A Dockerfile for a water-quality API sets WORKDIR, ENV, and EXPOSE. Which statement about those instructions is accurate?
Select an answer to reveal the explanation.
Short Explanation
WORKDIR is “which desk,” ENV is “default sticky notes the process can still replace,” and EXPOSE is a label on the door saying which port we listen on—not the key that opens the firewall.
Full Explanation
WORKDIR sets the default directory for later build steps and for the running water-quality process, so relative paths in COPY, RUN, and the application resolve consistently. ENV embeds defaults that persist into the container environment and remain overridable at run time for non-secret configuration such as log levels or feature flags. EXPOSE documents the intended listening port but does not by itself publish or map that port onto a host interface or cluster Service. Together they configure workspace, baked defaults, and port documentation—not automatic external reachability.
EXPOSE alone does not publish the port on the host without any run-time mapping. ENV values are not build-only and never visible to the running process; persistence into the process environment is their purpose. WORKDIR is not documentation-only and does change the process working directory for subsequent instructions and at start.
Exam caveat: confusing EXPOSE with publish is a classic trap on container exams—image metadata versus actual -p publish or orchestrator port mapping. Operational check: start the container without a port map, confirm EXPOSE metadata exists on the image config, and verify the host still cannot connect until a real publish or Service map is added.