305-300 Container Virtualization — 25 Questions

Question 1

Which THREE of the following are valid storage driver options for Docker on Linux?

Accepted Answer

overlay2. overlay2 (A) is the default and recommended storage driver on modern Linux because it uses OverlayFS to provide efficient copy-on-write layering via lowerdir/upperdir/merged directories. vfs (C) is a valid driver that performs no copy-on-write and simply copies files at each layer, making it correct though slow and space-inefficient. zfs (D) is a valid driver that leverages ZFS snapshots and clones for copy-on-write layering on systems with ZFS installed. btrfs (E) is also a valid driver using Btrfs subvolumes and snapshots for layering. ext4-driver (B) is not a Docker storage driver name; ext4 is a filesystem, and Docker does not expose an 'ext4-driver' option.

Answer

ext4-driver

Answer

vfs

Question 2

You are using systemd-nspawn to run a container. You notice the container does not have access to the host's system clock. Which flag must be added to the command to allow access to the system time?

Accepted Answer

--capability=CAP_SYS_TIME. Systemd-nspawn uses --private-users and other isolation flags, but specific hardware access requires flags.

Answer

--share-system

Answer

--clock-passthrough

Answer

--bind=/dev/rtc

Question 3

You are configuring an LXC container and need to grant it access to a specific host character device without running the container in privileged mode. Which configuration option in the container's config file should you use?

Accepted Answer

lxc.cgroup2.devices.allow. lxc.cgroup2.devices.allow is the cgroup v2 device controller directive that whitelists a specific device node (by major:minor or type) for a container, allowing access to a host character device without granting full privileged mode. It is the correct mechanism because device access in LXC is enforced by the cgroup device controller, and this key adds the necessary allow rule.

Answer

lxc.cap.keep

Answer

lxc.mount.entry

Answer

lxc.hook.pre-start

Question 4

You are configuring an LXC container and need to ensure the container's root filesystem is isolated from the host. Which configuration option in the container's config file restricts access to the host's /dev directory?

Accepted Answer

lxc.cgroup.devices.deny = a. The lxc.mount.entry and specific device nodes configuration are used to manage isolation.

Answer

lxc.mount.auto = proc:mixed sys:mixed

Answer

lxc.namespace.share = 0

Answer

lxc.cap.drop = sys_admin

Question 5

You are using systemd-nspawn and want to run a container that shares the host's network namespace. Which flag is required?

Accepted Answer

--network-host. The --network-host flag in systemd-nspawn explicitly configures the container to share the host's network namespace, giving it direct access to the host's network interfaces and IP stack. This is the documented option for disabling network namespace isolation entirely. Without it, systemd-nspawn creates a private network namespace by default, isolating the container's networking from the host.

Answer

--private-network=false

Answer

--network-veth

Answer

--share-net

Question 6

You are using a BSD Jail and want to limit the filesystem access of the jail to a specific directory tree. Which utility or configuration mechanism is primarily used to achieve this?

Accepted Answer

jail.conf path parameter. In FreeBSD jails, the path parameter inside jail.conf (or the -path flag on the jail(8) command line) specifies the directory that becomes the jail's root filesystem, effectively confining the jailed processes to that subtree. This is the primary, jail-native mechanism for limiting filesystem access. While chroot underlies the isolation, jail.conf's path is the configuration interface administrators actually use.

Answer

mount -t nullfs

Answer

jail_root_dir

Answer

chroot

Question 7

What is the default bridge network created by Docker when the daemon starts?

Accepted Answer

docker0. The default bridge network created by Docker is named 'bridge'.

Answer

eth0

Answer

virbr0

Answer

none

Question 8

You need to inspect the configuration of an LXC container named 'web'. Which command should you use?

Accepted Answer

lxc-info -n web. The `lxc-info -n web` command queries the state and configuration details of the LXC container named 'web', including its PID, IP addresses, resource usage, and state (running/stopped). The `-n` flag specifies the container name, making it the correct tool to inspect a specific container's configuration and runtime status. This is the standard LXC userspace utility for container introspection.

Answer

lxc-check

Answer

lxc-ls

Answer

lxc-config

Question 9

You are troubleshooting a problem where an LXC container cannot access its own /dev/null. What is a common cause in a non-root container?

Accepted Answer

Missing mknod permission. In a non-root LXC container, the container's root user is mapped to an unprivileged UID on the host via user namespaces. Creating device nodes like /dev/null requires the mknod capability (CAP_MKNOD), which is typically dropped for unprivileged containers. Without it, the container cannot create or access its own /dev/null, causing failures when programs try to redirect output to it.

Answer

Wrong kernel version

Answer

Host kernel panic

Answer

Insufficient RAM

Question 10

In systemd-nspawn, how can you execute a command inside a container that is already running?

Accepted Answer

machinectl shell. machinectl shell is the systemd-nspawn companion command that opens an interactive shell (or runs a command) inside a running container registered with systemd-machined. It uses the container's namespace and does not require knowing the container's PID or manually invoking nsenter. This is the intended, high-level way to execute commands in a running nspawn container.

Answer

systemctl start

Answer

systemd-nspawn -run

Answer

nsenter

Question 11

You are using an overlay network in Docker Swarm. What is the standard protocol used for the control plane and data plane communication between nodes?

Accepted Answer

VXLAN. Docker Swarm overlay networks use VXLAN (Virtual Extensible LAN) as the encapsulation protocol for both control plane and data plane communication between nodes. VXLAN encapsulates Layer 2 Ethernet frames within UDP packets (typically destination port 4789), allowing containers on different hosts to communicate as if on the same Layer 2 network.

Answer

BGP

Answer

IPsec

Answer

GRE

Question 12

Which TWO items are typically included in a Docker context?

Accepted Answer

Local files in the build directory. A Docker context is the set of files sent to the Docker daemon during a build, so option D (local files in the build directory) is correct because the build context consists of the files in the directory specified to `docker build`, which are packaged and transferred to the daemon. Option E (Dockerfile) is also correct because the Dockerfile is part of the build context and is read by the daemon to execute the build instructions. Option A (the host kernel) is not included, since the kernel is provided by the host operating system and is not part of the context sent to the daemon. Option B (remote images) is not included, as images are pulled by the daemon from a registry, not carried in the context. Option C (running containers) is not included, because containers are runtime instances managed by the daemon, not build-context artifacts.

Answer

The host kernel

Answer

Remote images

Answer

Running containers

Question 13

When using systemd-nspawn, you want to limit the memory usage of a container to 512MB. Which flag should be passed to the systemd-nspawn command?

Accepted Answer

--memory-limit=512M. systemd-nspawn uses the --memory-limit flag to restrict the memory consumption of the spawned container.

Answer

--max-mem=512M

Answer

--cgroup-memory=512M

Answer

--limit-mem=512M

Question 14

When configuring a Docker volume that needs to be shared between multiple containers, which storage driver storage path is recommended to ensure persistent data availability if the host reboots?

Accepted Answer

-v /host/path:/container/path. Binding a host directory into the container with -v /host/path:/container/path stores data on the host filesystem, which survives container restarts, host reboots, and even container deletion. This makes it the recommended approach when multiple containers must share persistent data across reboots. The other options either don't provide persistence or aren't volume mechanisms at all.

Answer

--link

Answer

--tmpfs

Answer

--volume-driver=none

Answer

--memory

Question 15

You need to limit the amount of CPU shares a Docker container can utilize. Which flag should be used?

Accepted Answer

--cpu-shares. The `--cpu-shares` flag sets the relative CPU weight (shares) for a container, controlling how CPU time is divided among containers when there is contention. It is a relative weight, not an absolute limit — a container with 1024 shares gets twice the CPU time of one with 512 shares when both are competing for CPU.

Answer

--cpu-limit

Answer

--cpus

Answer

--max-cpu

Answer

--cpu-weight

Question 16

Which kernel feature provides the isolation necessary for namespaces in container virtualization?

Accepted Answer

Namespaces. Linux namespaces are the kernel feature that provides isolation for containers by giving each container its own view of system resources such as PIDs, network interfaces, mount points, hostnames, and user IDs. Without namespaces, containers would share the host's global resource view and could not be isolated from each other. Namespaces are the foundational isolation primitive that makes container virtualization possible.

Answer

OverlayFS

Answer

Seccomp

Answer

Cgroups

Answer

AppArmor

Question 17

Which THREE commands are used to manage the lifecycle of an LXC container?

Accepted Answer

lxc-start. lxc-start (A) is correct because it is the command that boots an existing, stopped LXC container, transitioning it into the running state and thus initiating its lifecycle. lxc-stop (E) is correct because it gracefully shuts down a running container, ending its active lifecycle phase. lxc-destroy (B) is correct because it permanently deletes a container and its associated resources, completing the lifecycle by removing the container entirely. lxc-pause (C) is not among the marked answers because pausing merely suspends a running container's processes without advancing the start/stop/destroy lifecycle stages. lxc-reboot (D) is not marked correct because it restarts a container rather than representing a distinct lifecycle management stage such as creation, running, stopping, or destruction.

Answer

lxc-pause

Answer

lxc-reboot

Question 18

An administrator is configuring a Docker container to limit its CPU and memory usage. Which TWO of the following options can be used with the docker run command to enforce these resource constraints? (Choose two.)

Accepted Answer

--memory. The --cpus and --memory options are used to set hard limits on CPU and memory resources for a container. --cpus limits the number of CPU cores, while --memory sets the maximum memory. Other options like --cpu-shares and --memory-swap affect relative weights or swap, not hard limits. --blkio-weight is for block I/O, not CPU or memory.

Answer

--memory-swap

Answer

--blkio-weight

Answer

--cpu-shares

Question 19

You are deploying a multi-container application with Docker Compose. The web container must be able to resolve the service name 'db' to the database container's IP address, but the database container must NOT be able to initiate connections to the web container. Both containers are on the same user-defined bridge network 'app_net'. Which configuration change should you make?

Accepted Answer

Attach the db container to a separate user-defined network 'db_net', and attach the web container to both 'app_net' and 'db_net'.. Docker Compose allows a service to join multiple networks, and network membership determines reachability. A container can only communicate with another container if they share at least one network. By isolating the database on its own network and attaching only the web container to both networks, the web container gains access to the database, but the database cannot reach the web container. This pattern is commonly used to enforce security boundaries in multi-tier applications.

Answer

Use 'links' in the web service definition to point to the db service, and remove the shared network.

Answer

Attach the web container to a second user-defined network 'frontend_net', and attach the db container only to 'app_net'.

Answer

Place the db container on an internal-only network and the web container on both the internal network and a frontend network.

Question 20

You are building a container image with Buildah and want to ensure that the resulting image can be run by a non-root user without any additional runtime flags. The application inside writes logs to /var/log/app. Which Dockerfile instruction or Buildah command should you use to make /var/log/app writable by the non-root user in the final image?

Accepted Answer

Use the USER instruction to switch to the non-root user, then RUN mkdir -p /var/log/app && chown user:user /var/log/app. To make a directory writable by a non-root user in the final image, you must create it and set ownership to that user during the build. Switching to the user with USER and then running mkdir and chown ensures the directory is owned correctly in the image layer. Other approaches like VOLUME or COPY --chown do not reliably set directory ownership for existing paths.

Answer

Set the environment variable LOG_DIR=/var/log/app and expect the application to create it

Answer

Add a VOLUME instruction for /var/log/app so the directory is writable at runtime

Answer

Use the --chown flag with a COPY instruction to copy a placeholder file into /var/log/app