, puis Entrée pour vérifier.
Build an image tagged
myapp:1.0from the Dockerfile in the current directory.docker build -t myapp:1.0 .The final
.is the build context (where Docker looks for the Dockerfile and the files to COPY).List all containers, including stopped ones.
docker ps -adocker psalone shows only running containers.Open an interactive shell inside the running container named
web.docker exec -it web shexecruns a new command in an already-running container;-itattaches an interactive terminal.Remove the stopped container named
web, deleting its writable layer.docker rm webThis deletes the writable layer and its data. Stopping (not removing) would have kept it.
Show the logs of the container named
web.docker logs web
Écris-le
Rédige la requête, la configuration ou le code, puis compare avec la réponse.
Write a Dockerfile for a Python 3.12 app: work in
/app, copy the project in, install fromrequirements.txt, expose port 8000, and start it withpython app.py.FROM python:3.12-slim WORKDIR /app COPY . /app RUN pip install -r requirements.txt EXPOSE 8000 CMD ["python", "app.py"]RUNexecutes at build time (creates a layer);CMDis the default command at run time.
Distingue
Deux notions proches : dis ce qui les sépare vraiment.
Namespaces and cgroups: which question does each answer, and why do you need both for a usable container?
- Namespaces: “what can this process see?” (isolated view of PIDs, network, mounts…).
- cgroups: “how much can this process use?” (CPU, memory, I/O limits).
With namespaces only, an isolated container could still exhaust the whole host’s CPU or RAM. With cgroups only, processes would share one view and not be isolated. Together: isolation and predictable performance.
Image and container: what exactly is the difference, in terms of layers?
An image is a stack of read-only layers. Creating a container adds one writable layer on top (the container layer). All changes a running container makes go to that layer; the image layers stay read-only and are shared by many containers. The writable top layer is the whole difference.
dockerd, containerd and runc: what is each responsible for?
- dockerd: the daemon and API server; decides, manages images and containers (high level).
- containerd: high-level runtime; container lifecycle, images, snapshots (also used directly by Kubernetes).
- runc: low-level OCI runtime; actually creates namespaces and cgroups and starts the process.
Docker and Podman: name two architectural differences.
Podman is daemonless (no central
dockerd) and rootless by default, whereas Docker has a daemon and rootless is optional. Podman offers a Docker-compatible CLI and groups containers into pods. Both use namespaces + cgroups and OCI images.LXC and Docker both use namespaces + cgroups. What do they target differently?
LXC provides system containers: a full Linux distribution with several processes, managed like a lightweight VM. Docker provides application containers: one app plus a developer build/ship/run workflow (images, Dockerfile, registry).
Explique pourquoi
Le mécanisme derrière la règle.
Why do containers start in milliseconds while a VM takes seconds to minutes?
A VM boots a full guest OS (kernel, drivers, services) before the app runs. A container shares the host kernel and starts just the application’s processes in new namespaces, there is no OS to boot. That is also why a container weighs megabytes, not gigabytes.
Why is a container’s isolation “weaker” than a VM’s, and what is the security consequence?
All containers share the one host kernel; isolation is enforced by kernel features (namespaces, cgroups), not by separate virtual hardware. So a kernel vulnerability affects every container, and a container escape reaches the host. A VM has its own kernel behind a hypervisor, a stronger boundary.
Why does the layered image model save disk space and speed up builds?
Layers are content-addressed and shared between images via a union filesystem (OverlayFS): a base layer stored once is reused by every image that builds on it. On a rebuild, only the changed layers (and those above) are redone; unchanged lower layers are cached. Hence less disk and faster builds.
Why is data in a container called “ephemeral,” and how do you keep data that must survive?
Changes live only in the container’s writable layer, which
docker rmdeletes with the container. To persist data, store it outside the container: a volume or a bind mount, so it survives removal and can be shared.
Cas pratique
Choisis et justifie avec les critères du cours.
A team ships a microservice that “works on my machine” but breaks in testing because of dependency versions. How do containers fix this, and what single artifact guarantees the consistency?
The service is packaged with its runtime, libraries and config into an image. The same image runs identically from development to test to production, no environment-specific fixes. The image (built from a Dockerfile, pinned versions) is the artifact that guarantees consistency: build once, run anywhere a compatible engine exists.
You run 3 replicas of a web container across a cluster; one node dies. What does an orchestrator do, and which four jobs does it handle in general?
The orchestrator notices the desired state (“web x 3”) is no longer met and reschedules the lost replica onto a healthy node (self-healing), restoring 3.
Its four jobs: scheduling (place containers on the best node), scaling (add/remove replicas under load), self-healing (restart/reschedule failed ones), rolling updates (new version with no downtime).
Trouve l'erreur
Chaque affirmation contient au moins une faute.
“Docker is the Linux kernel feature that isolates containers.”
Docker is not the kernel mechanism. The isolation comes from kernel namespaces + cgroups; Docker orchestrates container creation through containerd and runc on top of those features. A Docker container is a process isolated by the kernel and managed by Docker tooling.
“Stopping a container deletes its data, so I stop containers to clean up.”
Stop keeps the writable layer and its data; the container can be started again. It is
docker rmthat deletes the writable layer and its data.“A Linux container image will run natively on a Windows host because containers are portable.”
Portability is within a compatible kernel family. A Linux container needs a Linux kernel; on Windows or macOS, Docker runs it inside a lightweight Linux VM. Containers share the host kernel, they do not carry their own.
Classe
Range chaque élément et explique les cas limites.
Match each milestone to what it brought: chroot (1979), FreeBSD Jails (2000), cgroups (2005-07), LXC (2008), Docker (2013).
- chroot: filesystem isolation.
- FreeBSD Jails: isolated system environments.
- cgroups: resource accounting and limits.
- LXC: Linux containers using namespaces + cgroups.
- Docker: the build/ship/run workflow (and Docker Hub).
For each need, pick an orchestrator: (a) learning on a small cluster; (b) production at any scale; (c) a team that does not want to run the control plane; (d) mixed workloads (containers, VMs, binaries).
(a) Docker Swarm; (b) Kubernetes; (c) Managed Kubernetes (EKS/AKS/GKE); (d) Nomad.
Et si...
Prévois la conséquence.
What if you set no cgroup memory limit on a container that has a memory leak?
Nothing caps its memory, so it can consume the host’s RAM and starve or crash other containers and the host itself (the OOM killer may fire). cgroups exist precisely so one container cannot exhaust the whole host.
What if an image built with Docker needs to run on a Kubernetes node that uses containerd or CRI-O, not Docker?
It runs fine. Thanks to the OCI image and runtime specs, an image built by Docker is portable across engines: containerd, CRI-O, Podman all consume OCI images and use runc/crun underneath. Docker is not required at runtime.