DCA · Question #73
A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster. Can this be used to schedule containers to meet the security…
The correct answer is B. No. While node labels with placement constraints are effective for workload separation in Swarm, if 'label constraints' refers broadly to service labels rather than node-specific constraints, it cannot enforce node separation.
Question
A company's security policy specifies that development and production containers must run on separate nodes in a given Swarm cluster. Can this be used to schedule containers to meet the security policy requirements? Solution: label contraints
Options
- AYes
- BNo
How the community answered
(46 responses)- A30% (14)
- B70% (32)
Why each option
While node labels with placement constraints are effective for workload separation in Swarm, if 'label constraints' refers broadly to service labels rather than node-specific constraints, it cannot enforce node separation.
Service labels alone, without being used as node placement constraints, do not provide the necessary mechanism to schedule containers onto physically separate nodes based on security policies.
If 'label constraints' is interpreted narrowly as constraints on service-defined labels rather than placement constraints leveraging node labels, then they do not directly control which nodes a service's containers are scheduled on. Service labels are primarily for metadata and organization, not for enforcing physical separation of workloads across different node types.
Concept tested: Docker Swarm service vs. node label constraints
Source: https://docs.docker.com/engine/reference/commandline/service_create/#add-labels
Topics
Community Discussion
No community discussion yet for this question.