Ten questions

Ten questions on what you have just read. Nothing is recorded and nothing is issued for it: it is here so you find out which of the eight lessons to read again, while you still have them open in the rail.

1. 1. An addon contains a Vulkan library but the parent has no device grant. What changes when the addon is enabled?

   The library appears in the composed root, but the parent gains no device access The addon starts as a nested package automatically The addon's device permission is merged into the parent
2. 2. Which sandbox layer controls whether the application can call clone with a new user namespace?

   The seccomp policy derived from userNamespaces The storage driver The mount namespace
3. 3. Why can a podman compatibility shim remain bounded?

   It forwards the command only after asking the user It parses a finite CLI subset into typed provider requests Podman is rootless
4. 4. A storage driver crashes while preparing the third of five layers. What must remain true?

   The previous valid runtime index and published checkouts remain usable The partial checkout becomes the new runtime index All five source layers are removed
5. 5. A vendor replaces a file at the same HTTPS URL. Which runtime source field prevents accepting it silently?

   name architecture sha256, together with the declared size
6. 6. Two installed SDK addons provide the exclusive slot sdk.go. What decides which one reaches VS Code?

   The provider selected for that parent application's slot The last addon listed in the Store Both are added to PATH in manifest order
7. 7. Which storage driver response order is correct for OverlayFS lower directories?

   Oldest layer first Any order, because OverlayFS sorts them Highest priority first
8. 8. Why does the prepared launch read a runtime index instead of calling the storage driver?

   Because the index contains application data To avoid a maintenance daemon round trip on every start Because the storage driver runs as root
9. 9. A parent starts a declared nested package. Which permission boundary applies to the child?

   The parent policy alone The child's manifest alone The intersection of the child policy and the parent boundary
10. 10. Verified launch finds that a prepared checkout contradicts its recorded layer state while enforcement is off. What happens?

    The checkout is trusted because its OCI digest was checked during install The launch is refused as tampered The application starts because enforcement is off