Study Hub / Docker Certified Associate (DCA) / Domain 3.0
Docker Certified Associate (DCA) Domain 3.0: Installation and Configuration — Explained
Domain 3.0 is about the Docker platform itself: installing the engine, choosing storage and logging drivers, and configuring the daemon. Less glamorous than orchestration — and exactly the kind of conceptual material worth understanding deeply.
The engine and its pieces
- Docker Engine — the client-server platform: the daemon (dockerd) does the work (builds, runs, manages), the CLI talks to it via API, and containerd handles container lifecycle underneath.
- Installation concepts — Engine on Linux (native, the reference platform), Docker Desktop (Mac/Windows, runs a Linux VM under the hood). Production = Linux hosts, kept patched, running supported Engine versions.
- Daemon configuration —
daemon.json: the central config file (storage driver, log driver, insecure registries, live-restore). Changes need a daemon reload — plan it. - Namespaces and cgroups (the Linux magic) — namespaces isolate what a container sees (its own PIDs, network, mounts); cgroups limit what it may use (CPU shares, memory caps). Containers aren't VMs — they're isolated Linux processes.
Storage drivers: how layers become filesystems
- What a storage driver does — stacks image layers into one unified view and manages the container's writable layer. The driver choice affects performance and stability.
- overlay2 — the modern default on Linux: fast, stable, efficient. The answer unless there's a specific reason otherwise.
- Volumes vs. bind mounts vs. tmpfs — volumes (managed by Docker, in /var/lib/docker) are the right way to persist data; bind mounts map arbitrary host paths (convenient, host-dependent); tmpfs lives in RAM only (sensitive temp data that must never touch disk).
- Backing filesystem matters — overlay2 wants xfs (with d_type) or ext4. The exam occasionally probes this pairing.
Logging drivers and daemon hardening
- Logging drivers — where container stdout/stderr goes:
json-file(default, local files),syslog,journald,none, cloud drivers (awslogs, gcplogs).docker logsonly works with drivers that keep local copies. - Log rotation — json-file grows forever by default; configure max-size/max-file or disks fill at 3 AM. An operations classic.
- Daemon hardening basics — TLS for the remote API (never expose the Docker socket unauthenticated), keep the engine patched, run containers as non-root where possible, and treat the Docker socket mount as root-equivalent (it is).
- Live restore — keeps containers running across daemon restarts/upgrades. The difference between "engine upgrade" and "engine upgrade with an outage."
The must-memorize table: data persistence options
Where the data lives determines whether it survives.
| Option | Managed by | Survives container removal? | Use for |
|---|---|---|---|
| Volume | Docker | Yes | Production persistent data |
| Bind mount | You (host path) | Yes (it's the host's file) | Dev, config injection, host files |
| tmpfs mount | Memory | No | Sensitive temp data, never on disk |
| Container writable layer | Storage driver | No | Ephemeral scratch only |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A database container must keep its data after the container is removed and recreated during upgrades. Which storage should it use?
- A. A. The container's writable layer — simplest
- B. B. A Docker volume — managed persistent storage independent of container lifecycle
- C. C. A tmpfs mount — fastest
- D. D. ENV variables
Show answer & reasoning
B. Volumes exist independently of any container: remove and recreate the database container and the volume (with the data) reattaches. The writable layer (A) dies with the container; tmpfs (C) dies with the host's RAM; ENV (D) isn't storage at all. "Survive the container" → volume.
2. Container logs are filling the host disk because json-file logging has no rotation configured. What is the fix?
- A. A. Switch to the "none" log driver
- B. B. Configure log rotation (max-size / max-file) for the json-file driver
- C. C. Delete /var/log manually every day
- D. D. Run fewer containers
Show answer & reasoning
B. The json-file driver keeps every log line forever unless told otherwise — rotation caps each file's size and count. "None" (A) blinds operations entirely; manual deletion (C) is toil that breaks at 3 AM. Rotation is a daemon.json setting: set it once, forget it.
3. What is the fundamental difference between Linux namespaces and cgroups in container isolation?
- A. A. They are the same thing with two names
- B. B. Namespaces isolate what a container can see; cgroups limit what it can use
- C. C. Namespaces limit CPU; cgroups isolate networks
- D. D. Cgroups are a Docker invention; namespaces are Kubernetes
Show answer & reasoning
B. Namespaces = visibility isolation (own process tree, network stack, mount points — the container thinks it's alone). Cgroups = resource limits (CPU shares, memory caps — the container can't hog the host). Both are Linux kernel features Docker assembles; neither is Docker-specific (D).
4. An admin mounts the Docker socket (/var/run/docker.sock) into a container for "convenience." What is the security implication?
- A. A. None — the socket is read-only by default
- B. B. It's equivalent to root on the host — the container can start privileged containers and escape
- C. C. It only allows log reading
- D. D. It improves performance
Show answer & reasoning
B. The Docker daemon runs as root, and the socket is the daemon's API: anyone who can talk to it can launch a fully privileged container with host paths mounted — game over. Socket mounts are root-equivalent and must be treated as such. "Convenience" here is a breach waiting for a schedule.
This was one domain. The simulator drills all 6.
This free preview covered Installation & Configuration (Domain 3.0, 15%). Not covered here: Orchestration (Domain 1.0, 25%); Security (Domain 5.0, 15%). Swarm orchestration and Docker security — the most scenario-heavy DCA material — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full DCA Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy