DCA Exam Dumps : Docker Certified Associate (DCA) Exam

= Linux capabilities are a way of restricting the privileges of a process or a container. By default, Docker containers run with a reduced set of capabilities, which means they cannot perform certain operations that require higher privileges, such as setting the system time1. To allow a container to set the system time, you need to grant it the SYS_TIME capability by using the --cap-add option when running the container2. For example, docker run --cap-add SYS_TIME alpine date -s 12:00 would set the system time to 12:00 inside the alpine container3. References: Docker Documentation, Runtime privilege and Linuxcapabilities, Change system date time in Docker containers without impacting host, Is it possible to change time dynamically in docker container?

 SELinux could be blocking the operation of setting the system time from inside a Docker container. SELinux is a security mechanism that enforces mandatory accesscontrol (MAC) policies on Linux systems. It restricts the actions that processes can perform based on their security contexts, such as user, role, type, and level. By default, SELinux prevents Docker containers from accessing or modifying the host’s system time, as this could pose a security risk or cause inconsistency. To allow Docker containers to set the system time, SELinux needs to be configured with the appropriate permissions or labels, or disabled altogether. However, this is not recommended, as it could compromise the security and stability of the system. References:

Change system date time in Docker containers without impacting host

Change Date Inside a Docker Container

How to Handle Timezones in Docker Containers

5 ways to change time in Docker container

How to set system time dynamically in a Docker container

= This is not a way to configure the Docker engine to use a registry without a trusted TLS certificate. There is no such option as IGNORE_TLS in the daemon.json configuration file. The daemon.json file is used to configure various aspects of the Docker engine, such as logging, storage, networking, and security1. To use a registry without a trusted TLS certificate, you need to either add the certificate to the trusted root certificates of the system, or configure the Docker engine to allow insecure registries2. To add the certificate to the trusted root certificates, you need to copy the certificate file to the /etc/docker/certs.d// directory on every Docker host2. To configure the Docker engine to allow insecure registries, you need to add the registry hostname or IP address to the “insecure-registries” array in the daemon.json file3. For example:

{ “insecure-registries” : [“myregistry.example.com:5000”] }

Note that using insecure registries is not recommended, as it exposes you to potential man-in-the-middle attacks and data corruption3. You should always use a registry with a trusted TLS certificate, or use Docker Content Trust to sign and verify your images4. References:

Daemon configuration file | Docker Docs

Verify repository client with certificates | Docker Docs

Test an insecure registry | Docker Docs

Content trust in Docker | Docker Docs