EX200 Manage containers — 30 Questions

Question 1

A developer reports that a container running a custom web application is failing to start on a Red Hat Enterprise Linux 8 host. The container image is built from a Dockerfile that uses 'EXPOSE 8080'. The host firewall is enabled. Which action is most likely required to allow external access to the application?

Accepted Answer

Start the container with the '-p 8080:8080' option to publish the port.. The container image's EXPOSE 8080 instruction is metadata that documents the intended port but does not actually publish it. To make the container's port 8080 accessible from the host's network, you must use the '-p 8080:8080' option when starting the container with 'podman run' or 'docker run'. This creates a port mapping from the host's port 8080 to the container's port 8080, allowing external traffic to reach the application.

Answer

Open port 8080 in the host firewall using firewall-cmd.

Answer

Disable the host firewall to allow all incoming traffic.

Answer

Ensure the container image includes an EXPOSE instruction for port 8080.

Question 2

An administrator needs to ensure that a container always runs with a specific SELinux context for security reasons. The container uses a volume mount from the host. Which command should be used to start the container?

Accepted Answer

podman run --security-opt label=type:container_t -v /host/data:/data myimage. Option D is correct because `--security-opt label=type:container_t` explicitly sets the SELinux type for the container process to `container_t`, ensuring the container runs with the required SELinux context. This is the proper way to assign a specific SELinux type when using `podman run`, especially when volume mounts are involved, as it avoids permission conflicts with the host's SELinux policy.

Answer

podman run --label selinux_context=container_t -v /host/data:/data myimage

Answer

podman run --privileged -v /host/data:/data myimage

Answer

podman run --selinux-context container_t -v /host/data:/data myimage

Question 3

A system administrator wants to run a container that uses the rootless mode available in Podman. Which requirement must be met for rootless containers to work correctly?

Accepted Answer

The user must have entries in /etc/subuid and /etc/subgid for user namespace mapping.. Rootless Podman containers require user namespace mapping to assign subordinate UIDs and GIDs from the host to the container. Without entries in /etc/subuid and /etc/subgid for the user, Podman cannot allocate the necessary ID ranges, and the container will fail to run in rootless mode.

Answer

The container must be run with the '--privileged' flag.

Answer

The system must have cgroups v2 enabled.

Answer

The user must have root privileges to run the container.

Question 4

A container running a database service needs to persist data across restarts. The administrator decides to use a named volume. Which command creates a named volume and mounts it correctly?

Accepted Answer

podman volume create dbdata && podman run -v dbdata:/var/lib/mysql mydb. Option B is correct because it first creates a named volume with `podman volume create dbdata`, then mounts that named volume to the container's `/var/lib/mysql` directory using the `-v` flag. Named volumes are managed by Podman and persist data independently of the container lifecycle, ensuring data survives container restarts or removal.

Answer

podman run -v /var/lib/mysql:/var/lib/mysql mydb

Answer

podman run --mount type=bind,src=dbdata,dst=/var/lib/mysql mydb

Answer

podman run --mount type=tmpfs,dst=/var/lib/mysql mydb

Question 5

Which TWO statements are true regarding container images and containers in Podman?

Accepted Answer

A container is a running or stopped instance of an image with a writable layer.. Option B is correct because a container in Podman is an instantiation of an image that adds a writable layer on top of the image's read-only layers. This writable layer persists changes made during the container's runtime, even after the container is stopped, unless explicitly removed.

Answer

A container can only be created from an image that is stored locally.

Answer

When a container is stopped, its writable layer is automatically removed.

Answer

A container image must be built using a Dockerfile.

Question 6

Which THREE actions are required to enable a non-root user to run containers using Podman on Red Hat Enterprise Linux 8?

Accepted Answer

Ensure the user has a running systemd user instance (loginctl enable-linger).. Option A is correct because `loginctl enable-linger` ensures that the user's systemd user instance starts at boot and remains running after the user logs out. This is required for Podman to manage containers using systemd user services, such as auto-starting containers with `podman generate systemd`.

Answer

Add the user to the 'docker' group to access the Docker socket.

Answer

Grant the user sudo privileges to run podman commands.

Question 7

Refer to the exhibit. A user attempts to start a new container named 'web3' but receives an error. The user wants to reuse the name 'web3'. Which command should be run first to resolve the issue?

Accepted Answer

podman rm web3. The error occurs because a container named 'web3' already exists, even if it is not running. To reuse the name, the existing container must be removed first. Option B, `podman rm web3`, removes the stopped container, freeing the name for a new container.

Answer

podman rmi registry.access.redhat.com/ubi8/nginx-118

Answer

podman kill web2

Answer

podman stop web1

Question 8

An administrator is tasked with deploying a containerized application on a Red Hat Enterprise Linux 8 server that is part of a high-security environment. The application must run as a non-root user inside the container. The container image is based on Red Hat Universal Base Image (UBI) and exposes port 443 for HTTPS. The administrator needs to ensure that the container can be restarted automatically if it crashes and that the application logs are persisted on the host in /var/log/app. The application requires a configuration file that is generated dynamically at startup and must be accessible to the container. The administrator has created a systemd service file for the container but wants to use Podman's built-in features to manage the container. Which approach meets all requirements?

Accepted Answer

Create a systemd service file using 'podman generate systemd' on a running container, then enable the service with 'systemctl enable --now container-myapp'. The container should be started with '--restart=always' and appropriate volume and port mappings.. Option A is correct because 'podman generate systemd' creates a systemd service unit file that integrates Podman containers with systemd's process management, enabling automatic restart on crash via systemd's restart behavior (e.g., Restart=always) and boot-start with 'systemctl enable --now'. The volume mount (-v /var/log/app:/var/log) persists logs on the host, and the port mapping (-p 443:443) exposes HTTPS. This approach meets all requirements: non-root user (specified in the container image or via --user), dynamic config file (generated at startup and mounted or injected), and systemd-managed restart.

Answer

Create a 'podman service' unit using 'podman service create' to manage the container with automatic restart and boot-start.

Answer

Run the container with 'podman run --restart=always -v /var/log/app:/var/log -p 443:443 myapp' and rely on the container's restart policy.

Answer

Use 'podman create --restart=on-failure -v /var/log/app:/var/log -p 443:443 myapp' and then start it with 'podman start'.

Question 9

A system administrator needs to run a container that remains running in the background and executes a web server. Which podman command will correctly run the container detached and map host port 8080 to container port 80?

Accepted Answer

podman run -d -p 8080:80 nginx. Option A is correct because `podman run -d` runs the container in detached mode (background), and `-p 8080:80` maps host port 8080 to container port 80, which is the standard port for the nginx web server. This allows external traffic on host port 8080 to be forwarded to the nginx service inside the container.

Answer

podman run -d -p 80:8080 nginx

Answer

podman run -d --expose 80 nginx

Answer

podman run -d -P 8080:80 nginx

Question 10

A containerized application requires persistent storage and must be able to run with SELinux enforcing. The administrator runs a container with the volume mount: `podman run -v /host/data:/container/data:Z myimage`. Which TWO statements are true about this configuration?

Accepted Answer

The volume mount persists after the container is removed.. Option C is correct because the `-v` flag with a bind mount persists the data in `/host/data` on the host filesystem even after the container is removed. The `:Z` flag tells Podman to relabel the host directory with a container-specific SELinux context, which is why Option E is also correct. This ensures the container can write to the mount point even when SELinux is enforcing.

Answer

The SELinux context of files in /host/data remains unchanged.

Answer

The /host/data directory is created automatically if it does not exist.

Answer

The container cannot write to /container/data if SELinux is enforcing.

Question 11

A container named 'web1' was created and ran briefly before exiting with status 0. The administrator needs to restart it and attach to the running container's console. Which command should be used?

Accepted Answer

podman start web1 && podman attach web1. Option D is correct because `podman start web1` restarts the existing container that exited with status 0, and `podman attach web1` connects the current terminal to the container's main process console. The `&&` ensures the attach runs only after the container is successfully started, allowing the administrator to interact with the running container's console.

Answer

podman run --name web1 -it registry.access.redhat.com/ubi8/httpd-24

Answer

podman start web1

Answer

podman restart web1 && podman attach web1

Question 12

Put the steps to configure NFS server to export /nfsshare to a specific client in order.

Question 13

Match each log file to its typical content.

Question 14

A user wants to run a container that will restart automatically unless explicitly stopped by the administrator. Which podman run option should be used?

Accepted Answer

--restart=unless-stopped. The `--restart=unless-stopped` policy ensures the container restarts automatically whenever it exits, unless the administrator explicitly stops it with `podman stop`. This matches the requirement exactly: the container will keep restarting even after system reboots or crashes, but will not restart if the admin manually stops it. The other policies either do not restart on manual stop (`always`) or only restart on non-zero exit codes (`on-failure`).

Answer

--restart=on-failure

Answer

--restart=always

Answer

--restart=no

Question 15

An administrator needs to list all container images stored locally, including intermediate layers. Which command should be used?

Accepted Answer

podman images -a. Option D (`podman images -a`) is correct because the `-a` (or `--all`) flag instructs Podman to list all images in the local storage, including intermediate layers that are not tagged and are used as building blocks for other images. Without this flag, only top-level (tagged) images are shown, which would omit the intermediate layers the administrator needs to see.

Answer

podman images -q

Answer

podman images --all

Answer

podman images --no-trunc

Question 16

A container fails to start because the port it needs is already in use. Which command can the administrator use to identify the process using the port?

Accepted Answer

ss -tlnp. Option B is correct because the `ss -tlnp` command displays listening TCP sockets (`-t`), numeric addresses (`-n`), and the associated process information (`-p`). This allows the administrator to identify which process (PID and program name) is bound to a specific port, directly addressing the container startup failure caused by a port conflict.

Answer

podman logs <container>

Answer

podman port -l

Answer

firewall-cmd --list-ports

Question 17

A team wants to run a container as a non-root user inside the container for security. Which instruction should be included in the Containerfile?

Accepted Answer

USER. The USER instruction in a Containerfile (Dockerfile) sets the user name or UID to use when running the container and for any subsequent RUN, CMD, or ENTRYPOINT instructions. By default, containers run as root (UID 0), which poses a security risk. Using USER to switch to a non-root user (e.g., USER 1001) ensures the container process runs with reduced privileges, aligning with the principle of least privilege.

Answer

PODMAN_USER

Answer

ENV USER

Answer

RUN useradd

Question 18

An administrator needs to pass environment variables from the host to a container without exposing them in the command line. Which method should be used?

Accepted Answer

--env-file. Option B (--env-file) is correct because it allows environment variables to be passed to a container by reading them from a file, avoiding exposure in the command line or process list. This method is secure as the file can be restricted with file permissions, and the variables are not visible in commands like `ps aux` or shell history.

Answer

--env

Answer

--secret

Answer

-e

Question 19

A containerized web server needs to persist logs outside the container. Which podman run option allows the administrator to specify a bind mount with mount propagation options?

Accepted Answer

--mount. Option A is correct because the `--mount` flag in `podman run` provides the most granular control over bind mounts, including the ability to specify mount propagation options (e.g., `shared`, `slave`, `private`) via the `propagation` parameter. This is essential for persisting container logs to the host filesystem while controlling how mount events are propagated between the container and the host.

Answer

--volume

Answer

--bind

Answer

-v

Question 20

A database container crashes repeatedly. The administrator wants to see the last 10 lines of the container's logs before it exited. Which command should be used?

Accepted Answer

podman logs --tail 10 . The `podman logs --tail 10 ` command retrieves the last 10 lines of the container's log output, which is exactly what the administrator needs to see the final log entries before the container exited. The `--tail` flag specifies the number of lines from the end of the log, making it ideal for troubleshooting a crash without viewing the entire log history.

Answer

podman logs -f <container>

Answer

podman logs --since 10m <container>

Answer

podman inspect <container>