11 questions on what you just read. Nothing is saved or issued. Use the result to see which of the 9 lessons to revisit while they are still open in the rail.
1. An addon contains a Vulkan library but the parent has no device grant. What changes when the addon is enabled?The addon starts as a nested package automatically The library appears in the composed root, but the parent gains no device access The addon's device permission is merged into the parent
2. Which sandbox layer controls whether the application can call clone with a new user namespace?The seccomp policy derived from userNamespaces The storage driver The mount namespace
3. Why can a podman compatibility shim remain bounded?It parses a finite CLI subset into typed provider requests It forwards the command only after asking the user Podman is rootless
4. A storage driver crashes while preparing the third of five layers. What must remain true?The partial checkout becomes the new runtime index The previous valid runtime index and published checkouts remain usable All five source layers are removed
5. A vendor replaces a file at the same HTTPS URL. Which runtime source field prevents accepting it silently?sha256, together with the declared size name architecture
6. Two installed SDK addons provide the exclusive slot sdk.go. What decides which one reaches VS Code?The last addon listed in the Store Both are added to PATH in manifest order The provider selected for that parent application's slot
7. Which storage driver response order is correct for OverlayFS lower directories?Highest priority first Oldest layer first Any order, because OverlayFS sorts them
8. Why does the prepared launch read a runtime index instead of calling the storage driver?Because the index contains application data To avoid a maintenance daemon round trip on every start Because the storage driver runs as root
9. A parent starts a declared nested package. Which permission boundary applies to the child?The parent policy alone The intersection of the child policy and the parent boundary The child's manifest alone
10. A host has no usable systemd user manager. What happens to an enabled cpak application service?The service is rejected because persistence requires systemd The package must request hostNetwork before it can restart cpak selects cron or XDG autostart and keeps the same service definition
11. Verified launch finds that a prepared checkout contradicts its recorded layer state while enforcement is off. What happens?The checkout is trusted because its OCI digest was checked during install The application starts because enforcement is off The launch is refused as tampered
