EX188 Container Image Building Practice Test 2 — 15 Questions

Question 1

What is the primary benefit of utilizing multi-stage builds in Containerfiles?

Accepted Answer

It allows you to produce a final production image containing only the application binary and runtime dependencies, significantly reducing image size and attack surface.. Multi-stage builds allow developers to use multiple FROM statements, leaving behind build tools and heavy SDKs in earlier stages and keeping production images small and secure.

Answer

It automatically encrypts environment variables stored in the image layers.

Answer

It bypasses the need for a container registry when sharing images.

Answer

It speeds up local DNS resolution during container execution.

Question 2

An auditor notices that a container image runs its main application process as the 'root' user by default. Which Containerfile instruction can be added to ensure the container runs as a non-privileged user named 'appuser'?

Accepted Answer

RUN useradd -u 1000 appuser && chown -R appuser /app
USER appuser. Using USER appuser ensures that subsequent commands and the runtime process execute under that user account.

Answer

EXEC appuser

Answer

PRIVILEGE drop appuser

Answer

SECURITY --user=appuser

Question 3

When writing a Containerfile, what is the difference between shell form and exec form for the CMD instruction?

Accepted Answer

Exec form runs the executable directly without invoking a shell, making it receive Unix signals (like SIGTERM) properly as PID 1.. Exec form runs the command directly without a shell, whereas shell form runs the command inside a subshell (/bin/sh -c).

Answer

There is no functional difference; they are syntactic aliases.

Answer

Shell form is required for multi-stage builds, while exec form is for single-stage builds.

Answer

Shell form runs the command as PID 1, while exec form spawns a bash shell wrapper.

Question 4

You need to ensure that a file copied into your image via the COPY instruction is owned by a specific user 'developer' and group 'devgroup'. How can this be achieved efficiently?

Accepted Answer

COPY --chown=developer:devgroup app.py /app/app.py. The COPY instruction supports the --chown flag to set ownership during the copy operation.

Answer

COPY app.py /app/app.py && chown developer:devgroup /app/app.py

Answer

COPY --user=developer:devgroup app.py /app/app.py

Answer

ADD --owner=developer app.py /app/app.py

Question 5

A developer has written a Containerfile with multiple COPY instructions for static configuration files that change frequently, placed near the top of the Containerfile before the application code installation. Why is this considered a bad practice for build caching?

Accepted Answer

It invalidates the build cache for all subsequent instructions whenever those configuration files change, slowing down builds.. Changing a file earlier in the Containerfile invalidates the cache for all subsequent instructions, forcing unnecessary rebuilds of heavy steps.

Answer

It violates OCI container image specification limits on COPY counts.

Answer

It causes the ENTRYPOINT instruction to fail at runtime.

Answer

It causes Podman to store duplicate layers in local storage, exhausting disk space.

Question 6

You are building an image behind a corporate firewall that requires a custom Certificate Authority (CA) certificate to trust internal registries and repositories. How can you add this CA certificate to the build container?

Accepted Answer

COPY corporate-ca.crt /etc/pki/ca-trust/source/anchors/
RUN update-ca-trust. Placing the CA certificate in the appropriate system directory (e.g., /etc/pki/ca-trust/source/anchors/ on RHEL/Fedora-based images) and running update-ca-trust is standard.

Answer

TRUST corporate-ca.crt

Answer

EXPOSE CERT corporate-ca.crt

Answer

ENV CA_CERT=corporate-ca.crt

Question 7

You need to label your container image with maintainer details and version metadata according to OCI annotation standards. Which instruction should you use?

Accepted Answer

LABEL maintainer="admin@example.com" version="1.0". The LABEL instruction adds metadata to an image as key-value pairs.

Answer

METADATA maintainer="admin@example.com"

Answer

ANNOTATE maintainer="admin@example.com"

Answer

TAG maintainer="admin@example.com"

Question 8

You want to ensure that if any command in a multi-command RUN instruction fails, the entire container build process fails immediately. What shell option should be set or is default in Containerfiles?

Accepted Answer

RUN set -e && command1 && command2. By default, the shell used in shell form runs with /bin/sh -c. To ensure failures propagate, strict error handling like set -o pipefail can be used.

Answer

RUN --strict-error command1 && command2

Answer

BUILD --fail-on-error

Answer

RUN ignore-errors=false command1 && command2

Question 9

When using the ADD instruction with a remote URL source, what is a recommended best practice regarding security and layer efficiency?

Accepted Answer

Avoid ADD for remote URLs; instead, use curl or wget within a RUN instruction to download, extract, and clean up in a single layer.. Downloading remote archives or files via ADD does not allow caching effectively, and it's generally recommended to use curl or wget inside a RUN instruction combined with cleanup to keep images lean and secure.

Answer

Always use ADD for remote URLs because it automatically verifies SSL/TLS certificates against the host system store.

Answer

ADD for remote URLs is deprecated and will cause podman build to abort with an error.

Answer

Use ADD for remote URLs because it creates a smaller layer than RUN.

Question 10

How does Podman's rootless build architecture handle volume mounts or privileged operations specified within a RUN instruction in a Containerfile?

Accepted Answer

Rootless builds execute within user namespaces, mapping root inside the container to an unprivileged user on the host, restricting certain host-level operations.. Rootless Podman utilizes user namespaces and often relies on tools like buildah or fuse-overlayfs to perform builds without root privileges on the host.

Answer

Rootless builds cannot execute RUN instructions that install RPM packages using dnf.

Answer

Rootless builds automatically elevate privileges via sudo when a RUN instruction requires root access.

Answer

Rootless builds require the buildah daemon to be running as root in systemd.

Question 11

You are building a minimal container image from scratch using 'FROM scratch'. Your statically compiled Go binary fails to execute when the container starts, with a 'file not found' error, even though it was successfully copied into the image. What is the most likely cause?

Accepted Answer

The binary was dynamically linked against glibc or requires system files (like /etc/passwd or /lib64/ld-linux-x86-64.so.2) that are absent in the scratch image.. 'FROM scratch' is an empty image. If the binary depends on shared libraries (e.g., glibc) or dynamic linkers that exist in the host/build environment but not in scratch, it will fail.

Answer

The binary was copied with incorrect permissions; it needs to be made executable with chmod +x during build.

Answer

The EXPOSE instruction was missing, preventing the binary from binding to network interfaces.

Answer

The WORKDIR instruction was omitted, preventing Podman from locating the binary.

Question 12

A developer wants to pass a secret API key during the container build process without leaving the secret exposed in image layers or history. Which Podman feature should be used?

Accepted Answer

podman build --secret id=mysecret,src=/path/to/key.txt . with RUN --mount=type=secret,id=mysecret .... Podman supports build-time secrets using the --secret flag and the --mount=type=secret directive in the Containerfile.

Answer

ARG API_KEY=secret_value

Answer

ENV API_KEY=secret_value

Answer

ADD /path/to/key.txt /app/key.txt followed by RUN rm /app/key.txt

Question 13

You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?

Accepted Answer

The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.. If instructions preceding the COPY or cache-dependent instruction generate timestamps or non-deterministic content (like using ADD with a remote URL or changing ENV order), the cache is invalidated.

Answer

The Containerfile lacks an explicit CACHE instruction at the top.

Answer

Podman disables caching by default for all RUN instructions containing package managers.

Answer

The USER instruction was set to root, which disables layer caching.

Question 14

When creating multi-architecture container images using podman build, how can you ensure that architecture-specific binaries are correctly handled when using instructions like COPY?

Accepted Answer

By running podman build separately for each architecture and combining them with podman manifest.. Podman supports building for multiple architectures using buildah/podman features, where TARGETPLATFORM, TARGETOS, and TARGETARCH build args are automatically available.

Answer

By setting the ARCH environment variable in the base image.

Answer

By manually editing the Containerfile to include architecture-specific IF/ELSE statements.

Question 15

Which TWO instructions in a Containerfile can be used to set metadata or default execution parameters that influence how a container runs? (Choose two.)

Accepted Answer

CMD. CMD and ENTRYPOINT both define runtime execution behavior for containers.

Answer

RUN

Answer

COPY

Answer

FROM