Pushing and pulling images in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What happens when you push a Docker image to Google Container Registry?

You have built a Docker image locally and want to store it in Google Container Registry (GCR). What is the main result of pushing the image to GCR?

A The image is uploaded and stored in GCR, making it available for other services to pull.

B The image is converted to a virtual machine and deployed automatically.

C The image is only stored temporarily and deleted after 24 hours.

D The image is deleted from your local machine after upload.

💡 Hint

Think about what a registry does with images you push to it.

Pushing an image to GCR uploads and stores it in the registry. This allows other services or users to pull the image later. The image is not converted or deleted automatically.

❓ Configuration

intermediate

Which command correctly tags a local Docker image for pushing to GCR?

You have a local Docker image named my-app with tag v1. Your GCP project ID is my-project. Which command correctly tags the image for pushing to Google Container Registry?

A docker tag gcr.io/my-project/my-app:v1 my-app:v1

B docker tag my-app gcr.io/my-project:v1/my-app

C docker tag my-app:v1 my-project/gcr.io/my-app:v1

D docker tag my-app:v1 gcr.io/my-project/my-app:v1

💡 Hint

Remember the format for GCR image names: gcr.io/[PROJECT-ID]/[IMAGE]:[TAG]

The correct tag format for pushing to GCR is gcr.io/my-project/my-app:v1. This tells Docker where to push the image.

❓ Architecture

advanced

What is the best architecture to securely pull images from GCR in a Kubernetes cluster?

You want your Kubernetes cluster to pull private images from Google Container Registry securely. Which architecture ensures secure and automated access?

A Use Kubernetes secrets with service account keys to authenticate image pulls.

B Make the images public in GCR so no authentication is needed.

C Use Workload Identity to allow Kubernetes service accounts to access GCR without storing keys.

D Manually log in to GCR on each node using Docker credentials.

💡 Hint

Consider a method that avoids managing long-lived keys and automates authentication.

Workload Identity lets Kubernetes service accounts access GCR securely without storing keys, improving security and automation.

❓ service_behavior

advanced

What happens if you try to pull a non-existent image tag from GCR?

You run docker pull gcr.io/my-project/my-app:nonexistent but the tag nonexistent does not exist in GCR. What is the expected behavior?

A Docker returns an error saying the image or tag was not found.

B Docker pulls the latest available tag instead automatically.

C Docker pulls an empty image with no layers.

D Docker pulls the image but with default configuration.

💡 Hint

Think about how Docker handles requests for images that do not exist.

If the requested image tag does not exist, Docker returns an error indicating the image or tag was not found. It does not pull other tags automatically.

❓ security

expert

Which IAM role is required to allow a user to push images to Google Container Registry?

You want to grant a user permission to push Docker images to GCR in your project. Which IAM role should you assign?

A roles/container.admin

B roles/storage.objectAdmin

C roles/storage.objectViewer

D roles/container.developer

💡 Hint

Consider which role allows writing objects to the underlying storage bucket used by GCR.

Google Container Registry stores images in Cloud Storage buckets. The role roles/storage.objectAdmin allows users to upload (push) images by managing objects in the bucket.