EX188 Container Operations And Lifecycle — Timed 40 Questions

Question 1

A container named api_gw is configured with a health check. An administrator needs to check the current health status (e.g., healthy, unhealthy, starting) using the command line without reading the full inspect JSON. Which command string achieves this?

40 minute time limit — choose an answer to begin.

Accepted Answer

podman inspect --format='{{json .State.Health.Status}}' api_gw. podman inspect with a Go-template --format flag extracts just the .State.Health.Status field from the container's JSON metadata, returning a single word like healthy, unhealthy, or starting. This is the canonical way to query health status without parsing the full inspect output, and it works identically for podman and docker.

Answer

podman health status api_gw

Answer

podman ps --filter health=unhealthy

Answer

podman status api_gw

Question 2

An administrator wants to generate a systemd unit file for an existing container named web_frontend so it can be managed by systemd. Which command should be run?

Accepted Answer

podman generate systemd --new --name web_frontend. The correct command is `podman generate systemd --new --name web_frontend`, which generates a systemd unit file for the named container. The `--new` flag tells Podman to create a unit that creates a new container each time the service starts, rather than managing an existing container instance.

Answer

systemctl enable --container web_frontend

Answer

podman export systemd web_frontend

Answer

podman systemd generate --name web_frontend

Question 3

An administrator wants to find out which host port is mapped to port 80/tcp inside a running container named proxy_svr, using format templating with podman inspect. Which command accomplishes this?

Accepted Answer

podman inspect --format='{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' proxy_svr. The correct command uses podman inspect with Go template syntax to iterate over the .NetworkSettings.Ports map, extracting each container port and its corresponding host port. The range loop iterates over the map, and for each port binding, it accesses the first element of the slice (index 0) to get the HostPort. This precisely retrieves the host port mapped to container port 80/tcp.

Answer

podman ports proxy_svr

Answer

podman inspect --ports proxy_svr

Answer

podman ps --filter port=80

Question 4

An administrator wants to run a container with a custom health check command that disables health checking entirely for a container that inherited one from its base image. Which flag achieves this?

Accepted Answer

--health-cmd=none. Setting `--health-cmd=none` explicitly overrides any HEALTHCHECK inherited from the base image and disables health checking for the container. Podman interprets the literal string `none` as a directive to turn off the health check rather than to execute a command named 'none'.

Answer

--health-enabled=false

Answer

--disable-health

Answer

--no-healthcheck

Question 5

An administrator wants to forcefully kill a running container named runaway_job immediately by sending the SIGKILL signal. Which command should be used?

Accepted Answer

podman kill runaway_job. The `podman kill` command sends a signal to the main process of a container. By default, it sends SIGKILL, which forcefully terminates the container immediately. This is the correct command to forcefully kill a running container.

Answer

podman terminate runaway_job

Answer

podman halt runaway_job

Answer

podman stop --force runaway_job

Question 6

An administrator needs to manage container lifecycles in Podman. Which TWO of the following commands can be used to start an existing, stopped container? (Choose TWO)

Accepted Answer

podman start. Option C, podman start, is correct because it starts one or more existing, stopped containers by name or ID, resuming them from their stopped state without creating a new container. Option E, podman restart, is correct because it stops and then starts the specified container(s); when applied to an already stopped container, it effectively starts it, so it can be used to bring an existing stopped container back up. Option A, podman exec, is wrong because it runs a new command inside an already running container and fails on a stopped one. Option B, podman run, is wrong because it creates and starts a new container from an image rather than starting an existing stopped container. Option D, podman up, is wrong because it is not a valid Podman command (it belongs to Docker Compose-style tooling).

Answer

podman exec

Answer

podman run

Answer

podman up

Question 7

An administrator wants to examine the internal state, environment variables, or port mappings of a running container. Which TWO commands or techniques are appropriate? (Choose TWO)

Accepted Answer

podman port. Option A, `podman port`, is correct because it specifically queries and displays the port mappings of a running container, showing the mapping between container ports and host ports, which directly addresses the port-mapping part of the scenario. Option C, `podman inspect`, is correct because it returns detailed JSON metadata about a container, including its internal state (such as running status and configuration), environment variables, and port mappings, making it the most comprehensive tool for examining a container's internal details. The unmarked options do not belong: `podman list-ports` (B) is not a valid podman subcommand, `podman env` (D) is not a podman command for inspecting a container's environment, and `podman show-env` (E) is likewise not a real podman subcommand for this purpose.

Answer

podman list-ports

Answer

podman env

Answer

podman show-env

Question 8

An administrator needs to stop and remove a running container in a single workflow. Which TWO of the following approaches accomplish this? (Choose TWO)

Accepted Answer

podman rm -f container_name. podman rm -f forces removal of running containers (stopping them first), and stopping a container before running podman rm is also valid.

Answer

podman kill --remove container_name

Answer

podman delete --force container_name

Answer

podman stop --rm container_name

Question 9

An administrator is managing rootless containers and needs to understand how user namespaces and security isolation function. Which TWO of the following configuration files or tools are directly relevant to rootless user mapping and systemd user persistence? (Choose TWO)

Accepted Answer

/etc/subuid and /etc/subgid. Option D is correct because /etc/subuid and /etc/subgid are the canonical files that define the subordinate UID and GID ranges assigned to each user, which rootless container tools such as Podman and Buildah use to map container root to an unprivileged host UID/GID via user namespaces. Option E is correct because loginctl enable-linger <user> keeps the user's systemd instance (and thus the user manager and any rootless containers started as user services) running after logout, which is essential for persistent rootless container services. Option A is not a real systemctl command or unit target, so it has no role in user mapping or persistence. Option B is incorrect because the actual rootless configuration file is /etc/containers/containers.conf (and storage.conf), not /etc/containers/rootless.conf. Option C is incorrect because subuid/subgid mappings are not stored in /var/lib/podman/subuid.conf; that path is not the standard location for user namespace mapping data.

Answer

systemctl system-wide-users

Answer

/etc/containers/rootless.conf

Answer

/var/lib/podman/subuid.conf

Question 10

An administrator wants to generate a systemd unit file for an existing Podman container named 'app_server' so that it can be managed as a system service. Which command should be used to generate this unit file and write it directly to the user systemd directory?

Accepted Answer

podman generate systemd --new --files --name app_server. The podman generate systemd command creates a systemd unit file for a container. The --new flag generates a unit that creates a new container each time it starts (rather than managing an existing one), --files writes the unit file to disk, and --name app_server specifies the container. This is the correct syntax to generate a unit file for the named container.

Answer

podman export systemd app_server > /etc/systemd/system/app_server.service

Answer

podman service generate --container app_server --output ~/.config/systemd/user/

Answer

podman systemd create --name app_server > ~/.config/systemd/user/container-app_server.service

Question 11

A container named 'app_prod' is currently running, and an operator needs to troubleshoot its current configuration, network settings, and mounted volumes in detail. Which THREE commands or approaches can retrieve this information? (Choose THREE)

Accepted Answer

Run 'podman inspect app_prod' to output comprehensive JSON-formatted metadata regarding configuration, mounts, and network settings.. Option A is correct because 'podman inspect app_prod' returns comprehensive JSON metadata about the running container, including its configuration, network settings, and mounted volumes, which directly addresses the troubleshooting need. Option C is correct because 'podman top app_prod' shows the processes currently running inside the container, giving visibility into its runtime state and helping diagnose what the container is executing. Option D is correct because 'podman port app_prod' displays the active port mappings between host and container, which is essential for verifying network reachability and published ports. Option B is not a valid Podman subcommand for this purpose, as 'podman config' does not print environment variables or limits for a container. Option E is not appropriate here because 'podman diff' only lists filesystem changes in the container's writable layer and does not report configuration, network settings, or mounted volumes.

Answer

Run 'podman config app_prod' to print a summary of environment variables and limits.

Answer

Run 'podman diff app_prod' to view changes to the container's file system, which is primarily used for tracking modifications rather than initial configuration.

Question 12

An administrator maintains a rootless Podman container named web_proxy that must restart automatically after a host reboot, even when the administrator is not logged in. The container was created without any systemd integration. Which sequence of commands should the administrator run to generate and enable a systemd user unit for this container?

Accepted Answer

podman generate systemd --new --name web_proxy > ~/.config/systemd/user/container-web_proxy.service, then systemctl --user daemon-reload and systemctl --user enable --now container-web_proxy.service. To generate a systemd user unit for a rootless container, podman generate systemd --new creates a unit that recreates the container on each start. The unit must be placed in ~/.config/systemd/user/, and systemctl --user daemon-reload and systemctl --user enable --now must be used to activate it. Enabling ensures the service starts at boot, and --now starts it immediately. Additionally, enabling linger for the user is required for the service to run without an active login session.

Answer

podman generate systemd --new --name web_proxy > /etc/systemd/system/container-web_proxy.service, then systemctl daemon-reload and systemctl enable --now container-web_proxy.service

Answer

podman generate systemd --new --name web_proxy > ~/.config/systemd/user/container-web_proxy.service, then systemctl --user daemon-reload and systemctl --user start container-web_proxy.service

Answer

podman generate systemd --new --name web_proxy > ~/.config/systemd/user/container-web_proxy.service, then systemctl daemon-reload and systemctl enable --now container-web_proxy.service

Question 13

An administrator is troubleshooting a rootless Podman container named app_srv that fails to start with a permission denied error when trying to bind to port 80. The administrator wants to allow the container to bind to privileged ports without running as root. Which TWO actions should the administrator take to resolve this issue? (Choose two.)

Accepted Answer

Add the CAP_NET_BIND_SERVICE capability to the container using podman run --cap-add net_bind_service.. To allow a rootless container to bind to privileged ports, the administrator can either lower the net.ipv4.ip_unprivileged_port_start sysctl on the host so unprivileged users can bind to port 80, or add the CAP_NET_BIND_SERVICE capability to the container. Both methods grant the necessary permission without running the container as root. Using --privileged or changing the container user to root does not work in rootless mode due to user namespace mapping, and port mapping does not address the internal binding restriction.

Answer

Run the container with the --privileged flag to grant all capabilities.

Answer

Set the container's user to root by adding --user root to the podman run command.

Answer

Configure the container to use a port mapping from a high port on the host to port 80 in the container, such as -p 8080:80.

Question 14

An administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?

Accepted Answer

podman events. The podman events command streams real-time container lifecycle events from the Podman system, including create, start, stop, die, and remove actions across all containers. It is the direct analog of docker events and is the correct tool for monitoring system-wide container activity.

Answer

podman monitor --stream

Answer

podman logs --follow --events

Answer

podman system trace

Question 15

An administrator needs to start a container named webapp from the image docker.io/library/httpd in the background. Which podman command should be used?

Accepted Answer

podman run -d --name webapp docker.io/library/httpd. The correct command is 'podman run -d --name webapp docker.io/library/httpd'. The 'run' subcommand creates and starts a container in one step, '-d' detaches it to run in the background, and '--name' assigns the container name. The image reference follows the options.

Answer

podman up -d --name webapp docker.io/library/httpd

Answer

podman container create -d --name webapp docker.io/library/httpd

Answer

podman start -d docker.io/library/httpd --name webapp

Question 16

A container named db_cache has stopped unexpectedly. An administrator wants to see the standard output logs generated by this container prior to its exit. Which command should be used?

Accepted Answer

podman logs db_cache. The `podman logs` command retrieves the standard output (stdout) and standard error (stderr) logs from a container, whether it is running or has stopped. Since the container `db_cache` has exited, `podman logs db_cache` will display the logs generated prior to its exit. This is the standard and correct way to access container logs in Podman.

Answer

podman inspect --logs db_cache

Answer

podman output db_cache

Answer

podman history db_cache

Question 17

An administrator needs to inspect low-level configuration, network settings, and state details of a running container named redis_cache in JSON format. Which command provides this?

Accepted Answer

podman inspect redis_cache. `podman inspect` is the canonical command for retrieving low-level metadata about a container, image, volume, or network. It outputs a comprehensive JSON document containing configuration, state, network settings, mounts, environment variables, and more. Since the question explicitly asks for JSON-format low-level details, `podman inspect redis_cache` is the correct choice.

Answer

podman show redis_cache

Answer

podman details redis_cache

Answer

podman query --json redis_cache

Question 18

A container named app_server is running and consuming excessive CPU. An administrator needs to gracefully stop this container with a 30-second timeout before forcing termination. Which command accomplishes this?

Accepted Answer

podman stop --time 30 app_server. `podman stop --time 30 app_server` is correct because `--time` (or `-t`) sets the number of seconds Podman waits after sending SIGTERM before escalating to SIGKILL. This is exactly the graceful-stop-with-30-second-timeout behavior required. The container's main process gets SIGTERM, and only if it does not exit within 30 seconds does Podman force-kill it.

Answer

podman kill --signal SIGTERM --timeout 30 app_server

Answer

podman halt -s 30 app_server

Answer

podman terminate --grace-period=30 app_server

Question 19

An administrator has created a systemd service file named container-web.service using podman generate systemd. Where should this file be placed for a rootless user to manage it as a user-level service?

Accepted Answer

~/.config/systemd/user/. For rootless Podman containers, systemd user services must reside in the user's systemd configuration directory, which is ~/.config/systemd/user/. This allows the user to manage the service with systemctl --user commands without requiring root privileges. Placing the unit file here ensures it is loaded when the user's systemd instance starts, typically at login.

Answer

~/.local/share/podman/systemd/

Answer

/etc/systemd/system/

Answer

/var/lib/containers/systemd/

Question 20

An administrator is troubleshooting a container that fails its health check repeatedly. The container definition needs a health check that runs curl -f http://localhost/ || exit 1 every 30s, with a 5s timeout and 3 retries, starting after a 10s grace period. Which flag combination implements this correctly in podman run?

Accepted Answer

podman run --health-cmd="curl -f http://localhost/ || exit 1" --health-interval=30s --health-timeout=5s --health-retries=3 --health-start-period=10s webapp. The correct flag combination uses Podman's health check flags: --health-cmd for the command, --health-interval for the period, --health-timeout for the timeout, --health-retries for retry count, and --health-start-period for the initial grace period. Option C matches all required parameters exactly, including the '|| exit 1' failure semantics. Podman's health check system mirrors Docker's HEALTHCHECK instruction and uses these specific flag names.

Answer

podman run --healthcheck="curl -f http://localhost/" --interval=30 --timeout=5 --retries=3 webapp

Answer

podman run --health-probe="curl -f http://localhost/" --health-delay=10s webapp

Answer

podman run --check-command="curl -f http://localhost/" --check-period=30s webapp