Docker DCA Exam Dumps

Image role-based access control isnota function of UCP. UCP has its own built-in authentication mechanism and integrates with LDAP services.It also has role-based access control (RBAC), so that you can control who can access and make changes to your cluster and applications1.However, image role-based access control is a feature of Docker Trusted Registry (DTR), which integrates with UCP and allows you to manage the images you use for your applications2.DTR lets you define granular permissions for images, such as who can push, pull, delete, or scan them3.Reference:Universal Control Plane overview), Docker Trusted Registry overview),Docker Access Control)

= Multi-stage builds allow you to use multiple FROM statements in your Dockerfile, each starting a new stage of the build1.This can help you achieve better logical separation of Dockerfile instructions for increased readability, as well as other benefits such as smaller image size, faster build time, and reduced security risks23. By separating your Dockerfile into different stages, you can organize your instructions by their purpose, such as building, testing, or deploying your application.You can also copy only the artifacts you need from one stage to another, leaving behind the unnecessary dependencies or tools1. This can make your Dockerfile easier to read and maintain, as well as improve the performance and security of your final image.Reference:

Multi-stage builds | Docker Docs

What Are Multi-Stage Docker Builds? - How-To Geek

Multi-stage | Docker Docs

Runningdocker engine activatewill upgrade Docker Engine CE to Docker Engine EE. This is a feature that allows you to switch from the Community Edition to the Enterprise Edition without reinstalling Docker or losing any data.You need to have a valid license file and a subscription to Docker EE to use this feature1.Docker EE is a premium version of Docker CE that offers additional features, such as security scanning, image management, and certified plugins23.Reference:

Upgrade Docker Engine | Docker Docs

What is the exact difference between Docker EE (Enterprise Edition), Docker CE (Community Edition) and Docker (Custom Support) - Stack Overflow

Docker Community Edition or Docker Enterprise Edition - Docker | BoxBoat

= The commanddocker run -add-volume /data /mydata -read-only ubuntuwill not mount the host's/datadirectory to the ubuntu container in read-only mode. The reason is that the command has several syntax errors and invalid options.The correct command to mount a host directory to a container in read-only mode isdocker run --mount type=bind,source=/data,target=/mydata,readonly ubuntu12. The commanddocker run -add-volume /data /mydata -read-only ubuntuhas the following problems:

The option-add-volumeis not a valid option fordocker run.The valid options for mounting a volume or a bind mount are--mountor-v12.

The option-read-onlyis not a valid option fordocker run.The valid option for making the container's root filesystem read-only is--read-only3.However, this option will not affect the mounted volumes or bind mounts, which have their ownreadonlyoption12.

The argument/data /mydatais not a valid argument fordocker run.The argument fordocker runshould be the command to run inside the container, such asbashorping4.The source and target of the volume or bind mount should be specified in the--mountor-voption, separated by a colon12.

Therefore, the commanddocker run -add-volume /data /mydata -read-only ubuntuwill not work as intended, and will likely produce an error message or an unexpected result.Reference:

Use bind mounts

Use volumes

docker run

Docker run reference

n: = Using the DTR web UI to make all tags in the repository immutable is not a good way to prevent an image, such as 'nginx:latest', from being overwritten by another user with push access to the repository. This is because making all tags immutable would prevent any updates to the images in the repository, which may not be desirable for some use cases. For example, if a user wants to push a new version of 'nginx:latest' with a security patch, they would not be able to do so if the tag is immutable.A better way to prevent an image from being overwritten by another user is to use the DTR web UI to create a promotion policy that restricts who can push to a specific tag or repository1.Alternatively, the user can also use the DTR API to create a webhook that triggers a custom action when an image is pushed to a repository2.Reference:

Prevent tags from being overwritten | Docker Docs

Create webhooks | Docker Docs