Pushing and pulling images in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What happens when you push a Docker image to Google Container Registry?

You have built a Docker image locally and want to store it in Google Container Registry (GCR). What is the main result of pushing the image to GCR?

A The image is uploaded and stored in GCR, making it available for other services to pull.

B The image is converted to a virtual machine and deployed automatically.

C The image is only stored temporarily and deleted after 24 hours.

D The image is deleted from your local machine after upload.

💡 Hint

Think about what a registry does with images you push to it.

Pushing an image to GCR uploads and stores it in the registry. This allows other services or users to pull the image later. The image is not converted or deleted automatically.

❓ Configuration

intermediate

Which command correctly tags a local Docker image for pushing to GCR?

You have a local Docker image named my-app with tag v1. Your GCP project ID is my-project. Which command correctly tags the image for pushing to Google Container Registry?

A docker tag gcr.io/my-project/my-app:v1 my-app:v1

B docker tag my-app gcr.io/my-project:v1/my-app

C docker tag my-app:v1 my-project/gcr.io/my-app:v1

D docker tag my-app:v1 gcr.io/my-project/my-app:v1

💡 Hint

Remember the format for GCR image names: gcr.io/[PROJECT-ID]/[IMAGE]:[TAG]

The correct tag format for pushing to GCR is gcr.io/my-project/my-app:v1. This tells Docker where to push the image.

❓ Architecture

advanced

What is the best architecture to securely pull images from GCR in a Kubernetes cluster?

You want your Kubernetes cluster to pull private images from Google Container Registry securely. Which architecture ensures secure and automated access?

A Use Kubernetes secrets with service account keys to authenticate image pulls.

B Make the images public in GCR so no authentication is needed.

C Use Workload Identity to allow Kubernetes service accounts to access GCR without storing keys.

D Manually log in to GCR on each node using Docker credentials.

💡 Hint

Consider a method that avoids managing long-lived keys and automates authentication.

Workload Identity lets Kubernetes service accounts access GCR securely without storing keys, improving security and automation.

❓ service_behavior

advanced

What happens if you try to pull a non-existent image tag from GCR?

You run docker pull gcr.io/my-project/my-app:nonexistent but the tag nonexistent does not exist in GCR. What is the expected behavior?

A Docker returns an error saying the image or tag was not found.

B Docker pulls the latest available tag instead automatically.

C Docker pulls an empty image with no layers.

D Docker pulls the image but with default configuration.

💡 Hint

Think about how Docker handles requests for images that do not exist.

If the requested image tag does not exist, Docker returns an error indicating the image or tag was not found. It does not pull other tags automatically.

❓ security

expert

Which IAM role is required to allow a user to push images to Google Container Registry?

You want to grant a user permission to push Docker images to GCR in your project. Which IAM role should you assign?

A roles/container.admin

B roles/storage.objectAdmin

C roles/storage.objectViewer

D roles/container.developer

💡 Hint

Consider which role allows writing objects to the underlying storage bucket used by GCR.

Google Container Registry stores images in Cloud Storage buckets. The role roles/storage.objectAdmin allows users to upload (push) images by managing objects in the bucket.

Practice

1. What does the docker push command do in Google Cloud Platform?

easy

A. Downloads a container image from Google Container Registry

B. Uploads your container image to Google Container Registry

C. Deletes a container image from your local machine

D. Builds a new container image from a Dockerfile

Solution

1. Step 1: Understand the purpose of docker push

   The docker push command uploads your local container image to a remote registry like Google Container Registry.

2. Step 2: Differentiate from other commands

   docker pull downloads images, docker build creates images, and deleting is a separate action.

3. Final Answer:

   Uploads your container image to Google Container Registry -> Option B

4. Quick Check:

   Push = Upload image to registry [OK]

Hint: Push means upload image to cloud registry [OK]

Common Mistakes:

• Confusing push with pull
• Thinking push builds the image
• Assuming push deletes images

2. Which of the following is the correct syntax to tag a local Docker image named myapp with the Google Container Registry path gcr.io/my-project/myapp:v1?

easy

A. docker tag myapp gcr.io/my-project/myapp:v1

B. docker push myapp gcr.io/my-project/myapp:v1

C. docker pull myapp gcr.io/my-project/myapp:v1

D. docker build myapp gcr.io/my-project/myapp:v1

Solution

1. Step 1: Identify the tagging command

   The docker tag command assigns a new name (including registry path) to an existing local image.

2. Step 2: Confirm correct syntax

   The syntax is docker tag SOURCE_IMAGE TARGET_IMAGE, so docker tag myapp gcr.io/my-project/myapp:v1 is correct.

3. Final Answer:

   docker tag myapp gcr.io/my-project/myapp:v1 -> Option A

4. Quick Check:

   Tag syntax = docker tag SOURCE TARGET [OK]

Hint: Tag uses 'docker tag source target' syntax [OK]

Common Mistakes:

• Using push or pull instead of tag
• Reversing source and target images
• Confusing build with tag

3. Given the commands below, what will be the result of running docker images?

docker tag myapp gcr.io/my-project/myapp:v2
docker push gcr.io/my-project/myapp:v2

medium

A. The local image list will only show myapp without the tag

B. The local image list will be empty

C. The local image list will include gcr.io/my-project/myapp:v2

D. The local image list will show myapp:v2 but not the full registry path

Solution

1. Step 1: Understand tagging effect on local images

   Tagging creates a new name for the same local image, so gcr.io/my-project/myapp:v2 appears locally.

2. Step 2: Recognize push does not remove local images

   Pushing uploads the image but does not delete local copies, so the tagged image remains listed.

3. Final Answer:

   The local image list will include gcr.io/my-project/myapp:v2 -> Option C

4. Quick Check:

   Tag adds local name; push uploads but keeps local image [OK]

Hint: Tag adds local name; push uploads but keeps local image [OK]

Common Mistakes:

• Thinking push deletes local images
• Assuming tag does not create new local name
• Confusing image names without registry path

4. You tried to push an image with the command docker push myapp:v1 but got an error saying the repository was not found. What is the most likely cause?

medium

A. You forgot to tag the image with the full registry path before pushing

B. You need to run docker pull before pushing

C. The image name myapp:v1 is invalid syntax

D. You must delete the local image before pushing

Solution

1. Step 1: Understand push requires full registry path

   To push to Google Container Registry, the image must be tagged with the full path like gcr.io/project-id/image:tag.

2. Step 2: Identify missing tag as cause of error

   Using only myapp:v1 lacks registry info, so the push command cannot find the remote repository.

3. Final Answer:

   You forgot to tag the image with the full registry path before pushing -> Option A

4. Quick Check:

   Push needs full registry tag [OK]

Hint: Push needs full registry path tag [OK]

Common Mistakes:

• Trying to pull before push
• Assuming image name syntax is wrong
• Deleting local image before push

5. You want to update your app image in Google Container Registry with a new version. Which sequence of commands correctly tags, pushes, and then pulls the updated image for deployment?

hard

A. docker build myapp:v2 && docker pull gcr.io/my-project/myapp:v2 && docker push gcr.io/my-project/myapp:v2

B. docker pull gcr.io/my-project/myapp:v2 && docker tag myapp:v2 && docker push myapp:v2

C. docker push myapp:v2 && docker tag myapp gcr.io/my-project/myapp:v2 && docker pull myapp:v2

D. docker tag myapp gcr.io/my-project/myapp:v2 && docker push gcr.io/my-project/myapp:v2 && docker pull gcr.io/my-project/myapp:v2

Solution

1. Step 1: Tag the local image with the full registry path

   Use docker tag myapp gcr.io/my-project/myapp:v2 to prepare the image for pushing.

2. Step 2: Push the tagged image to Google Container Registry

   Run docker push gcr.io/my-project/myapp:v2 to upload the image.

3. Step 3: Pull the updated image to confirm availability for deployment

   Use docker pull gcr.io/my-project/myapp:v2 to download the image where needed.

4. Final Answer:

   docker tag myapp gcr.io/my-project/myapp:v2 && docker push gcr.io/my-project/myapp:v2 && docker pull gcr.io/my-project/myapp:v2 -> Option D

5. Quick Check:

   Tag, push, then pull sequence [OK]

Hint: Tag with full path, push, then pull updated image [OK]

Common Mistakes:

• Pushing before tagging with full path
• Pulling before pushing updated image
• Incorrect command order