Container Orchestration Flashcards
What two problems do containers solve?
1) Managing the dependencies of an application
2) Runs much more efficiently than spinning up a lot of virtual machines
What is one of the earliest ancestors of modern container technologies?
chroot
What does the “chroot” command do?
The chroot command can isolate a process from the root filesystem, “hide” the files from the process and simulate a new root directory.
What are the eight namespaces of the Linux 5.6 Kernel?
1) pid (process id)
2) net (network)
3) mnt (mount)
4) ipc (inter-process communication)
5) user
6) uts (Unix time sharing)
7) cgroup
8) time
What is the difference between a virtual machine and a container?
A virtual machine emulates a complete machine and has its operating system and kernel. Containers share the kernel of the host machine and are isolated processes.
True or False
You need to use Docker to run industry-standard containers.
False
What’s the name of the container runtime reference implementation that the Open Container Initiative maintains?
runC
What is the primary use of runC?
runC is a low-level runtime used in a variety of tools to start containers, including Docker.
What does the runtime-spec describe?
The runtime-spec describes how to unpack a container image and manage the complete container lifecycle.
__________ provides a similar API as Docker and can be used as a drop-in replacement.
Podman
What is a container image?
A container image is a lightweight, standalone, executable package of software that includes everything needed to run an application, including code, runtime, system tools, system libraries and settings.
What do container images consist of?
Container images consist of a filesystem bundle and metadata.
Images can be built by reading the instructions from a buildfile called a __________.
Dockerfile
What is the purpose of a container registry?
Container registries act as a container distribution serve, where developers can upload and download different container images.
What is one of the biggest security risks of containers and why?
One of the biggest security risks of containers is that they share the same kernel as the machine they run on. This is a security risk because containers can run kernel processes with elevated privileges, which could unintentionally alter the host system.
True or False.
Public image registries are completely safe to use.
False
What are the 4C’s of Cloud Native security?
Code, container, cluster, cloud
What problems can be solved by container orchestration?
1) Providing compute resources like virtual machines where containers can run on
2) Schedule containers to servers in an efficient way
3) Allocate resources like CPU and memory to containers
4) Manage the availability of containers and replace them if they fail
5) Scale containers if load increases
6) Provide networking to connect containers together
7) Provision storage if containers need to persist data
What do container orchestration systems provide?
Container orchestration systems provide a way to build a cluster of multiple servers and host the containers on top.
A ________ is responsible for the management of containers and __________ host the containers.
Control plane; worker nodes
__________ namespaces allow each container is have their own unique ___________.
Network; IP address
True or False.
Containers have the ability to map a port from the container to a port from the host system.
True
What is the chroot isolated environment sometimes called?
chroot jail
Define Service Discovery.
Service Discovery is finding other services in the network and requesting information about them.
In container orchestration, where is service information stored?
In a Service Registry
What are the two most-used approaches to Service Discovery?
DNS and Key-Value-Store
What is a proxy?
A proxy is a server application that sits between the client and server and can modify or filter network traffic before it reaches the server.
What are some common proxy technologies?
1) nginx
2) haproxy
3) envoy
What does a service mesh do?
A service mesh adds a proxy server to every container.
What are the two most popular service meshes?
1) istio
2) linkerd
The proxies in a service mesh form a ______ ______.
data plane
What does a data plane do?
Data planes implement network rules and shape traffic flow.
Networking rules are managed centrally in the ______ ______ of a service mesh.
control plane
What does a service mesh control plane do?
It defines how traffic flows between services and what configuration should be applied to the proxies.
If a container needs to persist data on a host, a ______ can be used to achieve that.
Volume
What is the primary weakness of container volumes?
They give access to the host filesystem.
Container orchestration systems like Kubernetes can help to mitigate the problems with using container volumes, but always require a robust ______ _______ system that is attached to the host servers.
Central storage
