Docker Certified Associate (DCA): key terms

Flashcards for this exam Docker Certified Associate (DCA) guide

• .dockerignoreA file that excludes paths from the Docker build context sent to the builder.Foundational
• Artifact SigningCryptographically signing build artifacts or container images so consumers can verify their origin and integrity.Advanced
• Bind MountMounting a specific file or directory from the host filesystem into a container.Foundational
• ContainerA lightweight, isolated runtime environment that packages an application with its dependencies and shares the host operating system kernel.Foundational
• Container EscapeBreaking out of a container's isolation to gain access to the host or other containers.Advanced
• Container ImageAn immutable, layered package containing an application, its runtime, libraries, and configuration, used to create containers.Foundational
• Container Image HardeningBuilding container images with minimal contents, non-root users and no secrets to reduce attack surface.Intermediate
• Container Image ScanningScanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.Intermediate
• Container RegistryA service that stores and distributes container images, such as Docker Hub, Amazon ECR, Azure Container Registry, Google Artifact Registry, Quay, or Harbor.Foundational
• Container RuntimeThe software that runs containers on a host, such as containerd, CRI-O, or the low-level runc.Intermediate
• containerdA CNCF graduated, industry-standard container runtime that manages image transfer, storage, and container execution.Intermediate
• Control Groups (cgroups)A Linux kernel feature that limits, accounts for, and isolates CPU, memory, I/O, and other resources for groups of processes.Advanced
• CosignSigstore's command-line tool for signing, verifying and attaching attestations to container images and other OCI artifacts.Advanced
• Distroless ImageA minimal container image containing only the application and its runtime dependencies, without a shell or package manager.Advanced
• DockerA platform and toolset for building, shipping, and running containers, including Docker Engine, the docker CLI, Docker Compose, and Docker Desktop.Foundational
• Docker ComposeA tool for defining and running multi-container applications using a compose.yaml file.Foundational
• Docker EngineThe client-server application consisting of the dockerd daemon, a REST API, and the docker CLI that builds and runs containers.Intermediate
• Docker HubDocker's public cloud registry hosting official images, verified publisher images, and user repositories.Foundational
• Docker LayerA read-only filesystem diff produced by a Dockerfile instruction; images are stacks of layers combined by a union filesystem.Intermediate
• Docker Network DriverThe networking mode for Docker containers: bridge, host, overlay, macvlan, ipvlan, or none.Intermediate
• Docker SwarmDocker's built-in container orchestration mode that clusters Docker hosts into managers and workers running replicated services.Intermediate
• Docker VolumeDocker-managed persistent storage that exists independently of a container's lifecycle.Foundational
• DockerfileA text file of instructions (FROM, RUN, COPY, CMD, and others) that Docker uses to build a container image.Foundational
• ENTRYPOINTA Dockerfile instruction defining the executable that always runs when a container starts; CMD supplies default arguments.Intermediate
• Image DigestThe immutable sha256 content hash that uniquely identifies a specific container image manifest.Intermediate
• Image ScanningAnalyzing container images for known vulnerabilities, misconfigurations, secrets, and license issues.Intermediate
• Image SigningCryptographically signing container images so deployment systems can verify their origin and integrity before running them.Intermediate
• Kubernetes Security ContextPod and container settings that define privilege and access controls, such as user ID, privilege escalation, capabilities and filesystem permissions.Advanced
• Linux NamespacesA Linux kernel feature that isolates process views of system resources such as PIDs, network, mounts, users, IPC, and hostnames.Advanced
• Multi-Stage BuildA Dockerfile technique using multiple FROM stages so build tools stay in early stages and only needed artifacts are copied to the final image.Intermediate
• Open Container Initiative (OCI)A Linux Foundation project defining open standards for container image format, runtime, and distribution.Intermediate
• PodmanA daemonless, open-source container engine from Red Hat with a Docker-compatible CLI that supports rootless containers and pods.Intermediate
• Port PublishingMapping a host port to a container port so external clients can reach a containerized service.Foundational
• Privileged ContainerA container run with all host capabilities and device access, effectively removing isolation from the host.Intermediate
• Rootless ContainerA container run by an unprivileged user, using user namespaces so root inside the container maps to a non-root host user.Advanced
• SeccompA Linux kernel feature that restricts which system calls a process may make, reducing kernel attack surface for containers.Advanced
• TrivyAn open-source security scanner from Aqua Security for container images, file systems, Git repositories, Kubernetes and IaC.Intermediate