· about 30 minutes · runs on ubuntu-26.04-devops · unrated
An unrated lab. It runs on your machine with no account and no network, and everything about it — the faults, the checks, the hints and the reference solution — is in the repository. An attempt on it is recorded on your profile and never moves a rating: only rated labs do. Rated and unrated labs.
The job queue for the reporting workers is Redis, in a container started by jobs-redis.service.
The workers run on this machine and connect to 127.0.0.1:6379.
Every time the machine reboots — and every time someone restarts the service — the queue comes back
empty and a day of report jobs is lost. There are 50 pending jobs in the list jobs:pending
right now, and they must not be lost this time.
The security scan also flagged Redis as reachable from the network, with no password.
What is expected, and graded:
jobs:pending are still there, in order, in the container named jobs-redis that
jobs-redis.service starts at boot — now, and after a reboot.127.0.0.1:6379.There is no internet access: use the images that are already on the machine. You have root through
sudo.
The machine is checked, rebooted, and checked again. A check passes only if it passes both times.
| Check | Objective |
|---|---|
| 01_jobs_survive | Move a container's data onto a volume without losing what is already in it |
| 02_not_reachable_from_outside | Publish a container port only on the interface that needs it |
Where the lab's hints send you, level by level, as you ask for them (h, then l opens a journal section in the TUI).
4 questions on the same topic, in the lab's Theory tab. They never affect the lab's grade. Three of them, to answer here:
A container was started with `docker run --rm -v /srv/data:/data IMAGE`. The image also declares `VOLUME /cache`. What remains after the container stops?
Only /srv/data on the host
--rm removes the container, its writable layer and its anonymous volumes. A bind-mounted host directory belongs to the host and is untouched; a named volume would also survive.
https://docs.docker.com/reference/cli/docker/container/run/#rm · https://docs.docker.com/engine/storage/volumes/
Which `-p` option makes a container's port 6379 reachable only from the host itself?
-p 127.0.0.1:6379:6379
The host IP comes first. Without it Docker publishes on every address, IPv4 and IPv6. --expose only documents a port and publishes nothing on the host.
https://docs.docker.com/engine/network/#published-ports
Redis runs with `--save ""`. Which command still writes the dataset to dump.rdb?
redis-cli SAVE
An empty save setting only disables automatic snapshots; SAVE (or BGSAVE) writes one on demand. CONFIG REWRITE writes the configuration file, docker commit captures the container's writable layer but not an unmounted volume, and FLUSHALL deletes everything.
https://redis.io/docs/latest/operate/oss_and_stack/management/persistence/