Explanation
The PVC remains unbound until a persistentVolume that matches all requirements of the PVC becomes available is an action Kubernetes takes in this situation. A persistentVolumeClaim (PVC) is a request for storage by a user. A PVC specifies the desired size, access modes, and storage class of the storage. A persistentVolume (PV) is a piece of storage in the cluster that has been provisioned by an administrator. A PV has a lifecycle independent of any individual pod that uses it. A PVC is automatically bound to a suitable PV based on its requirements. If no PV exists that matches the PVC, and dynamic provisioning is not enabled, then the PVC remains unbound indefinitely until a matching PV is created. References:
https://kubernetes.io/docs/concepts/storage/persistent-volumes/,
https://kubernetes.io/docs/concepts/storage/persistent-volumes/#lifecycle-of-a-volume-and-claim

Explanation
Docker will block the command docker container run myorg/myimage:1.0 if the image tag myorg/myimage:1.0 is unsigned and the environment variable DOCKER_CONTENT_TRUST=1 is set. The reason is that setting DOCKER_CONTENT_TRUST=1 enables Docker Content Trust (DCT), which is a feature that allows users to verify the integrity and publisher of Docker images using digital signatures1.
When DCT is enabled, Docker will only pull, run, or build images that have valid signatures. If an image tag is unsigned or has an invalid signature, Docker will reject the operation and display an error message2. Therefore, to run an unsigned image with DCT enabled, you need to either disable DCT by setting DOCKER_CONTENT_TRUST=0 or use the --disable-content-trust flag, or sign the image tag with a valid key3. References:
* Content trust in Docker
* Determine if Docker image is signed or unsigned
* Signing Images and Enabling Docker Content Trust

Explanation
Deleting '/var/lib/docker' directory does not upgrade Docker Engine CE to Docker Engine EE. The
'/var/lib/docker' directory is where Docker stores all its data and metadata related to containers, images, volumes, networks, etc. Deleting this directory will remove all your Docker data and configurations from your system, but it will not change your Docker version or edition. To upgrade Docker Engine CE to Docker Engine EE, you need to uninstall 'docker-ce' package before installing 'docker-ee' package. References:
https://docs.docker.com/engine/install/linux-postinstall/#where-are-images-and-containers-stored-on-the-filesyst
https://docs.docker.com/engine/install/centos/#upgrade-docker-after-using-the-convenience-script

Explanation
= The role of Control Groups (cgroups) when used with a Docker container is not user authorization to the Docker API. Cgroups are a feature of the Linux kernel that allow you to limit the access processes and containers have to system resources such as CPU, RAM, IOPS and network1. Cgroups enable Docker to share available hardware resources to containers and optionally enforce limits and constraints2. User authorization to the Docker API is a different concept that involves granting permissions to users or groups to perform certain actions on the Docker daemon, such as creating, running, or stopping containers3.
References:
* Lab: Control Groups (cgroups) | dockerlabs
* Runtime metrics | Docker Docs
* Authorize users to access the Docker API | Docker Docs
I hope this helps you understand the role of cgroups and how they work with Docker containers. If you have any other questions related to Docker, please feel free to ask me.