305-300 Container Virtualization — 15 Questions

Question 1

You are using systemd-nspawn to run a container. You notice the container does not have access to the host's system clock. Which flag must be added to the command to allow access to the system time?

Accepted Answer

--capability=CAP_SYS_TIME. Systemd-nspawn uses --private-users and other isolation flags, but specific hardware access requires flags.

Answer

--share-system

Answer

--clock-passthrough

Answer

--bind=/dev/rtc

Question 2

You are configuring an LXC container and need to ensure the container's root filesystem is isolated from the host. Which configuration option in the container's config file restricts access to the host's /dev directory?

Accepted Answer

lxc.cgroup.devices.deny = a. The lxc.mount.entry and specific device nodes configuration are used to manage isolation.

Answer

lxc.mount.auto = proc:mixed sys:mixed

Answer

lxc.namespace.share = 0

Answer

lxc.cap.drop = sys_admin

Question 3

What is the default bridge network created by Docker when the daemon starts?

Accepted Answer

docker0. The default bridge network created by Docker is named 'bridge'.

Answer

eth0

Answer

virbr0

Answer

none

Question 4

Which THREE of the following are valid storage driver options for Docker on Linux?

Accepted Answer

overlay2. Docker supports multiple storage drivers including overlay2, btrfs, and zfs, depending on the underlying filesystem.

Answer

ext4-driver

Answer

vfs

Question 5

You are optimizing a Dockerfile to reduce image size. Which THREE of the following practices are recommended?

Accepted Answer

Remove /var/lib/apt/lists/* after installing packages. Multi-stage builds, minimizing layers, and cleaning up caches are standard practices.

Answer

Use the FROM latest tag for all base images

Answer

Always install recommended packages for security

Question 6

You are troubleshooting a Docker container that cannot reach the internet despite the host having connectivity. The container uses the default bridge network. Which iptables chain is most likely causing the block?

Accepted Answer

FORWARD. Docker adds rules to the FORWARD chain in the filter table to manage traffic between the bridge network and external networks.

Answer

PREROUTING

Answer

POSTROUTING

Answer

OUTPUT

Question 7

You are configuring an LXC container and need to grant it access to a specific host character device without running the container in privileged mode. Which configuration option in the container's config file should you use?

Accepted Answer

lxc.cgroup2.devices.allow. The lxc.cgroup2.devices.allow directive is the standard way to whitelist specific hardware devices for a container in cgroup2-based environments.

Answer

lxc.cap.keep

Answer

lxc.mount.entry

Answer

lxc.hook.pre-start

Question 8

A Docker container is failing to connect to an external database despite the host being able to ping it. You suspect a bridge networking issue. Which command allows you to inspect the current NAT rules created by Docker?

Accepted Answer

iptables -t nat -L -n. Docker manages iptables rules for container networking.

Answer

docker network inspect bridge

Answer

ip link show docker0

Answer

sysctl -a | grep net.bridge

Question 9

You need to run a container that requires access to the host's network namespace directly to perform packet capture. Which Docker run flag should you use?

Accepted Answer

--network host. The --network host flag allows a container to share the host's networking namespace, providing full access to host network interfaces.

Answer

--cap-add NET_ADMIN

Answer

--privileged

Answer

--net bridge

Question 10

Which Docker command is used to display the resource usage (CPU, memory) of running containers?

Accepted Answer

docker stats. 'docker stats' provides a real-time stream of container resource usage statistics.

Answer

docker top

Answer

docker usage

Answer

docker info

Question 11

When building a Dockerfile, which instruction should be used to define the user context for subsequent RUN, CMD, and ENTRYPOINT instructions?

Accepted Answer

USER. The USER instruction sets the UID/GID for processes executed in subsequent steps.

Answer

WORKDIR

Answer

RUN useradd

Answer

AS

Question 12

You need to inspect the metadata of a specific Docker image without pulling it from a remote registry. Which command should you use?

Accepted Answer

docker manifest inspect. docker manifest inspect allows retrieving information about an image's manifest without downloading the layers.

Answer

docker pull --metadata

Answer

docker image history

Answer

docker image inspect

Question 13

You are using systemd-nspawn and want to run a container that shares the host's network namespace. Which flag is required?

Accepted Answer

--network-host. The --private-network flag disables the network, while omitting it or specifically using --network-veth allows various configurations; however, to share the host's namespace, one must use --network-host.

Answer

--private-network=false

Answer

--network-veth

Answer

--share-net

Question 14

In an OpenVZ environment, you need to limit the number of processes a container can create. Which parameter in the container configuration file should be modified?

Accepted Answer

NUMPROC. The 'nproc' (or numproc) parameter in the OpenVZ configuration limits the total number of processes a container is allowed to hold.

Answer

PHYSPAGES

Answer

KMEMSIZE

Answer

PRIVVMPAGES

Question 15

You are using a BSD Jail and want to limit the filesystem access of the jail to a specific directory tree. Which utility or configuration mechanism is primarily used to achieve this?

Accepted Answer

jail.conf path parameter. The 'path' configuration parameter in the jail.conf file defines the root directory of the jail.

Answer

mount -t nullfs

Answer

jail_root_dir

Answer

chroot