EX200 Manage containers — Timed 10 Questions

Question 1

A developer reports that a container running a custom web application is failing to start on a Red Hat Enterprise Linux 8 host. The container image is built from a Dockerfile that uses 'EXPOSE 8080'. The host firewall is enabled. Which action is most likely required to allow external access to the application?

Accepted Answer

Start the container with the '-p 8080:8080' option to publish the port.. The container image's EXPOSE 8080 instruction is metadata that documents the intended port but does not actually publish it. To make the container's port 8080 accessible from the host's network, you must use the '-p 8080:8080' option when starting the container with 'podman run' or 'docker run'. This creates a port mapping from the host's port 8080 to the container's port 8080, allowing external traffic to reach the application.

Answer

Open port 8080 in the host firewall using firewall-cmd.

Answer

Disable the host firewall to allow all incoming traffic.

Answer

Ensure the container image includes an EXPOSE instruction for port 8080.

Question 2

An administrator needs to ensure that a container always runs with a specific SELinux context for security reasons. The container uses a volume mount from the host. Which command should be used to start the container?

Accepted Answer

podman run --security-opt label=type:container_t -v /host/data:/data myimage. Option D is correct because `--security-opt label=type:container_t` explicitly sets the SELinux type for the container process to `container_t`, ensuring the container runs with the required SELinux context. This is the proper way to assign a specific SELinux type when using `podman run`, especially when volume mounts are involved, as it avoids permission conflicts with the host's SELinux policy.

Answer

podman run --label selinux_context=container_t -v /host/data:/data myimage

Answer

podman run --privileged -v /host/data:/data myimage

Answer

podman run --selinux-context container_t -v /host/data:/data myimage

Question 3

A system administrator wants to run a container that uses the rootless mode available in Podman. Which requirement must be met for rootless containers to work correctly?

Accepted Answer

The user must have entries in /etc/subuid and /etc/subgid for user namespace mapping.. Rootless Podman containers require user namespace mapping to assign subordinate UIDs and GIDs from the host to the container. Without entries in /etc/subuid and /etc/subgid for the user, Podman cannot allocate the necessary ID ranges, and the container will fail to run in rootless mode.

Answer

The container must be run with the '--privileged' flag.

Answer

The system must have cgroups v2 enabled.

Answer

The user must have root privileges to run the container.

Question 4

A container running a database service needs to persist data across restarts. The administrator decides to use a named volume. Which command creates a named volume and mounts it correctly?

Accepted Answer

podman volume create dbdata && podman run -v dbdata:/var/lib/mysql mydb. Option B is correct because it first creates a named volume with `podman volume create dbdata`, then mounts that named volume to the container's `/var/lib/mysql` directory using the `-v` flag. Named volumes are managed by Podman and persist data independently of the container lifecycle, ensuring data survives container restarts or removal.

Answer

podman run -v /var/lib/mysql:/var/lib/mysql mydb

Answer

podman run --mount type=bind,src=dbdata,dst=/var/lib/mysql mydb

Answer

podman run --mount type=tmpfs,dst=/var/lib/mysql mydb

Question 5

Which TWO statements are true regarding container images and containers in Podman?

Accepted Answer

A container is a running or stopped instance of an image with a writable layer.. Option B is correct because a container in Podman is an instantiation of an image that adds a writable layer on top of the image's read-only layers. This writable layer persists changes made during the container's runtime, even after the container is stopped, unless explicitly removed.

Answer

A container can only be created from an image that is stored locally.

Answer

When a container is stopped, its writable layer is automatically removed.

Answer

A container image must be built using a Dockerfile.

Question 6

Which THREE actions are required to enable a non-root user to run containers using Podman on Red Hat Enterprise Linux 8?

Accepted Answer

Ensure the user has a running systemd user instance (loginctl enable-linger).. Option A is correct because `loginctl enable-linger` ensures that the user's systemd user instance starts at boot and remains running after the user logs out. This is required for Podman to manage containers using systemd user services, such as auto-starting containers with `podman generate systemd`.

Answer

Add the user to the 'docker' group to access the Docker socket.

Answer

Grant the user sudo privileges to run podman commands.

Question 7

Refer to the exhibit. A user attempts to start a new container named 'web3' but receives an error. The user wants to reuse the name 'web3'. Which command should be run first to resolve the issue?

Accepted Answer

podman rm web3. The error occurs because a container named 'web3' already exists, even if it is not running. To reuse the name, the existing container must be removed first. Option B, `podman rm web3`, removes the stopped container, freeing the name for a new container.

Answer

podman rmi registry.access.redhat.com/ubi8/nginx-118

Answer

podman kill web2

Answer

podman stop web1

Question 8

An administrator is tasked with deploying a containerized application on a Red Hat Enterprise Linux 8 server that is part of a high-security environment. The application must run as a non-root user inside the container. The container image is based on Red Hat Universal Base Image (UBI) and exposes port 443 for HTTPS. The administrator needs to ensure that the container can be restarted automatically if it crashes and that the application logs are persisted on the host in /var/log/app. The application requires a configuration file that is generated dynamically at startup and must be accessible to the container. The administrator has created a systemd service file for the container but wants to use Podman's built-in features to manage the container. Which approach meets all requirements?

Accepted Answer

Create a systemd service file using 'podman generate systemd' on a running container, then enable the service with 'systemctl enable --now container-myapp'. The container should be started with '--restart=always' and appropriate volume and port mappings.. Option A is correct because 'podman generate systemd' creates a systemd service unit file that integrates Podman containers with systemd's process management, enabling automatic restart on crash via systemd's restart behavior (e.g., Restart=always) and boot-start with 'systemctl enable --now'. The volume mount (-v /var/log/app:/var/log) persists logs on the host, and the port mapping (-p 443:443) exposes HTTPS. This approach meets all requirements: non-root user (specified in the container image or via --user), dynamic config file (generated at startup and mounted or injected), and systemd-managed restart.

Answer

Create a 'podman service' unit using 'podman service create' to manage the container with automatic restart and boot-start.

Answer

Run the container with 'podman run --restart=always -v /var/log/app:/var/log -p 443:443 myapp' and rely on the container's restart policy.

Answer

Use 'podman create --restart=on-failure -v /var/log/app:/var/log -p 443:443 myapp' and then start it with 'podman start'.

Question 9

A system administrator needs to run a container that remains running in the background and executes a web server. Which podman command will correctly run the container detached and map host port 8080 to container port 80?

Accepted Answer

podman run -d -p 8080:80 nginx. Option A is correct because `podman run -d` runs the container in detached mode (background), and `-p 8080:80` maps host port 8080 to container port 80, which is the standard port for the nginx web server. This allows external traffic on host port 8080 to be forwarded to the nginx service inside the container.

Answer

podman run -d -p 80:8080 nginx

Answer

podman run -d --expose 80 nginx

Answer

podman run -d -P 8080:80 nginx

Question 10

A containerized application requires persistent storage and must be able to run with SELinux enforcing. The administrator runs a container with the volume mount: `podman run -v /host/data:/container/data:Z myimage`. Which TWO statements are true about this configuration?

Accepted Answer

The volume mount persists after the container is removed.. Option C is correct because the `-v` flag with a bind mount persists the data in `/host/data` on the host filesystem even after the container is removed. The `:Z` flag tells Podman to relabel the host directory with a container-specific SELinux context, which is why Option E is also correct. This ensures the container can write to the mount point even when SELinux is enforcing.

Answer

The SELinux context of files in /host/data remains unchanged.

Answer

The /host/data directory is created automatically if it does not exist.

Answer

The container cannot write to /container/data if SELinux is enforcing.