A developer asks to mount the node’s container runtime socket via hostPath into a ordinary business app Pod for convenience. What is the CKAD-oriented response?
Select an answer to reveal the explanation.
Short Explanation
hostPath is like giving every guest a master key to the hotel’s boiler room—powerful, node-tied, and usually the wrong default for a normal business app. Use emptyDir or a PVC instead.
Full Explanation
When a developer asks to mount the node’s container runtime socket via hostPath into an ordinary business app Pod for convenience, the CKAD-oriented response is to avoid hostPath for ordinary application data. Prefer emptyDir or a PVC and keep apps portable and less node-coupled. Runtime socket hostPath is a privileged escape hatch for agents, not a pattern for municipal business containers.
Approving hostPath to the runtime socket as the default pattern for all application data invites node compromise from any app bug. Preferring hostPath over PVC because hostPath “automatically backs up across zones” is false. Requiring hostPath on every Deployment so apps can manage neighboring node Pods expands blast radius unacceptably.
Exam caveat: hostPath appears in exams as something to recognize and usually avoid for portable apps. CSI/PVC is the durable path; emptyDir is ephemeral Pod scratch.
Operational check: remove hostPath from the Pod spec; mount emptyDir or PVC instead; kubectl describe pod and confirm volume type; run Pod security admission in warn/enforce mode to catch hostPath. In municipal environments, document the chosen pattern in the service runbook so on-call engineers apply the same kubectl checks during incidents, and keep the change tied to the application Deployment or Job rather than ad-hoc node mutation.