Checkpoint: Containers from First Principles

Five questions on this section. Answer all of them, then see your score and why each answer is right or wrong.

You run notes-api with docker run --memory 256m. Under a load test the container dies and docker ps -a shows Exited (137). What enforced the limit?

The PID namespace, which caps how much the process tree may allocate.
Node.js itself, which reads --memory and exits with 137.
A cgroup memory limit; the kernel’s OOM killer ended the process with SIGKILL (128 + 9 = 137).
The image’s read-only layers, which can’t hold more than 256 MB.

You change one line in src/server.ts and rebuild this image. Roughly how long does the build take compared with an unchanged rebuild?

Dockerfile

FROM node:24-slim
WORKDIR /app
COPY . .
RUN npm ci
RUN npm run build

Much longer, because COPY . . misses the cache and every step after it, including the full npm ci, reruns.
About the same, because only npm run build needs to rerun.
Faster, because Docker reuses the previous node_modules folder.
It fails, because changed files can’t be copied over cached layers.

notes-api runs with CMD ["node", "dist/server.js"] and has no SIGTERM handler. What does docker stop do?

Node exits immediately with code 143, because SIGTERM’s default action terminates the process.
Docker restarts the container instead of stopping it.
Node finishes in-flight requests and exits 0.
The signal is ignored because Node is PID 1 without a handler, so after 10 seconds Docker sends SIGKILL and the container exits with 137.

You run docker run -d -p 3000:3000 notes-api:dev. The logs say listening on 3000, but curl localhost:3000 from your laptop gets connection reset. What do you check first?

Whether the image has an EXPOSE 3000 line.
Whether the app binds to 127.0.0.1 inside the container instead of 0.0.0.0.
Whether port 3000 is open in the host firewall.
Whether Docker Desktop is up to date.

Which statement about images and containers is correct?

Each container gets its own full copy of the image’s files on disk.
Removing a container also removes its image.
Many containers can run from one image; each has a private writable layer that is deleted with the container.
A running container’s changes are written back into the image when it stops.

5 questions unanswered