EX188 Container Image Building Practice Test 3 — 15 Questions

Question 1

When using the ADD instruction with a remote URL source, what is a recommended best practice regarding security and layer efficiency?

Accepted Answer

Avoid ADD for remote URLs; instead, use curl or wget within a RUN instruction to download, extract, and clean up in a single layer.. Using ADD with a remote URL is discouraged because it creates a separate layer for the downloaded file and does not automatically extract archives (unless the URL points to a recognized archive format, but that behavior is inconsistent). Instead, using curl or wget within a RUN instruction allows you to download, extract, and clean up in a single layer, reducing image size and avoiding caching issues. This is a security best practice because you can verify checksums and avoid leaving unnecessary files.

Answer

Always use ADD for remote URLs because it automatically verifies SSL/TLS certificates against the host system store.

Answer

ADD for remote URLs is deprecated and will cause podman build to abort with an error.

Answer

Use ADD for remote URLs because it creates a smaller layer than RUN.

Question 2

How does Podman's rootless build architecture handle volume mounts or privileged operations specified within a RUN instruction in a Containerfile?

Accepted Answer

Rootless builds execute within user namespaces, mapping root inside the container to an unprivileged user on the host, restricting certain host-level operations.. Podman rootless builds run inside a user namespace where the container's UID 0 is mapped to the invoking unprivileged user's UID on the host (via /etc/subuid and /etc/subgid ranges). This means RUN instructions that appear to run as root inside the build actually execute as an unprivileged user on the host, so operations requiring real host privileges — mounting block devices, changing host ownership outside the mapped range, or binding to privileged ports — are restricted or fail.

Answer

Rootless builds cannot execute RUN instructions that install RPM packages using dnf.

Answer

Rootless builds automatically elevate privileges via sudo when a RUN instruction requires root access.

Answer

Rootless builds require the buildah daemon to be running as root in systemd.

Question 3

You are building a minimal container image from scratch using 'FROM scratch'. Your statically compiled Go binary fails to execute when the container starts, with a 'file not found' error, even though it was successfully copied into the image. What is the most likely cause?

Accepted Answer

The binary was dynamically linked against glibc or requires system files (like /etc/passwd or /lib64/ld-linux-x86-64.so.2) that are absent in the scratch image.. 'FROM scratch' is an empty image. If the binary depends on shared libraries (e.g., glibc) or dynamic linkers that exist in the host/build environment but not in scratch, it will fail.

Answer

The binary was copied with incorrect permissions; it needs to be made executable with chmod +x during build.

Answer

The EXPOSE instruction was missing, preventing the binary from binding to network interfaces.

Answer

The WORKDIR instruction was omitted, preventing Podman from locating the binary.

Question 4

A developer wants to pass a secret API key during the container build process without leaving the secret exposed in image layers or history. Which Podman feature should be used?

Accepted Answer

podman build --secret id=mysecret,src=/path/to/key.txt . with RUN --mount=type=secret,id=mysecret .... Podman supports build-time secrets using the --secret flag and the --mount=type=secret directive in the Containerfile.

Answer

ARG API_KEY=secret_value

Answer

ENV API_KEY=secret_value

Answer

ADD /path/to/key.txt /app/key.txt followed by RUN rm /app/key.txt

Question 5

You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?

Accepted Answer

The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.. Docker/Podman layer caching invalidates a RUN layer when any preceding instruction's layer changes. If COPY requirements.txt comes after an instruction that produces non-deterministic output (e.g., a RUN that fetches latest packages or writes timestamps) or if build-context files have changed mtimes, the cache key for the COPY layer changes, invalidating all subsequent RUN layers including the dependency install.

Answer

The Containerfile lacks an explicit CACHE instruction at the top.

Answer

Podman disables caching by default for all RUN instructions containing package managers.

Answer

The USER instruction was set to root, which disables layer caching.

Question 6

Which TWO instructions in a Containerfile can be used to set metadata or default execution parameters that influence how a container runs? (Choose two.)

Accepted Answer

CMD. CMD [CORRECT] is right because it sets the default command (and/or default arguments) that the container executes when it starts if no command is supplied at runtime, directly influencing how the container runs. ENTRYPOINT [CORRECT] is also right because it configures the executable that the container always runs, defining the container's primary process and default execution behavior. Both are runtime metadata instructions stored in the image config, unlike build-time instructions. RUN (A) executes commands during image build to create layers and does not set runtime defaults. COPY (D) only copies files from the build context into the image filesystem. FROM (E) merely specifies the base image for the build stage and has no role in runtime execution parameters.

Answer

RUN

Answer

COPY

Answer

FROM

Question 7

You need to ensure that a container image built with Podman includes reproducible timestamps for files to improve security and supply chain verification. Which flag or environment variable controls this?

Accepted Answer

SOURCE_DATE_EPOCH. SOURCE_DATE_EPOCH is the standardized environment variable (from the reproducible-builds.org specification) that sets a fixed timestamp for files created during a build, enabling bit-for-bit reproducible images. Podman and Buildah honor it during podman build, so setting it produces deterministic file timestamps. This supports supply chain verification because identical inputs yield identical image digests.

Answer

PODMAN_REPRODUCIBLE_BUILD=true

Answer

TIMESTAMP=0 in the Containerfile ENV

Answer

--reproducible flag in podman build

Question 8

Which TWO Containerfile instructions are used to bring files or data from outside the container into the build context or image? (Choose two.)

Accepted Answer

COPY. COPY is correct because it copies files or directories from the build context (or from a stage in a multi-stage build via --from) into the image filesystem, and it does not perform any remote URL fetching or automatic archive extraction. ADD is correct because it also brings files into the image, and additionally supports fetching remote URLs and auto-extracting recognized local tar archives into the destination. GET, FETCH, and IMPORT are not valid Containerfile/Dockerfile instructions, so they cannot be used to bring files or data into the build context or image.

Answer

GET

Answer

FETCH

Answer

IMPORT

Question 9

Which TWO commands can be used with Podman to build a container image from a Containerfile? (Choose two.)

Accepted Answer

podman image build. podman build and podman image build are both valid commands for building images.

Answer

podman container build

Answer

podman make image

Answer

podman create build

Question 10

Which TWO options are valid flags for the 'podman build' command to specify build arguments and tags? (Choose two.)

Accepted Answer

--build-arg. Option C (--build-arg) is correct because 'podman build --build-arg KEY=VALUE' passes a build-time variable into the Containerfile/Dockerfile, matching the ARG instruction during the image build. Option D (-t / --tag) is correct because 'podman build -t name:tag' (or --tag) assigns a repository name and tag to the resulting image, which is exactly how you name built images. Option A (--volume) is not a build flag for specifying build arguments or tags; it is used with run/create to mount host paths into containers. Option B (--publish) is also a run/create flag for mapping container ports to host ports, not a build argument or tag mechanism. Option E (--env-file) supplies environment variables at runtime for run/create, not build-time arguments or image tags, so it does not fit the scenario.

Answer

--volume

Answer

--publish

Answer

--env-file

Question 11

Which TWO statements are true regarding the EXPOSE instruction in a Containerfile? (Choose two.)

Accepted Answer

It informs Podman that the container listens on the specified network ports at runtime.. Option A is correct because EXPOSE in a Containerfile declares the network ports the containerized application listens on at runtime, and Podman records this metadata so tools like podman inspect and podman run -P can use it. Option D is correct because EXPOSE serves primarily as documentation between the image creator and the container operator, indicating intended listening ports without actually opening or publishing them. Option B is wrong because EXPOSE has no relationship to environment variables; port configuration via env vars is a separate application-level concern. Option C is wrong because EXPOSE does not create or enforce firewall rules in the container network namespace and does not block unexposed ports. Option E is wrong because EXPOSE alone does not publish ports to the host; publishing requires -p for explicit mapping or -P to publish all exposed ports to random host ports.

Answer

It replaces the need to define environment variables for port configuration.

Answer

It enforces strict firewall rules inside the container network namespace, blocking unexposed ports.

Answer

It automatically publishes all exposed ports to random host ports without needing the -p or -P flag.

Question 12

Which TWO instructions are used to define variables or set environment values within a Containerfile? (Choose two.)

Accepted Answer

ARG. ARG and ENV are used for defining build arguments and environment variables respectively.

Answer

DEFINE

Answer

VAR

Answer

SET

Question 13

Which THREE practices should be followed to optimize container image size and build caching when writing Containerfiles? (Choose three.)

Accepted Answer

Order Containerfile instructions from least frequently changing to most frequently changing to maximize cache hits.. Caching and layer minimization depend on instruction order, cleanup in the same layer, and avoiding unnecessary tool installation.

Answer

Avoid using .containerignore files so that all host files are always cached by Podman.

Answer

Install all debugging tools and heavy development SDKs in the final production stage.

Question 14

Which THREE features or characteristics distinguish the ADD instruction from the COPY instruction in a Containerfile? (Choose three.)

Accepted Answer

ADD can automatically extract local compressed tar archive files into the destination directory.. Option A is correct because ADD automatically unpacks recognized local compressed tar archives (e.g., .tar, .tar.gz, .tgz, .tar.bz2, .tar.xz) into the destination directory, whereas COPY just places the file as-is. Option D is correct because ADD can fetch files directly from remote HTTP/HTTPS URLs, a capability COPY does not have. Option E is correct because COPY is preferred for straightforward file copying since its behavior is explicit and predictable, avoiding ADD's implicit extraction and remote-fetch side effects. Option B is wrong because neither ADD nor COPY requires the source to be in a git repository. Option C is wrong because COPY does not support remote URLs natively; only ADD does.

Answer

ADD requires the source file to be located within a git repository, unlike COPY.

Answer

COPY supports remote URLs natively just like ADD.

Question 15

Which THREE directives or practices are associated with implementing secure container builds and adhering to least-privilege principles? (Choose three.)

Accepted Answer

Using minimal, trusted base images to reduce the total software footprint and vulnerability surface.. Option B is correct because starting from minimal, trusted base images (e.g., distroless, alpine, or scratch) shrinks the installed package set and attack surface, reducing the number of exploitable CVEs in the final image. Option C is correct because a USER instruction that switches to a non-root UID/username before CMD or ENTRYPOINT enforces least privilege at runtime, preventing container processes from having root capabilities if the container is compromised. Option E is correct because BuildKit's --secret mounts (e.g., RUN --mount=type=secret) inject credentials only during the build step without persisting them in any image layer, unlike ENV or COPY which bake secrets permanently into the image history. Option A is wrong because hardcoding database passwords in ENV instructions stores credentials in plaintext in image metadata and layers, violating least privilege and secret-management best practices. Option D is wrong because running RUN instructions with --privileged grants the build container full host capabilities, which is the opposite of least privilege and dramatically increases the risk of container escape during builds.

Answer

Hardcoding database passwords directly into ENV instructions so the application can read them easily.

Answer

Running all RUN instructions with '--privileged' inside the Containerfile.