Chapter 26 - Worked Answers

1. Read-only root field path

ListAssignedTasks supplies the service SecurityContext; ensureTask converts it with dockerSecurityContext and sets ContainerSpec.Security; dockerContainerConfig sets HostConfig.ReadonlyRootfs. Bind mounts have separate read-only/rw modes, so a read-only root does not prohibit every writable mounted path. The mapping is inspected source evidence, not a real Engine inspection. Empty configured CapDrop defaults to NET_RAW in this baseline, not ALL.

2. Order before defaults

CreateService resolves image metadata and validates the candidate, then calls Admit before NormalizeServiceSpec applies resource defaults. RequireResourceRequests can therefore reject missing explicit CPU/memory even when defaults would later exist. Trace the actual method rather than treating the design document’s normalized-candidate phrase as execution. A change to admit normalized values would alter policy semantics and needs its own tests.

3. Different rejection types

Malformed YAML/domain structure can fail before policy evaluation. A structurally valid privileged request under denying policy reaches admission and returns field/rule/message violations. Quota exhaustion occurs at the later projected-usage check and returns quota.Error, exposed as its own structured conflict. Only the policy denial should be interpreted as admission violations. Human Error() text is not the stable machine interface; use typed/structured fields.

4. Scope of passing tests

The focused tests cover selected ordinary service scale/rollout and evaluator rules. CreateJob has a separate path, and GitOpsStatus auto_revert restores stored desired state without re-entering Admit in that method. Neither path is certified by the service tests. Shared Docker workers still share kernel/network/daemon trust; accepted user/capability/filesystem options do not create a complete hostile-tenant sandbox. A broader claim needs caller inventory and explicit physical-boundary tests.

These answers use chapter 26 and its scoped claim/execution records. Design changes remain proposals until separately implemented and tested.