Red Hat · Free Practice Questions · Last reviewed May 2026
30 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
When writing a Containerfile, which instruction specifies the base image to be used for the subsequent build steps?
BASE
INIT
FROM
FROM declares the base image from which subsequent build steps run, and it must be the first instruction in a stage. It satisfies the stem because every later instruction, such as RUN or COPY, executes against the filesystem and metadata established by that base image.
PARENT
Which instruction documents the network ports on which a container listens at runtime?
LISTEN
EXPOSE
EXPOSE documents the network ports a container listens on at runtime, functioning as metadata for image consumers and tooling. It satisfies the stem's requirement for declaring listening ports, unlike RUN or CMD, which execute commands rather than record port information.
PORT
OPEN
A developer wants to build a container image using podman build, but the Containerfile is named 'Customfile' and located in a subdirectory named 'dockerfiles'. Which command accomplishes this?
podman build -f dockerfiles/Customfile .
The -f flag overrides podman build's default Containerfile lookup, pointing it at dockerfiles/Customfile. The trailing dot supplies the build context, so podman reads instructions from that named file while resolving COPY and ADD paths relative to the current directory, satisfying both the non-standard filename and subdirectory location.
podman build --file-path dockerfiles/Customfile .
podman build -p dockerfiles/Customfile .
podman build --config dockerfiles/Customfile .
You need to set a persistent environment variable named 'APP_PORT' with the value '8080' inside a container image via the Containerfile. Which instruction should you use?
EXPORT APP_PORT=8080
ENV APP_PORT=8080
ENV sets a persistent environment variable that remains available to processes at build and runtime within the image. Unlike ARG, which applies only during the build, ENV satisfies the requirement for a persistent APP_PORT value of 8080 in the Containerfile.
VAR APP_PORT=8080
SET APP_PORT=8080
Which instruction should be used in a Containerfile to copy local files from the host machine into the container filesystem?
COPY
COPY transfers files from the build context on the host into the image filesystem during a build. ADD also copies but additionally handles remote URLs and archive extraction, so COPY is the precise instruction for plain local file transfer into the container.
TRANSFER
ADD
MOVE
Which Containerfile instruction sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions?
PATH
ENV
WORKDIR
WORKDIR sets the working directory used by subsequent RUN, CMD, ENTRYPOINT, COPY and ADD instructions in the Containerfile, persisting across later layers. This directly satisfies the stem's requirement for the instruction that establishes that directory context.
RUN
Want more Container Image Building practice?
Practice this domainAn administrator runs a container with a SELinux-relabeled host directory mount using the Z option, but multiple containers need to share write access to this exact same volume. Which option should be used instead?
podman run -v /host/data:/data:O
podman run -v /host/data:/data:Z
podman run -v /host/data:/data:z
Lowercase z relabels content so multiple containers can share the volume.
podman run -v /host/data:/data:shared
An engineer needs to inspect the low-level configuration details, mount points, and driver options of a named volume named 'app_vol'. Which command provides this information in JSON format?
podman volume inspect app_vol
`podman volume inspect app_vol` returns the volume's full configuration as a JSON array, exposing Mountpoint, Driver, Options, Labels and Scope. This directly satisfies the stem's requirement for low-level mount point and driver detail in JSON, unlike `podman volume ls`, which lists names only.
podman volume show app_vol
podman volume status app_vol
podman inspect volume app_vol
Where are Podman named volumes typically stored on the host file system by default for a non-root user?
/var/lib/containers/storage/volumes/
/etc/containers/volumes/
/var/run/containers/storage/
~/.local/share/containers/storage/volumes/
For a non-root user, Podman stores named volumes under the user's home directory because rootless containers cannot write to `/var/lib/containers`. The default rootless storage path is `~/.local/share/containers/storage`, with named volumes placed in its `volumes/` subdirectory, satisfying the non-root constraint in the stem.
A developer wants to mount a host directory into a container with read-only permissions to prevent accidental data modification. Which volume option flag achieves this?
podman run --read-only-mount=/host/data
podman run -v /host/data:/container/data:ro
The `:ro` suffix on the `-v` bind mount sets the mount's read-only attribute in the kernel, so writes to `/container/data` fail with EROFS. This directly satisfies the stem's constraint of preventing accidental modification of the host directory, while still exposing its contents to the container.
podman run -v /host/data:/container/data:rw
podman run --mount type=bind,source=/host/data,destination=/container/data,readonly=false
An administrator needs to create a persistent storage area managed completely by Podman that does not rely on a specific host directory path. Which command should be used?
podman volume bind my_data
podman run -v /my_data
podman volume create my_data
Podman volumes are stored in a Podman-managed location on the host, so no explicit host directory path is required. Creating the named volume with podman volume create my_data satisfies the persistence and host-path-independence constraints before it is mounted into a container.
podman create volume my_data
How can an administrator remove all unused, dangling Podman volumes that are not currently attached to any container?
podman rm --volumes
podman volume rm --all
podman volume clean
podman volume prune
podman volume prune removes all volumes not referenced by any container, matching the dangling-volume requirement exactly. Unlike podman volume rm, it needs no explicit volume names, so it clears unused volumes in one non-interactive command.
Want more Storage And Configuration practice?
Practice this domainA user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?
~/.local/share/containers/storage.conf
/etc/sysconfig/podman
/etc/containers/registries.conf
~/.config/containers/registries.conf
Rootless Podman looks for user-specific registry configurations in ~/.config/containers/registries.conf.
A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?
podman inspect image_name
podman inspect reads the local image's configuration metadata and layer information from container storage without creating or starting a container. Commands such as podman run or podman history execute or rebuild context, so they fail the stem's constraint of inspecting without running.
podman view image_name
podman info
podman show image_name
A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?
/etc/containers/signatures.yaml
~/.config/containers/policy.json
/etc/containers/policy.json
/etc/containers/policy.json is the system-wide policy file that container tooling such as Podman and Skopeo consult by default when deciding whether to accept an image. It defines which registries and signatures are trusted, satisfying RHEL 9's requirement for image signature verification without per-user configuration.
/etc/containers/registries.conf
An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?
podman push --auth registry.example.com
podman auth registry.example.com
podman login registry.example.com
Podman must authenticate against the target registry before any push succeeds. Running podman login registry.example.com stores credentials for that registry, so the subsequent push to registry.example.com/team is authorised rather than rejected with an authentication error.
podman connect registry.example.com
After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?
podman rename myapp:v1 registry.example.com/myteam/myapp:latest
podman commit myapp:v1 registry.example.com/myteam/myapp:latest
podman push myapp:v1 --target registry.example.com/myteam/myapp:latest
podman tag myapp:v1 registry.example.com/myteam/myapp:latest
The tag subcommand creates a new reference pointing at the existing local image without copying layers or contacting the registry. The source stays myapp:v1 and the fully qualified target name is added, ready for a later push.
A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?
:ro
:shared
:z
The :z flag relabels the mounted host directory with a shared SELinux context (svirt_sandbox_file_t) permitting container processes to write. Without it, SELinux denies writes to the volume. In rootless mode, user namespaces handle equivalent permission mapping.
:exec
Want more Registry And Security practice?
Practice this domainAn administrator creates a custom CNI network using 'podman network create mynet' and wants to assign a static IP address to a container upon creation. Which option achieves this?
podman run --network mynet:192.168.100.50 -d myimage
podman run --network mynet --ip 192.168.100.50 -d myimage
Passing '--ip 192.168.100.50' alongside '--network mynet' assigns the static address within that custom CNI network at container creation. Podman only honours the static IP when the named network is specified, satisfying the requirement to fix the address during 'podman run'.
podman network connect --ip 192.168.100.50 mynet container_id
podman run --net-static-ip 192.168.100.50 -d myimage
You need to configure a container so that its port 8080 maps to port 80 on the host's loopback interface only (127.0.0.1). Which syntax is correct?
podman run --net 127.0.0.1:80:8080 myapp
podman run -p 80:8080/127.0.0.1 myapp
podman run --publish 8080:80/lo myapp
podman run -p 127.0.0.1:80:8080 myapp
Binding the host address explicitly as 127.0.0.1:80:8080 restricts the published port to the loopback interface, satisfying the stem's requirement that only the host itself reach container port 8080 via host port 80. Omitting the address would publish on all interfaces, exposing the service externally.
A container needs to be created that shares the host's network stack entirely, bypassing any NAT or virtual interface overhead. Which Podman flag achieves this?
--share-net
--publish host
--network host
Using --network host places the container directly in the host's network namespace, so it shares the host stack with no NAT or virtual interface. This satisfies the stem's requirement to bypass that overhead entirely, unlike bridge or slirp4netns modes.
--net bridge
Which Podman network mode completely isolates a container from any network communication, removing all interfaces except the loopback?
--network none
`--network none` creates a network namespace containing only the loopback interface, so the container has no route to other containers, the host, or external networks. This directly satisfies the stem's requirement for complete isolation with all interfaces removed except loopback.
--network isolated
--network closed
--network disabled
You need to inspect the configuration details, including subnet, gateway, and driver, of a custom Podman network named 'appnet'. Which command should you run?
podman inspect --network appnet
podman network show appnet
podman network status appnet
podman network inspect appnet
The podman network inspect command outputs the full JSON configuration of the named network, including subnet, gateway and driver details. Appending the network name 'appnet' targets that specific network, satisfying the requirement to examine its configuration.
You want to remove a custom Podman network named 'testnet', but it currently has active containers attached to it. What happens?
The network is removed, and the containers lose their network interface silently.
The deletion fails until all connected containers are stopped and disconnected.
Podman refuses to remove a network while containers remain attached, returning an error rather than silently detaching them. You must stop and disconnect every container from 'testnet' first, satisfying the stem's active-container constraint. This prevents orphaned containers losing network connectivity mid-operation.
The containers are automatically disconnected and moved to the default bridge network.
The containers are automatically terminated and the network is removed.
Want more Networking And Compose practice?
Practice this domainAn administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?
podman monitor --stream
podman events
`podman events` streams real-time lifecycle events from the Podman service, reporting actions such as create, start, stop and die for every container on the system. It satisfies the stem's requirement for system-wide, real-time monitoring, unlike `podman ps`, which only lists current container state.
podman logs --follow --events
podman system trace
An administrator needs to start a container named webapp from the image docker.io/library/httpd in the background. Which podman command should be used?
podman run -d --name webapp docker.io/library/httpd
The -d flag detaches the container so it runs in the background, and --name webapp assigns the required container name. Specifying docker.io/library/httpd as the image pulls and starts it, satisfying both the naming and background constraints in one command.
podman up -d --name webapp docker.io/library/httpd
podman container create -d --name webapp docker.io/library/httpd
podman start -d docker.io/library/httpd --name webapp
A container named db_cache has stopped unexpectedly. An administrator wants to see the standard output logs generated by this container prior to its exit. Which command should be used?
podman inspect --logs db_cache
podman logs db_cache
`podman logs db_cache` retrieves the captured stdout/stderr of the container, including output written before it exited, satisfying the requirement to inspect pre-exit standard output. Because Podman persists container logs after termination, this works even though `db_cache` has stopped, unlike `podman attach`, which requires a running container.
podman output db_cache
podman history db_cache
An administrator needs to inspect low-level configuration, network settings, and state details of a running container named redis_cache in JSON format. Which command provides this?
podman show redis_cache
podman details redis_cache
podman inspect redis_cache
Podman stores container configuration as OCI metadata, and inspect renders it as JSON, exposing low-level settings, network configuration and runtime state. Unlike logs or ps, which show only summary or output data, inspect returns the full structured document the administrator requires.
podman query --json redis_cache
A container named app_server is running and consuming excessive CPU. An administrator needs to gracefully stop this container with a 30-second timeout before forcing termination. Which command accomplishes this?
podman kill --signal SIGTERM --timeout 30 app_server
podman halt -s 30 app_server
podman stop --time 30 app_server
The --time flag sets the grace period before SIGKILL, so podman stop --time 30 app_server sends SIGTERM, waits 30 seconds for graceful shutdown, then forces termination. This precisely matches the stem's requirement for a graceful stop with a 30-second timeout.
podman terminate --grace-period=30 app_server
An administrator has created a systemd service file named container-web.service using podman generate systemd. Where should this file be placed for a rootless user to manage it as a user-level service?
~/.local/share/podman/systemd/
/etc/systemd/system/
~/.config/systemd/user/
Rootless Podman services run under the user's own systemd instance, which reads units from ~/.config/systemd/user/. Placing the generated file there lets the unprivileged user enable and manage it with systemctl --user, without root-owned system paths.
/var/lib/containers/systemd/
Want more Container Operations And Lifecycle practice?
Practice this domainThe EX188 exam is performance-based — there are no multiple-choice questions. It is a hands-on lab exam completed within 150 minutes. You complete practical tasks in a live or simulated environment. Courseiva practice questions cover the underlying concepts.
Hands-on Linux administration tasks in a live RHEL environment.
The exam covers 5 domains: Container Image Building, Storage And Configuration, Registry And Security, Networking And Compose, Container Operations And Lifecycle. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Red Hat EX188 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.