Minimize Base Image Footprint CKS Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   You are optimizing a Dockerfile for a Node.js application. The current Dockerfile has separate RUN instructions for 'apt-get update', 'apt-get install', 'npm install', and 'rm -rf /var/lib/apt/lists/*'. You want to reduce the number of layers and the final image size. Which change is most effective?

   • ACombine the apt-get update, install, and cleanup commands into a single RUN instruction using '&&' and clean the apt cache in the same layer.
   • BUse 'apt-get install --no-install-recommends' but keep the update and install in separate RUN instructions.
   • CRemove the 'apt-get update' command entirely to save a layer.
   • DMove the 'rm -rf /var/lib/apt/lists/*' command to a separate RUN instruction after the install.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your team is containerizing a Go-based gRPC service that must run as a non-root user. The service requires no shell access, no package manager, and no debugging tools in production. You want to minimize the attack surface and image footprint. Which base image strategy should you use?

   • AUse a distroless base image and copy the statically compiled Go binary into it.
   • BUse the full ubuntu image and remove unnecessary packages in a later RUN step.
   • CUse the latest alpine image and install the Go binary along with curl for health checks.
   • DUse the scratch image and manually add all required system libraries and CA certificates.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   You are containerizing a small utility that performs a single task and has no external dependencies. The utility is a statically compiled binary. You want the smallest possible image with the least attack surface. Which base image should you choose?

   • Aalpine:latest
   • Bdistroless/static
   • Cubuntu:latest
   • Dscratch
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security audit requires that production container images must not contain a shell or package manager to reduce the blast radius of a container breakout. Your application is a Java service that needs a JRE and some CA certificates. Which approach satisfies the audit requirement?

   • AUse a full Ubuntu image and configure the container to run as a non-root user.
   • BUse a standard OpenJDK image and rely on the container runtime to prevent shell access.
   • CUse an alpine-based JRE image and remove the shell and apk in a later RUN step.
   • DUse a distroless Java base image that includes the JRE and CA certificates but no shell or package manager.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   You are writing a Dockerfile for a Python application. The build process requires gcc and other build tools to compile a native dependency, but the runtime only needs the compiled .so file and the Python interpreter. Which Dockerfile approach best minimizes the final image footprint?

   • AUse a single-stage build with the full python image and install only the required pip packages.
   • BUse a multi-stage build: compile in a builder stage with gcc, then copy only the compiled artifacts and runtime dependencies to a slim final stage.
   • CUse a single-stage build and delete the source code and build directory after compilation.
   • DUse a single-stage build and run 'apt-get remove gcc' after compilation to clean up.
   Reveal Solution Discussion Select an answer first