CKAD Application Design and Build Practice Question
You have a multi-stage Dockerfile. The first stage builds a binary using a large build image. The second stage copies the binary from the first stage into a minimal runtime image. Which Dockerfile instruction is used to copy artifacts from a previous stage?
⚠ Common exam trap
This question tests the distinction between COPY and ADD in multi-stage builds. The trap is that candidates may confuse ADD's additional features (like URL fetching or tar extraction) with the --from flag, or mistakenly think ENTRYPOINT or CMD can be used for file operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
COPY --from=builder /app/artifact /app/
In multi-stage Docker builds, the COPY instruction with the --from flag allows you to copy files from a named previous stage (e.g., 'builder') into the current stage. This is the standard Docker mechanism for selectively transferring build artifacts while discarding intermediate build dependencies, enabling a smaller final image.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ADD --from=builder /app/artifact /app/
Why it's wrong here
The ADD instruction does not support the --from flag; it only accepts source paths from the build context or remote URLs, optionally auto-extracting tar archives. If you attempt to use --from=builder with ADD, Docker will fail with a parse error because that flag is reserved exclusively for COPY. Trying to reference another stage this way is simply invalid Dockerfile syntax.
- ✗
ENTRYPOINT --from=builder /app/artifact /app/
Why it's wrong here
ENTRYPOINT configures the container's main executable and cannot perform file operations. Passing --from=builder is meaningless here, and if interpreted literally, Docker would treat --from=builder as the command to execute, resulting in a failure at container startup. ENTRYPOINT establishes the runtime process, not how files move between build stages.
- ✗
CMD --from=builder /app/artifact /app/
Why it's wrong here
CMD provides default arguments or a default command for a container and is not a build-time instruction. It has no --from flag, and writing CMD --from=builder /app/artifact /app/ would cause Docker to try executing --from=builder as a program, which cannot succeed. CMD is purely about runtime defaults, never about copying files into an image.
- ✓
COPY --from=builder /app/artifact /app/
Why this is correct
This is the correct multi-stage copy directive: the --from=builder flag tells Docker to retrieve /app/artifact from the filesystem of the stage named 'builder' (created with FROM ... AS builder) and place it at /app/ in the current stage. COPY preserves permissions and is the standard way to transplant compiled artifacts between stages without including the entire build environment in the final image.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.