CCNA Lxp Scripting Containers Questions

kubectl logs retrieves stdout and stderr written by the pod's main container, satisfying the requirement to view standard output. Other verbs such as describe or exec do not stream container logs, so they fail the stated constraint.

The -u flag selects the user whose crontab is being edited, so this command always opens root's personal crontab regardless of which account is currently logged in. Entries placed there are executed as root, and the schedule field can specify 30 2 * * 1,3,5 to meet the Monday, Wednesday, and Friday requirement.

`jq` is a lightweight and flexible command-line JSON processor. The `-r` option outputs raw strings without quotes. The filter `.version` extracts the value of the top-level 'version' key. This is the correct and reliable way to parse JSON and retrieve a specific field's value, handling formatting and escaping properly.

The -e unary test operator returns true when the pathname resolves to an existing file or directory, regardless of type. It satisfies the existence half of the stem's requirement, letting the script confirm the file is present before attempting any read operation.

The notify directive names the handler to trigger when a task reports changed state, so a config-file modification notifies the restart handler. Handlers run once at play end, avoiding repeated service restarts during the play.

Cron captures any output and mails it, but if mail is unconfigured the output is discarded, so failures go unnoticed. Redirecting stdout and stderr to a file captures cron's environment-specific errors, such as missing PATH entries or permissions, enabling diagnosis. This directly resolves the lack of visibility that makes the cron run appear to fail silently.

Publishing with `-p 80:8080` maps host port 80 to container port 8080, satisfying the requirement to reach the internal web server on the host's privileged HTTP port. Docker's port syntax is host:container, so the left value is the externally exposed port and the right is the container's listening port.

The `-v /data:/mnt/data` flag creates a bind mount by mapping an absolute host path to a container path, satisfying the requirement to share `/data` at `/mnt/data`. Docker interprets the leading slash as a host filesystem location rather than a named volume, giving the container direct read-write access to that directory.

The -d flag detaches the container, --rm deletes it automatically once stopped, and -p 8080:80 publishes host port 8080 to container port 80. All three stem constraints are satisfied in a single command, with the image name supplied last as the positional argument.

`set -e` makes bash exit immediately when any command returns a non-zero status, satisfying the requirement that the script halt on first failure. Unlike `set -u` (unset variables) or `set -x` (trace output), it targets command failure directly, preventing subsequent commands from running after an error.

A static binary needs no shared libraries, so it can run on a base image that contains no shell, package manager, or libc. This shrinks the attack surface and image size while making the runtime contents deterministic, which directly matches the requirement to exclude a shell and package manager from the shipped image.

Enabling a timer creates the symlink needed for it to be started at boot by systemd, allowing its schedule to fire reliably. Starting a timer only activates it for the current session; enabling ensures persistence across reboots, which is required for a recurring daily maintenance task in this scenario.

Rootless mode is Podman's defining architectural difference: it uses user namespaces to map the container's root to an unprivileged host UID, so no daemon runs as root. Docker's daemon typically requires root, making this the key security distinction the question targets.

The service module manages systemd, sysvinit and similar service managers on the remote host, letting the playbook assert that a named service is started and enabled. It is the purpose-built module for service state, unlike command or shell, which would run arbitrary commands without idempotent state guarantees.

docker build reads the Dockerfile from the specified context, and the dot sets the current directory as that context. The -t flag assigns the repository and tag myapp:v1, satisfying both the build-from-current-directory and tagging requirements in one command.

The `copy` module places the file with the specified content and reports a changed status only when the content differs. The `notify` directive then triggers the named handler, which uses the `service` module to restart the web service. This ensures the restart occurs only on change, matching the requirement exactly.

Glob expansion by the shell resolves `*.txt` into a list of matching filenames before the loop runs, so each iteration assigns one filename to `file`. This satisfies the requirement to iterate over every .txt file in the current directory, provided matches exist.

jq is a lightweight command-line JSON processor that is widely available in distribution repositories and is often preinstalled on modern systems. It can parse JSON, filter with expressions such as .key, and output the value, which directly satisfies the requirement to extract a specific key from a structured JSON file.

The set -e option sets errexit, so Bash terminates the script immediately when any command returns a non-zero exit status. This satisfies the requirement to halt execution on failure rather than continuing through subsequent commands.

Single quotes treat every character literally, so a variable such as $HOME is passed unchanged, whereas double quotes permit parameter and variable expansion, command substitution and escape sequences. This quoting distinction determines whether the shell interprets the enclosed text before passing it to the command.

`kubectl logs <pod-name>` retrieves stdout/stderr from the Pod's containers, exposing application-level failures such as crash loops, misconfiguration or missing dependencies that block startup. When a Pod is running but not Ready, or restarting repeatedly, container output pinpoints the fault directly, satisfying the need to diagnose why the Pod fails to start.

getopts is a POSIX shell builtin that parses short options consistently across shells and distributions. It sets OPTARG for options that take a value and OPTIND for the next argument, so the script can detect missing required arguments and print usage before doing any work. This meets the portability and validation goals in the scenario.

set -e makes Bash exit immediately when any command returns a non-zero status, so the script halts on the first failure. Placed at the top, it satisfies the requirement to stop immediately rather than continue executing subsequent commands.

`kubectl expose deployment web-app --port=80 --target-port=8080` generates a ClusterIP service, the default type, satisfying the internal-only requirement. The `--port` flag sets the service port to 80, while `--target-port=8080` directs traffic to the container's listening port, correctly mapping the mismatch between service and pod ports.

docker exec runs a new process inside an already running container; -it allocates an interactive TTY and keeps stdin open, and bash specifies the shell. This satisfies the requirement without restarting or attaching to the main process.

`kubectl get endpoints` lists each Service's backing pod IPs and ports, directly confirming whether the ClusterIP Service's selector actually matched the running pod. Since the stem's constraint is a ClusterIP Service with no external exposure, endpoint association is the failure point to verify, and this command exposes an empty or mismatched endpoint list immediately.

The set -e option instructs bash to terminate the script immediately when any command returns a non-zero exit status. Placing it at the top satisfies the requirement that the script halts on first failure rather than continuing with subsequent commands.

`set -e` causes the shell to exit immediately when a command returns a non-zero status, satisfying the requirement to abort on failed commands. Because `-u` is not included, referencing an unset variable does not terminate the script, so the script continues running. This combination precisely matches the administrator's stated requirements.

This opens the hostname file on file descriptor 3 and reads from it with read <&3, leaving file descriptor 0 untouched. Interactive commands inside probe can therefore still read from the keyboard, and IFS= with -r preserves leading whitespace and backslashes. It is the standard technique for keeping stdin available while looping over a file.

`set -x` enables the shell's trace mode, printing each command to stderr after expansion but before execution, prefixed with `+`. This satisfies the stem's requirement to display every command as it runs, letting the engineer follow the script's actual execution path and pinpoint where file processing fails.

set -e makes the shell terminate immediately when any command returns a non-zero exit status, satisfying the requirement to stop on failure. Without it, Bash continues executing subsequent commands by default, masking the error and allowing the script to run on with corrupted state.

The yq utility parses YAML natively and its -o=json output flag re-serializes the whole document as JSON, keeping nested maps and lists intact. The identity filter '.' selects the entire document, so this single command produces valid JSON that the API can consume without any intermediate text manipulation.

The trap builtin with the EXIT pseudo-signal runs the specified command when the shell exits, regardless of whether the exit is normal or caused by a signal such as SIGINT. This matches the requirement to run cleanup unconditionally at script termination, and the single quotes defer expansion of cleanup until the trap fires.

Correct. -r returns true if the file exists and has read permission.

Functions are invoked by name; parentheses are used only in definition.

Correct. Includes required apiVersion, selector, and template with labels.

The replicas field sits under the Deployment's spec, declaring the desired pod count that the ReplicaSet controller continuously reconciles. Setting spec.replicas to the required number satisfies the stem's demand for specifying how many identical pods run concurrently.

The shebang's first line tells the kernel which interpreter binary executes the file, so `#!/bin/bash` names the absolute path to Bash. This satisfies the stem's requirement by ensuring the script runs under Bash rather than the invoking shell, regardless of the user's default login shell.

The -d flag detaches the container, -p 8080:80 maps host port 8080 to container port 80, and -v /data:/app/data bind-mounts the host directory. Together these satisfy every stated constraint in a single command, using the nginx image.

The -f unary test operator returns true when the path exists and is a regular file, excluding directories and other special types. Used inside [ ], it satisfies the requirement to verify that /etc/passwd exists as a regular file.

Setting IFS= for the read command disables trimming of leading and trailing whitespace, and the -r flag prevents backslashes from being interpreted as escapes. read consumes one line at a time and strips the terminating newline, so filenames with embedded spaces stay intact and are passed quoted to process. This is the canonical safe line-reading loop.

The positional parameter $1 holds the first argument passed to the script. Wrapping it in double quotes preserves empty or whitespace-containing values, and the -z test returns true when the string length is zero, which correctly detects a missing argument and allows the script to print an error and exit.

Podman runs containers directly as child processes without a long-running daemon, which suits rootless operation because no privileged background service is needed. Docker relies on the dockerd daemon, typically requiring root or elevated privileges for container management.

A systemd timer paired with a service unit is the native scheduling mechanism on systemd-based distributions. The OnCalendar directive accepts calendar expressions such as Mon 03:15:00, and enabling the timer with systemctl enable --now ensures it starts immediately and persists across reboots without requiring an interactive login session.

The cron format is minute hour day-of-month month day-of-week command. '0 3 * * 1' means minute 0, hour 3 (3:00 AM), any day of month, any month, and day-of-week 1 (Monday). This exactly matches the requirement to run every Monday at 3:00 AM. The script path is absolute, which is best practice for cron jobs.

Files in /etc/cron.d use the extended format that includes a user field between the schedule and the command, so this entry runs the script as root at 02:30 every Monday. The five time fields map to minute, hour, day of month, month, and day of week, satisfying the requirement precisely.

Command substitution with $(command) runs the command in a subshell and substitutes its standard output, which is then assigned to the variable. Backticks achieve the same but nest poorly; $(...) is the modern, preferred syntax.

Referencing a mutable tag such as `latest` means a rebuild can pull a different base image, producing non-reproducible results. Pinning to an explicit version tag or image digest guarantees the same inputs are used across builds, which is the core requirement for reproducible container images in automated pipelines.

Within single quotes, Bash treats every character literally, so $VAR stays unexpanded; double quotes permit parameter and command substitution while still suppressing word splitting and globbing. This satisfies the stem's request for the precise difference in expansion behaviour between the two quoting styles.

COPY transfers files from the build context into the image, here placing the project's source at /app. It satisfies the need to get application code into the image before running npm install and CMD. Unlike ADD, COPY performs no URL fetching or archive extraction, keeping the build predictable.

Docker volumes are stored outside the container's writable layer, in a managed host directory, so their data persists after the container is removed and can be mounted by multiple containers simultaneously, satisfying both persistence and cross-container sharing.

Handlers are only invoked when the notifying task reports `changed`, so binding the restart to the package installation via `notify` ensures the service restarts precisely when the package changes. On subsequent idempotent runs where the package is already present, the task reports `ok` and the handler does not fire, matching the requirement to act only on real state changes.

Applying the manifest creates or updates the resources, and kubectl rollout status blocks until the Deployment's rollout completes or fails, returning a non-zero exit code on failure. This combination lets the script confirm success programmatically before proceeding to the next step in the automation workflow.

The `service` module manages service state on managed nodes, directly satisfying the requirement to ensure a service is running across all hosts. It supports `state: started` and `enabled`, unlike `command` or `shell`, which execute arbitrary commands without idempotent service-state handling. This makes it the appropriate declarative choice for the playbook.

getopts is a bash built-in that parses short options with arguments, such as -f filename, and sets OPTARG and OPTIND automatically. It handles the -v flag and option-argument pairing natively, unlike manual shifting or external parsers.

`IFS= read -r line` reads a full line without word splitting or backslash interpretation, and redirecting the file into the loop prevents the subshell problem that occurs when piping. This preserves spaces and special characters within each line. It is the standard, reliable pattern for line-by-line processing in Bash scripts.

Removing the stopped container with the -v flag also deletes any anonymous volumes associated with it, satisfying the requirement to clean up volumes. The container must be stopped first, which the other selected command handles, so this completes the lifecycle cleanup for the webapp container.

Under set -e, a command that is part of an OR list such as cmd || true is exempt from triggering exit, because the shell only aborts when the last command in the list returns non-zero. Appending || true lets the SSH failure be tolerated for that iteration while errexit still guards the rest of the script, which is precisely the requested behavior.

set -e makes bash terminate the script immediately when any command returns a non-zero exit status, matching the requirement to abort on failure. Placed at the top, it governs all subsequent commands in the script.

The function adds its two positional arguments, 5 and 10, storing the arithmetic result in a local variable, then echoes it. Bash arithmetic expansion evaluates the sum to 15, which is printed as the output.

Prints 42 to stdout; caller can capture with result=$(function).

The five fields of a crontab entry are minute, hour, day of month, month, and day of week. `30 2 * * *` means minute 30 of hour 2 (02:30) on every day of every month and every day of the week. This matches the requirement to run the backup script daily at 02:30.

Variables placed in a group_vars directory apply to all hosts in the group.

`git revert` creates a new commit that undoes the changes introduced by the specified commit. This is safe for shared repositories because it does not alter existing history; it adds a new commit that reverses the changes. It is the recommended way to undo changes that have been pushed, as it preserves the commit history for all collaborators.

Copies files to remote hosts.

The trailing colon after b declares that -b consumes an argument, while the bare a marks -a as a flag taking none. This matches the invocation ./script -a -b value, where getopts assigns value to OPTARG for -b and leaves -a argument-free.

The shebang instructs the kernel to launch the named program, here `/bin/bash`, to interpret the script's contents when executed directly. This satisfies the stem's requirement that the line defines which interpreter runs the file, rather than the current shell or a compiled binary.

Each RUN creates a layer, and deleting files in a later layer only masks them, leaving their bytes in the image. Chaining commands with && and removing caches such as /var/lib/apt/lists in the same RUN prevents that bloat. This keeps the final image smaller and the build deterministic, which matches the stated goal.

COPY transfers config.txt from the build context into the image at /app/, satisfying the file requirement, while EXPOSE 8080 documents the port the container listens on at runtime. Both instructions match the stem's constraints precisely, unlike ADD, which also handles remote URLs and archives unnecessarily here.

Bash accepts the hybrid syntax combining the function keyword with parentheses and braces. The shell parses function myfunc() { commands; } as a valid definition, so this form satisfies the stem's requirement for a legitimate function declaration alongside the other two accepted variants.

Command substitution executes the enclosed command in a subshell and replaces the expression with its standard output, which is then assigned to the variable. This lets result capture the directory listing text rather than the literal string, satisfying the script's intent.

lineinfile manages individual lines within an existing file, adding 'MaxAuthTries 3' if absent and matching by regexp. This satisfies the requirement to ensure a specific configuration line is present across multiple servers without rewriting the whole file.

Bash substring expansion uses ${parameter:offset:length}, so ${myvar:0:5} extracts five characters starting at index zero, yielding "Hello". The offset is zero-based, and the length is explicit, which is exactly what printing the first five characters requires.

Overriding the image's default entrypoint with an interactive shell keeps the container running and exposes its filesystem, letting you inspect why the original command exited. This directly addresses the immediate-exit symptom by bypassing the failing startup command.

`set -e` makes Bash exit immediately when any command returns a non-zero status, which is exactly the failure-termination behaviour described. The shebang already invokes Bash, so this shell option applies. It satisfies the requirement to exit on any command failure.