feat(root04): author Containers & Docker
Adds all 8 ROOT 04 modules (why containers exist, images & containers, Docker CLI, container networking, container storage, Dockerfile & image build, Docker Compose, containers → Kubernetes) — 43 activities, using the nested Docker Engine Phase 6D built and tested. Modules 1, 2, and 8 are conceptual (no lab by design) — the honest bridge module (M8) explicitly names what Kubernetes adds beyond what this course already taught, without re-teaching Kubernetes itself. Adds 5 new hands-on Docker scenarios plus 2 MCQs, all against the real nested Docker Engine: docker-cli-basics (run/exec/inspect a real container), docker-container-networking (a genuine "works internally, unreachable from host" port-publishing failure, diagnosed and fixed by recreating the container with the correct `-p` flag), docker-container-storage (a real destroy/recreate cycle proving named-volume persistence, not just described), docker-build-image (a real Dockerfile, a real build, a real custom image run), and docker-compose-multiservice (a real two-service Compose application with a real published port). All tested end-to-end via the real scenario-validation API, including negative tests. Wires rootnode-containers-assessment (2 required + 4 random-draw scenarios) using the existing Phase 3B assessment engine. This completes the entire ROOT_ Foundations sequence (ROOT 01-04) — see docs/PHASE6E_ROOT_FOUNDATIONS_COMPLETION.md. Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
Claude Sonnet 5
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"id": "docker-build-image",
|
||||
"title": "Write a Real Dockerfile and Build a Real Image",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Medium",
|
||||
"type": "task",
|
||||
"weight": 6,
|
||||
"description": "## Write a Real Dockerfile and Build a Real Image\n\nA file `/srv/build-lab/greeting.txt` already exists, containing a message.\n\n**Your task:**\n\n1. Write a `Dockerfile` at `/srv/build-lab/Dockerfile` that:\n - Starts `FROM alpine:3.19`\n - Sets the working directory to `/app`\n - Copies `greeting.txt` into the image\n - Runs `cat greeting.txt` as its default command\n2. Build it, tagged `rootnode-build-lab:1`\n3. Run a container from YOUR image and confirm it prints the real content of `greeting.txt`",
|
||||
"hints": [
|
||||
{
|
||||
"title": "The Dockerfile",
|
||||
"body": "Each instruction builds one layer: FROM sets the base, WORKDIR sets the working directory for everything after it, COPY brings a file from the build context into the image, CMD sets the default command run when a container starts.",
|
||||
"command": "cat <<EOF > /srv/build-lab/Dockerfile\nFROM alpine:3.19\nWORKDIR /app\nCOPY greeting.txt .\nCMD cat greeting.txt\nEOF"
|
||||
},
|
||||
{
|
||||
"title": "Building and running",
|
||||
"body": "`docker build -t <tag> <context-directory>` builds using the Dockerfile found in that directory. `docker run --rm <tag>` runs it once and cleans up automatically afterward.",
|
||||
"command": "cd /srv/build-lab && docker build -t rootnode-build-lab:1 .\ndocker run --rm rootnode-build-lab:1"
|
||||
}
|
||||
],
|
||||
"setup_commands": [
|
||||
{ "command": "rm -rf /srv/build-lab && mkdir -p /srv/build-lab" },
|
||||
{ "command": "echo 'Hello from my custom image' > /srv/build-lab/greeting.txt" },
|
||||
{ "command": "docker pull alpine:3.19" }
|
||||
],
|
||||
"validation": {
|
||||
"commands": [
|
||||
{ "description": "the image was actually built with the expected tag", "command": "docker image inspect rootnode-build-lab:1 --format '{{.RepoTags}}' 2>/dev/null", "expected_output": "rootnode-build-lab:1", "match": "contains" },
|
||||
{ "description": "a container from the student's own image produces the real file content", "command": "docker run --rm rootnode-build-lab:1 2>/dev/null", "expected_output": "Hello from my custom image", "match": "exact" }
|
||||
]
|
||||
},
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": [
|
||||
{ "command": "docker rmi rootnode-build-lab:1 2>/dev/null; rm -rf /srv/build-lab" }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"id": "docker-cli-basics",
|
||||
"title": "Run, Exec Into, and Inspect a Real Container",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Easy",
|
||||
"type": "task",
|
||||
"weight": 5,
|
||||
"description": "## Run, Exec Into, and Inspect a Real Container\n\n**Your task:**\n\n1. Run a container named `cli-lab-app` from the `nginx:alpine` image, in the background (detached)\n2. Use `docker exec` to run a command INSIDE the running container that creates `/tmp/marker.txt` containing exactly `hello-from-exec`\n3. Record the running container's ID to `/srv/docker-cli-lab/container-id.txt`\n4. Use `docker logs` and `docker inspect` to confirm it's actually running — you don't need to write those findings anywhere, just use them to verify your own work",
|
||||
"hints": [
|
||||
{
|
||||
"title": "Running and execing",
|
||||
"body": "`docker run -d --name <name> <image>` starts a container in the background under a name you choose instead of a random one. `docker exec <name> <command>` runs a NEW command inside an ALREADY-running container — different from `docker run`, which starts a brand new container.",
|
||||
"command": "docker run -d --name cli-lab-app nginx:alpine\ndocker exec cli-lab-app sh -c 'echo hello-from-exec > /tmp/marker.txt'"
|
||||
},
|
||||
{
|
||||
"title": "Recording the container ID",
|
||||
"body": "`docker ps -q -f name=<name>` prints just the ID of a container matching that name filter.",
|
||||
"command": "mkdir -p /srv/docker-cli-lab\ndocker ps -q -f name=cli-lab-app > /srv/docker-cli-lab/container-id.txt"
|
||||
}
|
||||
],
|
||||
"setup_commands": [
|
||||
{ "command": "mkdir -p /srv/docker-cli-lab" },
|
||||
{ "command": "docker rm -f cli-lab-app 2>/dev/null; true" },
|
||||
{ "command": "docker pull nginx:alpine" }
|
||||
],
|
||||
"validation": {
|
||||
"commands": [
|
||||
{ "description": "cli-lab-app is running from the correct image", "command": "docker inspect cli-lab-app --format '{{.Config.Image}} {{.State.Running}}' 2>/dev/null", "expected_output": "nginx:alpine true", "match": "exact" },
|
||||
{ "description": "the marker file was actually created inside the container via exec", "command": "docker exec cli-lab-app cat /tmp/marker.txt 2>/dev/null", "expected_output": "hello-from-exec", "match": "exact" },
|
||||
{ "description": "the container ID was correctly recorded and matches the real running container", "command": "[ \"$(cat /srv/docker-cli-lab/container-id.txt 2>/dev/null)\" = \"$(docker ps -q -f name=cli-lab-app)\" ] && echo match || echo mismatch", "expected_output": "match", "match": "exact" }
|
||||
]
|
||||
},
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": [
|
||||
{ "command": "docker rm -f cli-lab-app 2>/dev/null; rm -rf /srv/docker-cli-lab" }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"id": "docker-compose-multiservice",
|
||||
"title": "Run a Real Two-Service Application With Compose",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Medium",
|
||||
"type": "task",
|
||||
"weight": 7,
|
||||
"description": "## Run a Real Two-Service Application With Compose\n\nManually running two related containers, wiring their network, and keeping track of dependency order gets tedious fast — Compose describes the whole application in one file.\n\n**Your task**, at `/srv/compose-lab/docker-compose.yml`:\n\n1. Define a `web` service from `nginx:alpine`, publishing host port `8077` to container port `80`\n2. Define an `api` service from `alpine:3.19`, running `sh -c 'echo api-ready > /tmp/ready && sleep 3600'`\n3. Make `web` depend on `api` (`depends_on`)\n4. Bring the whole application up with `docker compose up -d`\n5. Confirm both services are actually running, and that `curl http://localhost:8077/` succeeds",
|
||||
"hints": [
|
||||
{
|
||||
"title": "The compose file",
|
||||
"body": "A `services:` block defines each container as a named service — `ports` publishes a port exactly like `docker run -p`, `depends_on` controls startup order.",
|
||||
"command": "cat <<EOF > /srv/compose-lab/docker-compose.yml\nservices:\n web:\n image: nginx:alpine\n ports:\n - '8077:80'\n depends_on:\n - api\n api:\n image: alpine:3.19\n command: sh -c 'echo api-ready > /tmp/ready && sleep 3600'\nEOF"
|
||||
},
|
||||
{
|
||||
"title": "Bringing it up",
|
||||
"body": "`docker compose up -d` reads the compose file in the current directory (or use `-f` to point at one elsewhere) and starts every service defined in it.",
|
||||
"command": "cd /srv/compose-lab && docker compose up -d"
|
||||
}
|
||||
],
|
||||
"setup_commands": [
|
||||
{ "command": "rm -rf /srv/compose-lab && mkdir -p /srv/compose-lab" },
|
||||
{ "command": "docker pull nginx:alpine" },
|
||||
{ "command": "docker pull alpine:3.19" }
|
||||
],
|
||||
"validation": {
|
||||
"commands": [
|
||||
{ "description": "the web service is running", "command": "docker compose -f /srv/compose-lab/docker-compose.yml ps --format '{{.Service}}:{{.State}}' 2>/dev/null | grep web", "expected_output": "web:running", "match": "exact" },
|
||||
{ "description": "the api service is running", "command": "docker compose -f /srv/compose-lab/docker-compose.yml ps --format '{{.Service}}:{{.State}}' 2>/dev/null | grep api", "expected_output": "api:running", "match": "exact" },
|
||||
{ "description": "the published port actually works", "command": "curl -sf http://localhost:8077/ -o /dev/null -w '%{http_code}'", "expected_output": "200", "match": "exact" }
|
||||
]
|
||||
},
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": [
|
||||
{ "command": "docker compose -f /srv/compose-lab/docker-compose.yml down 2>/dev/null; rm -rf /srv/compose-lab" }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,38 @@
|
||||
{
|
||||
"id": "docker-container-networking",
|
||||
"title": "It Works Inside the Container, But Not From the Host — Why?",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Medium",
|
||||
"type": "task",
|
||||
"weight": 6,
|
||||
"description": "## It Works Inside the Container, But Not From the Host — Why?\n\nA container named `net-lab-web` is already running `nginx:alpine`. It works perfectly INSIDE itself, but `curl http://localhost:8099/` from this Lab's own shell fails.\n\n**Your task:**\n\n1. Confirm the app really does work internally: `docker exec net-lab-web wget -qO- http://localhost:80/`\n2. Confirm `curl http://localhost:8099/` from the host really does fail\n3. Diagnose why (hint: `docker port net-lab-web` shows what ports are actually published — or aren't)\n4. Fix it: remove the container and recreate it WITH the correct port publish flag, so `curl http://localhost:8099/` succeeds",
|
||||
"hints": [
|
||||
{
|
||||
"title": "Checking what's actually published",
|
||||
"body": "`docker port <container>` lists every host-port-to-container-port mapping currently configured — an empty result means NOTHING is published, no matter how well the app works internally.",
|
||||
"command": "docker port net-lab-web"
|
||||
},
|
||||
{
|
||||
"title": "The fix — port publishing can't be added to a running container",
|
||||
"body": "Port publishing is set at container CREATION time, not changeable afterward — you must remove and recreate it with `-p hostPort:containerPort`.",
|
||||
"command": "docker rm -f net-lab-web\ndocker run -d --name net-lab-web -p 8099:80 nginx:alpine"
|
||||
}
|
||||
],
|
||||
"setup_commands": [
|
||||
{ "command": "docker rm -f net-lab-web 2>/dev/null; true" },
|
||||
{ "command": "docker pull nginx:alpine" },
|
||||
{ "command": "docker run -d --name net-lab-web nginx:alpine" }
|
||||
],
|
||||
"validation": {
|
||||
"commands": [
|
||||
{ "description": "net-lab-web is running from the correct image", "command": "docker inspect net-lab-web --format '{{.Config.Image}} {{.State.Running}}' 2>/dev/null", "expected_output": "nginx:alpine true", "match": "exact" },
|
||||
{ "description": "port 8099 is now genuinely published to the container's port 80", "command": "docker port net-lab-web 2>/dev/null | grep 80/tcp", "expected_output": "8099", "match": "contains" },
|
||||
{ "description": "the published port is actually reachable from the host", "command": "curl -sf http://localhost:8099/ -o /dev/null -w '%{http_code}'", "expected_output": "200", "match": "exact" }
|
||||
]
|
||||
},
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": [
|
||||
{ "command": "docker rm -f net-lab-web 2>/dev/null" }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,37 @@
|
||||
{
|
||||
"id": "docker-container-storage",
|
||||
"title": "Prove Data Survives a Container's Death — With a Volume",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Medium",
|
||||
"type": "task",
|
||||
"weight": 6,
|
||||
"description": "## Prove Data Survives a Container's Death — With a Volume\n\nA container's own writable layer is disposable — data written there disappears when the container is destroyed. A named VOLUME is different.\n\n**Your task:**\n\n1. Create a named volume: `docker volume create storage-lab-vol`\n2. Run a container named `storage-lab-app` from `alpine:3.19` (keep it running with `sleep 3600`), mounting the volume at `/data`\n3. Write a file `/data/file.txt` containing exactly `persisted-data`, inside the container\n4. Destroy the container completely (`docker rm -f storage-lab-app`)\n5. Recreate it with the SAME name, SAME image, and the SAME volume mount\n6. Confirm `/data/file.txt` still contains `persisted-data` — proving the volume, not the container, is what actually held the data",
|
||||
"hints": [
|
||||
{
|
||||
"title": "Creating and mounting a volume",
|
||||
"body": "`-v <volume-name>:<path-in-container>` mounts a named volume at a path inside the container — data written there lives in the volume, independent of the container's own lifecycle.",
|
||||
"command": "docker volume create storage-lab-vol\ndocker run -d --name storage-lab-app -v storage-lab-vol:/data alpine:3.19 sleep 3600\ndocker exec storage-lab-app sh -c 'echo persisted-data > /data/file.txt'"
|
||||
},
|
||||
{
|
||||
"title": "Destroying and recreating",
|
||||
"body": "Removing the container does NOT remove the volume — recreating a container with the same `-v` flag reattaches the exact same data.",
|
||||
"command": "docker rm -f storage-lab-app\ndocker run -d --name storage-lab-app -v storage-lab-vol:/data alpine:3.19 sleep 3600\ndocker exec storage-lab-app cat /data/file.txt"
|
||||
}
|
||||
],
|
||||
"setup_commands": [
|
||||
{ "command": "docker rm -f storage-lab-app 2>/dev/null; docker volume rm storage-lab-vol 2>/dev/null; true" },
|
||||
{ "command": "docker pull alpine:3.19" }
|
||||
],
|
||||
"validation": {
|
||||
"commands": [
|
||||
{ "description": "storage-lab-vol volume exists", "command": "docker volume inspect storage-lab-vol --format '{{.Name}}' 2>/dev/null", "expected_output": "storage-lab-vol", "match": "exact" },
|
||||
{ "description": "storage-lab-app is running and mounts the volume at /data", "command": "docker inspect storage-lab-app --format '{{range .Mounts}}{{.Name}}:{{.Destination}} {{end}}' 2>/dev/null", "expected_output": "storage-lab-vol:/data", "match": "contains" },
|
||||
{ "description": "the data genuinely survived a container destroy/recreate cycle", "command": "docker exec storage-lab-app cat /data/file.txt 2>/dev/null", "expected_output": "persisted-data", "match": "exact" }
|
||||
]
|
||||
},
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": [
|
||||
{ "command": "docker rm -f storage-lab-app 2>/dev/null; docker volume rm storage-lab-vol 2>/dev/null; true" }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"id": "docker-image-vs-container-mcq",
|
||||
"title": "Image vs. Container — The Distinction That Confuses Everyone at First",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Easy",
|
||||
"type": "mcq",
|
||||
"weight": 3,
|
||||
"description": "## Image vs. Container — The Distinction That Confuses Everyone at First\n\nYou run `docker run nginx:alpine` three separate times without removing anything in between. How many containers now exist, and how many images?",
|
||||
"options": [
|
||||
{ "id": "a", "text": "3 containers, 3 images — each run creates its own independent image" },
|
||||
{ "id": "b", "text": "3 containers, 1 image — the image is the packaged artifact pulled once; each `run` creates a new, independent RUNNING INSTANCE from it" },
|
||||
{ "id": "c", "text": "1 container, 1 image — running the same image twice just reuses the same container" },
|
||||
{ "id": "d", "text": "1 container, 3 images — Docker versions the image automatically on each run" }
|
||||
],
|
||||
"correct_option": "b",
|
||||
"explanation": "An image is packaged, read-only artifact — pulling `nginx:alpine` downloads it exactly once. A container is a RUNNING INSTANCE of an image; running the same image multiple times creates multiple independent containers (with their own writable layer, network identity, and lifecycle), all sharing the same underlying image.",
|
||||
"hints": [],
|
||||
"setup_commands": [],
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": []
|
||||
}
|
||||
@@ -0,0 +1,22 @@
|
||||
{
|
||||
"id": "docker-port-publish-mcq",
|
||||
"title": "Works Inside, Unreachable Outside",
|
||||
"category": "Containers",
|
||||
"isolation_type": "shared_namespace",
|
||||
"difficulty": "Medium",
|
||||
"type": "mcq",
|
||||
"weight": 4,
|
||||
"description": "## Works Inside, Unreachable Outside\n\nA web server container is confirmed healthy — `docker exec <container> curl localhost:80` succeeds from inside it. But `curl http://localhost:8080/` from the HOST fails to connect. The container was started with plain `docker run -d myapp` (no other flags). What's most likely missing?",
|
||||
"options": [
|
||||
{ "id": "a", "text": "The image itself is broken" },
|
||||
{ "id": "b", "text": "A `-p 8080:80` port-publish flag was never set when the container was created, so nothing on the host maps to the container's port 80" },
|
||||
{ "id": "c", "text": "The container needs more memory" },
|
||||
{ "id": "d", "text": "DNS is misconfigured" }
|
||||
],
|
||||
"correct_option": "b",
|
||||
"explanation": "Working correctly INSIDE the container proves the application itself is fine — the failure is specifically that the host has no mapping to the container's internal port. Port publishing (`-p hostPort:containerPort`) must be set at container creation time; without it, the container's ports are only reachable from other containers on the same Docker network, never from the host.",
|
||||
"hints": [],
|
||||
"setup_commands": [],
|
||||
"default_namespace": "default",
|
||||
"teardown_commands": []
|
||||
}
|
||||
Reference in New Issue
Block a user