EX188 Hard Questions — 25 Difficult Questions

Question 1

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Into the local GnuPG keyring using 'gpg --import'. For the dir:// transport, Podman verifies signatures using keys in the local GnuPG keyring, so the public key must be imported with 'gpg --import' into the user's keyring (or root's, depending on context). The signedBy field in policy.json references a key fingerprint that Podman looks up in that keyring during verification.

Answer

Into ~/.config/containers/policy.d/keys/

Answer

Into /etc/containers/certs.d/keys/

Answer

Into /var/lib/containers/sigstore/

Question 2

An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?

Accepted Answer

podman image sign --sign-by <key_id> registry.example.com/app:latest. The podman image sign command generates a GPG signature for an image in local storage, using --sign-by to specify the key ID. This is the correct command for signing images before pushing them to a registry, and it operates on the local image reference. The signature is stored locally and can be uploaded alongside the image.

Answer

podman push --sign-by <key_id> app:latest

Answer

podman gpg --sign app:latest

Answer

podman sign --key <key_id> app:latest

Question 3

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

Accepted Answer

Use ENTRYPOINT for the binary and CMD for the default arguments.. Using ENTRYPOINT for the binary and CMD for the default arguments is the best practice. When a user runs 'podman run ', the arguments passed on the command line override the CMD instruction, while the ENTRYPOINT remains the executable. This allows the user to easily override default arguments without changing the binary.

Answer

Use ENV for the binary and WORKDIR for the arguments.

Answer

Use RUN for both the binary and the arguments.

Answer

Use CMD for the binary and ENTRYPOINT for the default arguments.

Question 4

A rootless Podman container needs to access a host directory. Due to user namespace mapping, file ownership appears different inside the container. Which flag can be added to the mount to adjust UID/GID mapping behavior if supported?

Accepted Answer

podman run -v /host/path:/container/path:U. Volume mount options can include specific flags, and Podman handles rootless UID/GID mapping automatically, but misconfigurations can be troubleshot using mount options. Wait, let's look at standard options like 'U' for chown.

Answer

podman run -v /host/path:/container/path:ns

Answer

podman run -v /host/path:/container/path:uid=root

Answer

podman run -v /host/path:/container/path:map

Question 5

An engineer needs to inspect the content and metadata of an existing Podman secret named 'my_secret' without outputting the raw secret value in plain text if masked, or viewing its metadata. Which command inspects the secret?

Accepted Answer

podman secret inspect my_secret. podman secret inspect displays the metadata of a secret — its ID, name, driver, creation time, and labels — without revealing the secret's value. This is exactly what the question asks for: inspecting metadata without exposing the plaintext secret. The other listed subcommands either do not exist or would reveal the secret value.

Answer

podman secret cat my_secret

Answer

podman secret show my_secret

Answer

podman secret view my_secret

Question 6

A developer writes a Podman Compose file and needs to generate corresponding Kubernetes YAML manifests to prepare for an OpenShift deployment. Which Podman Compose command performs this generation?

Accepted Answer

podman generate kube. Podman Compose supports the 'podman-compose generate' or generating output via Kubernetes integration tools, but specifically, podman play/generate or podman-compose options like converting to K8s can be managed. Wait, podman-compose doesn't natively have a direct 'generate' subcommand in all versions, but Podman itself provides 'podman generate kube'. Let's look at standard Podman K8s generation: 'podman generate kube' creates Kubernetes YAML from a pod or container.

Answer

podman kube create --compose

Answer

podman-compose to-kube

Answer

podman-compose export --kubernetes

Question 7

Which TWO files or backend network management utilities are heavily relied upon by Podman for container networking stack configuration on modern Linux distributions? (Choose two.)

Accepted Answer

aardvark-dns. Option E, netavark, is correct because it is the default OCI container network backend for Podman on modern Linux distributions, responsible for setting up container network interfaces, bridges, and firewall rules. Option A, aardvark-dns, is correct because it is the authoritative DNS server that Podman relies on to provide name resolution between containers on the same network, working alongside netavark. Together, netavark and aardvark-dns replaced the older CNI-based stack as Podman's default networking solution. Option B, libnetwork, is incorrect because it is Docker's networking library, not Podman's backend. Option C, docker-proxy, is incorrect because it is a Docker component for port forwarding, not used by Podman. Option D, iptables-nft, is incorrect because although Podman may interact with nftables through netavark, iptables-nft itself is not a Podman-specific networking utility relied upon for stack configuration.

Answer

libnetwork

Answer

docker-proxy

Answer

iptables-nft

Question 8

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". Podman's `/etc/containers/registries.conf` uses TOML, and a registry block is defined with `[[registry]]` (an array of tables). The `prefix` field specifies the registry hostname to match, and `location` specifies the mirror to use instead, so `[[registry]]` with `prefix` and `location` is the correct syntax.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 9

Which THREE parameters are valid key-value pairs when using the advanced '--mount' flag with bind or volume types? (Choose THREE)

Accepted Answer

source. When using '--mount', valid keys include type, source (or src), and destination (or target/dst).

Answer

format

Question 10

You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?

Accepted Answer

The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.. Docker/Podman layer caching invalidates a RUN layer when any preceding instruction's layer changes. If COPY requirements.txt comes after an instruction that produces non-deterministic output (e.g., a RUN that fetches latest packages or writes timestamps) or if build-context files have changed mtimes, the cache key for the COPY layer changes, invalidating all subsequent RUN layers including the dependency install.

Answer

The Containerfile lacks an explicit CACHE instruction at the top.

Answer

Podman disables caching by default for all RUN instructions containing package managers.

Answer

The USER instruction was set to root, which disables layer caching.

Question 11

You have created a Podman pod and want to launch two containers inside this pod so they share the same network namespace. How do you specify this during container creation?

Accepted Answer

podman run --pod mypod -d myimage. The --pod flag on podman run attaches a new container to an existing pod, and all containers in the same pod share the pod's network namespace (and by default its IPC and UTS namespaces). So podman run --pod mypod -d myimage launches the container inside the pod with shared networking. This is the standard way to add containers to a pod after the pod is created.

Answer

podman run --share-namespace mypod -d myimage

Answer

podman pod connect mypod myimage

Answer

podman run --network pod:mypod -d myimage

Question 12

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

Accepted Answer

/etc/containers/registries.conf using the unqualified-search-registries parameter. The /etc/containers/registries.conf file contains the unqualified-search-registries parameter, which lists registries to search when a user pulls an image without specifying a registry. Adding registry.access.redhat.com to this list allows podman pull rhel9 to automatically expand to registry.access.redhat.com/rhel9.

Answer

/etc/sysconfig/podman using the SEARCH_REGISTRIES variable

Answer

/etc/containers/registries.d/default.yaml using the search-domains parameter

Answer

~/.config/containers/auth.json using the default-registry key

Question 13

You need to completely remove a custom user-defined bridge network named 'test-net' that has no active containers attached to it. Which command performs this action?

Accepted Answer

podman network rm test-net. 'podman network rm test-net' removes the specified user-defined network. Since the network has no active containers attached, the removal succeeds immediately; if containers were attached, Podman would refuse unless forced. This is the direct, correct command for deleting a named network.

Answer

podman network prune --force

Answer

podman rm network test-net

Answer

podman network delete test-net

Question 14

When generating a Kubernetes Pod YAML from a Podman container using 'podman generate kubernetes', how are published ports mapped into the resulting Kubernetes manifest?

Accepted Answer

They are translated into container port definitions within the containers spec array.. When generating a Kubernetes Pod YAML from a Podman container, published ports are translated into containerPort entries within the containers spec array. This reflects the container's exposed ports in the Kubernetes manifest, allowing the Pod to declare which ports it listens on.

Answer

They are converted into host-level iptables rules embedded in annotations.

Answer

They are ignored entirely and must be added manually.

Answer

They cause the generation command to fail with a port conflict error.

Question 15

Which THREE configuration directives or files are associated with customizing container storage backends and root directory locations in Podman? (Choose three.)

Accepted Answer

The environment variables 'CONTAINERS_STORAGE_DRIVER' or 'STORAGE_DRIVER'.. Storage options are configured in /etc/containers/storage.conf, via environment variables like STORAGE_DRIVER, or via user home directory overrides.

Answer

The signature verification policy file '/etc/containers/policy.json'.

Answer

The registry authentication file '~/.config/containers/auth.json'.

Question 16

An administrator is configuring a systemd service using podman generate systemd and wants the generated service to stop and remove the container automatically when the service stops, and create a fresh container when it starts. Which flag should be added?

Accepted Answer

--new. The --new flag in podman generate systemd creates a systemd unit that removes the existing container when the service stops and creates a fresh container when it starts. This ensures a clean state on each service start, which is useful for stateless or ephemeral workloads.

Answer

--ephemeral

Answer

--recreate

Answer

--auto-remove

Question 17

An administrator needs to connect an already running container named 'web1' to an existing user-defined network named 'backend-net' without restarting the container. Which command accomplishes this?

Accepted Answer

podman network connect backend-net web1. The podman network connect command attaches a running container to an existing user-defined network without requiring a restart. Its syntax is 'podman network connect ', which matches option B. This is the supported way to add a live container to an additional network, and Podman updates the container's DNS and interfaces dynamically.

Answer

podman network attach backend-net web1

Answer

podman container modify --network backend-net web1

Answer

podman network join --container web1 backend-net

Question 18

An administrator wants to ensure that a bind-mounted directory allows propagation of mounts from the host into the container. Which mount option configures mount propagation mode?

Accepted Answer

podman run -v /host/dir:/container/dir:shared myapp. The :shared mount option on a bind mount configures mount propagation mode to shared, allowing mounts performed on the host to propagate into the container (and vice versa). The syntax is -v /host/dir:/container/dir:shared, where shared is the propagation mode keyword.

Answer

podman run -v /host/dir:/container/dir:mtype=shared myapp

Answer

podman run -v /host/dir:/container/dir:sync myapp

Answer

podman run -v /host/dir:/container/dir:propagate myapp

Question 19

An administrator wants to find out which host port is mapped to port 80/tcp inside a running container named proxy_svr, using format templating with podman inspect. Which command accomplishes this?

Accepted Answer

podman inspect --format='{{range $p, $conf := .NetworkSettings.Ports}} {{$p}} -> {{(index $conf 0).HostPort}} {{end}}' proxy_svr. The correct command uses podman inspect with Go template syntax to iterate over the .NetworkSettings.Ports map, extracting each container port and its corresponding host port. The range loop iterates over the map, and for each port binding, it accesses the first element of the slice (index 0) to get the HostPort. This precisely retrieves the host port mapped to container port 80/tcp.

Answer

podman ports proxy_svr

Answer

podman inspect --ports proxy_svr

Answer

podman ps --filter port=80

Question 20

An administrator is using Podman Quadlets to manage containers via systemd. Where must the Quadlet .container configuration file be placed for system-wide root containers?

Accepted Answer

/etc/containers/systemd/. For system-wide root containers managed by Quadlets, the .container file must be placed in /etc/containers/systemd/. This directory is monitored by the podman-system-generator, which converts Quadlet files into systemd unit files at boot or on daemon-reload.

Answer

/etc/systemd/system/containers/

Answer

/var/lib/containers/systemd/quadlets/

Answer

/etc/systemd/system/