This exam closes the "Administer the daemon" module of the Docker course. The mission: a Docker host has been running for two years, the person who set it up has left, the disk is filling up and nobody knows who can talk to the engine anymore. You must take it back in hand: write its configuration, free up space without losing data, remove the direct accesses that are no longer needed, protect the socket and close the network API. It teaches you nothing new, it checks what you learned. Allow about 60 minutes on a virtual machine running Docker Engine 29.9.2.
What you will learn
- Say what the exam expects and on which state of the system it grades you.
- Spot the lessons to review before you start.
- Work out, depending on the hints requested, the checks you must pass to reach the threshold.
- Read your result to decide whether to move on or to consolidate.
Prerequisites
The lessons of the administration module must be finished, up to Run Docker in rootless mode. The exam assumes that you know how to configure the daemon, clean up a host without destroying what matters, and say who can talk to the engine. Rootless mode is taught just before, but it is not part of this exam: you do not have to set it up here.
Use the lab environment you used for the previous lessons. The two images you need are provided: there is nothing to build.
What does the exam ask of you?
The statement describes a neglected host that runs an application and an inventory tool. At the end, the state of the machine must show five things:
- the daemon is configured with log rotation, it has been restarted, and the application is still running;
- the space used for nothing is freed, and the host's two named volumes are intact with their data;
- the
dockergroup contains only the accounts that should be in it; - the inventory tool no longer reaches the daemon socket: it goes through a read-only proxy, provided as an image, that lets a read through and refuses a stop;
- the daemon no longer listens on any TCP socket without TLS.
No command is imposed. The full statement, with the names of the accounts, the volumes and the tool, is read in the lab, and only there.
How is it graded?
The lab does not read the commands you typed. It reads back the state of the system at the moment you hand in your work. Five checks of equal weight share the grade.
| Check | What is read |
|---|---|
| Log rotation | A container created after your intervention carries the rotation, and the application is still running |
| Space freed, useful volume intact | The leftovers of an unmaintained host are gone, and the named volumes keep their data |
docker group | The account to remove is no longer in it, the one that administers the machine stays, and nobody else has moved |
| Read-only proxy | The tool no longer mounts the socket, the proxy lets a read through and refuses a stop |
| No TCP API without TLS | The daemon no longer listens on a TCP socket without TLS |
The first check reads a container created by the lab itself: an intention written in a file is not enough, it takes an observable fact.
The fourth measures two things. Removing the socket mount is not enough if the proxy lets everything through.
The fifth reads the real state of the daemon, its listening sockets and its launch command line, not a configuration file. It rejects any TCP listening by the daemon, with or without TLS.
The threshold is 75 points, and one requirement is offset by no total: the check on the space freed without losing a named volume must pass. Losing a named volume fails the exam even with the four other checks passed. A failure repaired late costs time, a lost piece of data cannot be recovered. The 75-point threshold may be recalibrated after the first attempts.
Which rules apply?
This exam measures, it does not guide you. Three rules follow from that.
- The lab offers four hints, from the vaguest to the most explicit, which cost 10, 15, 20 and 25 points, and whose costs add up. The score is the share of checks passed, multiplied by a scale of 100 points minus the cost of the hints requested.
- You may consult the lessons of the course and the official Docker documentation, as you would at work.
- The statement explains nothing again: the lessons of the module have already taught what you need to know.
With five checks, each is worth a fifth of the scale. The table shows the margin left by each level of hints.
| Hints requested | Scale | Checks to pass |
|---|---|---|
| None | 100 | 4 out of 5 (80 points) or 5 out of 5; 3 out of 5 give 60 |
| The first | 90 | 5 out of 5 (90 points; 4 out of 5 give 72) |
| The first two | 75 | 5 out of 5 (75 points, right at the threshold) |
| Three or more | 55 at most | Threshold not reachable |
In every case, the check on the space freed without losing a volume must be among the checks passed.
Which lessons should you review before starting?
The statement does not say which actions it asks for, and this list does not try to point them out either. It gathers the lessons of the module that teach an action useful here. Start by rereading those where your last labs were difficult.
- Rotate Docker logs and reclaim disk space
- Remove direct access to the Docker daemon
- Put a proxy in front of the Docker API
- Upgrade Docker Engine and back up its configuration
Take the exam
The lab prepares the machine, gives you the statement, then grades the state in which you leave it. Start it when you have about 60 minutes ahead of you, so that you can work in one go.
From your lab environment, the command is launched like this:
dsoxlab run epreuve-reprendre-un-hote-dockerThe statement is displayed, you work on the machine, then the lab plays its five checks. Read the result check by check: a message describes what is missing from the final state, never the command to type.
After the exam
If you clear the threshold with the volume check passed, you know how to take over a Docker host, on the points measured. You can move on to the rest of the course. A result under the threshold does not mean that you failed to learn: it shows where the gap is.
Link each failed check to a lesson in the list above, reread it, then redo the action yourself. Do not try to memorize an answer.
Key points
- The exam is a measurement: nothing is explained again, hints cost points, and the grade covers the final state of the machine, not your commands.
- You need 75 points. With no hint, four checks out of five are enough; with one or two hints, all five must pass; beyond that, the threshold is no longer reachable.
- Losing a named volume fails the exam whatever the total: a volume that nobody mounts is not for that reason a useless volume.
- A configuration proves nothing until it is applied: the lab reads what the daemon does, not what a file announces.
- Rootless mode is not part of this exam.