Docker will block the command docker container run myorg/myimage:1.0 if the image tag myorg/myimage:1.0 is unsigned and the environment variable DOCKER_CONTENT_TRUST=1 is set. The reason is that setting DOCKER_CONTENT_TRUST=1 enables Docker Content Trust (DCT), which is a feature that allows users to verify the integrity and publisher of Docker images using digital signatures1. When DCT is enabled, Docker will only pull, run, or build images that have valid signatures. If an image tag is unsigned or has an invalid signature, Docker will reject the operation and display an error message2. Therefore, to run an unsigned image with DCT enabled, you need to either disable DCT by setting DOCKER_CONTENT_TRUST=0 or use the --disable-content-trust flag, or sign the image tag with a valid key3. Reference:
Content trust in Docker
Determine if Docker image is signed or unsigned
Signing Images and Enabling Docker Content Trust

The command kubectl drain <node name> is the correct one to run on the node to gracefully terminate all pods on the node, while marking the node as unschedulable. This command will safely evict all the pods from the node before you perform maintenance on the node, such as installing patches or an OS upgrade1. It will respect the PodDisruptionBudgets you have specified, if any, and allow the pod's containers to gracefully terminate1. It will also mark the node as unschedulable, so that no new pods can be scheduled on the node until it is ready1.
The other commands are not correct because:
*docker swarm leave will make the node leave the swarm cluster, but it will not affect the Kubernetes workloads on the node2.
*docker node update -availability drain <node name> will change the availability of the node to drain, which means that no new tasks can be assigned to the node, but it will not terminate the existing pods on the node3.
*kubectl cordon <node name> will mark the node as unschedulable, but it will not evict the pods on the node4.
References:
*Safely Drain a Node | Kubernetes
*[docker swarm leave | Docker Docs]
*[docker node update | Docker Docs]
*[kubectl cordon | Kubernetes Docs]

= Simultaneously creating and tagging multiple images is not an advantage of multi-stage builds. Multi-stage builds are a feature that allows you to use multiple FROM statements in your Dockerfile, each starting a new stage of the build1. You can selectively copy artifacts from one stage to another, leaving behind everything you don't want in the final image. This helps you to optimize the size and security of your images, as well as to simplify your build process12. However, multi-stage builds do not create or tag multiple images at once. Each Dockerfile produces one final image, which is the result of the last stage in the Dockerfile1. If you want to create and tag multiple images from a single Dockerfile, you need to use the --target option with the docker build command, and specify the name of the stage you want to build and tag3. Reference:
Multi-stage builds | Docker Docs
What Are Multi-Stage Docker Builds? - How-To Geek
Stop at a specific build stage | Docker Docs

A node is a physical or virtual machine running Docker Engine in swarm mode1. A node can be either a manager or a worker, depending on its role in the cluster1. A physical machine participating in the swarm is a node, regardless of its role or availability2. References:
* How nodes work | Docker Docs
* Manage nodes in a swarm | Docker Docs