Title: Quiz 5 — Building the Core: Containerized Services and Environments
Course: AIINFRA 303: Capstone Project > Section: Week 05 — Building the Core: Containerized Services and Environments

Q: A container packages an application with its dependencies so that it runs identically across different environments.
- True
- False
A: True

Q: What is the primary benefit of a Docker multi-stage build?
- It lets you run multiple containers from one Dockerfile
- It separates build-time tools from the runtime image, shrinking the final image size
- It automatically updates the base image to `:latest`
- It removes the need for a `docker-compose.yml`
A: It separates build-time tools from the runtime image, shrinking the final image size

Q: What uv command, combined with a committed uv.lock, installs dependencies at the exact locked versions rather than re-resolving them?
Feedback: Sample/expected answer: `uv sync --frozen`

Q: It's a safe practice to bake environment-specific secrets and configuration directly into a Docker image at build time.
- True
- False
A: False

Q: Why should containers avoid running as the root user?
- Root processes run slower than non-root processes
- Docker Compose does not support root users
- A compromised root process has root-equivalent reach inside the container, increasing risk
- Root users cannot bind to network ports
A: A compromised root process has root-equivalent reach inside the container, increasing risk

Q: Name one risk of pulling the :latest tag for a base image in a production Dockerfile.
Feedback: Sample/expected answer: It can silently swap in a different (possibly breaking) image version with no warning, since ****`:latest`**** is a moving target rather than a pinned version.

Q: In this week's lab, how should runtime configuration (like a database URL) be passed to the containerized service?
- Hardcoded as an `ENV` instruction in the Dockerfile
- Injected at runtime via environment variables or an env file in `docker-compose.yml`
- Committed into the application source code
- Set as a Docker build `ARG` with the real production value
A: Injected at runtime via environment variables or an env file in `docker-compose.yml`

Q: Shipping build tools and source code inside the final runtime image increases the attack surface without providing any runtime benefit.
- True
- False
A: True