Explanation
This is how they should be distributed across three datacenters or availability zones, because having an even distribution of managers across datacenters or availability zones ensures that the swarm can survive the loss of any one datacenter or availability zone and maintain quorum. According to the official documentation, managers should be distributed evenly across datacenters or availability zones to ensure that the swarm can survive the loss of any one datacenter or availability zone.
References: https://docs.docker.com/engine/swarm/admin_guide/#add-manager-nodes-for-fault-tolerance

= The command docker run -v /data:/mydata --mode readonly ubuntu is not valid because it has some syntax errors. The correct syntax for running a container with a bind mount is docker run [OPTIONS] IMAGE
[COMMAND] [ARG...]. The errors in the command are:
* The option flag for specifying the volume is --volume or -v, not -v. For example, -v
/data:/mydata should be --volume /data:/mydata.
* The option flag for specifying the mode of the volume is --mount, not --mode. For example, --mode readonly should be --mount type=bind,source=/data,target=/mydata,readonly.
* The option flag for specifying the mode of the container is --detach or -d, not --mode. For example, --mode readonly should be --detach.
The correct command for running a container with a bind mount in read-only mode is:
docker run --volume /data:/mydata --mount type=bind,source=/data,target=/mydata,readonly --detach ubuntu This command will run a container using the ubuntu image and mount the host's /data directory to the container's /mydata directory in read-only mode. The container will run in the background (--detach).
References: : docker run reference | Docker Documentation : [Use bind mounts | Docker Documentation]

Explanation
The networkPolicy shown in the image is designed to block traffic from pods lacking the tier: api label, to pods bearing the tier: backend label. This is because the policy is set to matchLabels: tier: backend, and the ingress is set to - from: podSelector: matchLabels: tier: api. Therefore, any traffic that does not match these labels will be blocked.
References:
* Isolate containers with a user namespace | Docker Docs
* The mnt namespace - Docker Cookbook - Second Edition
* Container security fundamentals part 2: Isolation & namespaces
I hope this helps you understand the concept of networkPolicy and how it works with Kubernetes. If you have any other questions related to Docker, please feel free to ask me.

Explanation
Creating a PersistentVolume with storageClass: "" and hostPath: /data, and a persistentVolumeClaim requesting this PV, and then using that PVC to populate a volume in a pod is not a strategy that successfully accomplishes this. A PersistentVolume is an API object that represents a piece of storage in the cluster that has been provisioned by an administrator. A PersistentVolumeClaim is a request for storage by a user. A hostPath PersistentVolume uses a file or directory on the node to emulate network-attached storage. However, this type of volume only works on a single node cluster, and it does not work on Windows nodes. Therefore, it cannot be used to mount the /data directory on your laptop into a container. References:
https://kubernetes.io/docs/concepts/storage/persistent-volumes/,
https://kubernetes.io/docs/concepts/storage/volumes/#hostpath