LPIC-3 Exam 305: Virtualization and Containerization (305-300) (305-300) (305-300) — Questions 1–75

`systemctl status libvirtd` queries systemd directly for the unit's runtime state, reporting whether libvirtd is active, inactive or failed, plus recent log lines. This satisfies the stem's requirement to check service status on a systemd-managed host, unlike `service` or `virsh` alternatives that query different layers.

vhost-net moves the virtio-net data plane from the QEMU userspace process into a kernel thread, cutting the number of context switches and the userspace overhead per packet. Because it keeps the same virtio-net guest driver, no guest OS change is required. This directly addresses the high system time and context-switch rate under heavy network load.

With the qemu builder, Packer starts the VM and immediately tries to SSH using the configured credentials. If the image does not start sshd early or if the boot command does not wait for the SSH port to become reachable, the communicator times out and provisioning never runs. Ensuring sshd is enabled and adding appropriate boot wait logic resolves this.

Internal snapshots store state inside the qcow2 image itself, and snapshot-create-as creates one against the running domain's current state without requiring a separate disk-only or external file. The --domain and snapshot name arguments are sufficient; no --disk-only or --atomic flags are needed.

Docker runs an embedded DNS server for user-defined networks, which listens on 127.0.0.11 and resolves container names and aliases. It allows containers on the same network to communicate using their names. This server is automatically configured in the container's /etc/resolv.conf. It is the correct mechanism for service discovery within a user-defined bridge network.

VirtualBox installs as an application atop an existing host operating system and relies on it for hardware access, which is the defining characteristic of Type 2 virtualisation, unlike bare-metal Type 1 hypervisors such as Xen or ESXi.

Rocket's daemonless design removes the long-running central daemon that Docker relied on, so containers launch directly via the rkt CLI without a persistent broker process. This satisfies the stem's architectural difference: no privileged daemon means a reduced attack surface and independent container lifecycle management.

Setting `jail_enable=YES` in `/etc/rc.conf` activates FreeBSD's `rc.d/jail` framework, which reads the `jail_list` variable and starts each named jail during the multi-user boot phase. This satisfies the stem's boot-persistence constraint directly, without requiring manual `jail` invocations or external schedulers.

VNC provides graphical console access to a virtual machine by exposing a remote framebuffer, letting clients view and control the guest's display. It satisfies the stem's console-connection requirement, unlike SSH, which requires a running guest OS and network reachability.

Containers on the default bridge receive DNS configuration from the Docker daemon unless overridden per container. If the daemon's `dns` setting points to an unreachable resolver, name resolution fails inside the container even though the host resolves fine. Checking `/etc/docker/daemon.json` for a `dns` entry or the `--dns` daemon flag is the correct first step.

macvlan assigns each container its own MAC and IP address on the parent interface, making it appear directly attached to the physical network. This satisfies the stem's requirement for containers to hold their own IPs on the physical network, unlike bridge, which uses NAT.

Editing the `<interface>` element in the VM's XML definition sets the `mac address` attribute directly, satisfying the requirement to change a virtual machine's NIC hardware address. Libvirt applies this at the hypervisor layer, so the guest receives the new MAC on next start, independent of any guest OS configuration.

virt-install creates and defines new libvirt domains, building the guest's XML definition and starting installation from a specified source. Provisioning new virtual machines is exactly its function, unlike virsh define, which only registers pre-existing XML without creating a guest.

Static addressing in libvirt is delivered through the network's DHCP section, where a host element binds a MAC address to a fixed IP. Placing the host entry inside the dhcp block ensures the guest receives that reserved address instead of a pooled lease, meeting the stem's static IP requirement.

The QEMU guest agent communicates over a virtio-serial channel and allows the host to query guest network interfaces, including IP addresses. libvirt's virsh domifaddr --source agent relies on this agent. Adding the channel device and installing the agent package inside the guest satisfies the IP reporting requirement.

USER sets the runtime user for all subsequent RUN, CMD and ENTRYPOINT instructions in the Dockerfile, satisfying the stem's user-context constraint. It changes the UID/GID used during build and at container start, unlike WORKDIR, which only alters the working directory.

--private-network gives the container its own isolated network namespace, separate from the host's interfaces and routing table. This satisfies the requirement to isolate container traffic, preventing direct host network access unless a virtual Ethernet link is explicitly configured.

The -p 8080:80 flag publishes host port 8080 to container port 80, where the web server actually listens per the Dockerfile. EXPOSE alone only documents the port; explicit publishing is required for external access, satisfying the stem's mapping requirement.

A bridge network binds a host bridge interface to the physical NIC, so guest traffic shares the host's LAN segment and receives addresses from the same DHCP scope. This satisfies the requirement for direct physical-network connectivity rather than NAT or an isolated virtual switch.

logical is a libvirt storage pool type backed by an LVM volume group, where volumes are created as logical volumes. It is a genuine pool driver alongside dir, fs, netfs, disk, iscsi, scsi and mpath.

Docker's -p flag takes host-port:container-port order, so -p 8080:80 publishes host port 8080 and forwards it to port 80 inside the container. Reversing the pair would map the ports the wrong way round, failing the stem's stated mapping.

COPY transfers files or directories from the build context on the host into the image filesystem at the specified destination. Unlike ADD, it performs no URL fetching or archive extraction, making it the precise instruction for the stem's host-to-image copy requirement.

The shell provisioner runs scripts or inline commands on the guest. It is commonly used to install packages and configure the VM. By specifying a shell script, Vagrant will execute it during provisioning, which meets the requirement of installing dependencies after boot.

fstrim discards unused guest blocks so the qcow2 file no longer stores them, then qemu-img convert rewrites the image without those zeroed clusters. This satisfies the shrink-on-host constraint while preserving the virtual disk's nominal size.

ADD copies files from a build context or remote URL into the image filesystem, creating a new layer that persists in the resulting image. This directly modifies image content, satisfying the question's requirement for instructions that change the filesystem, unlike metadata-only directives such as CMD or ENTRYPOINT.

libvirtd runs as a privileged daemon exposing a management API (via libvirt) that accepts remote or local calls to create, start, stop and inspect QEMU/KVM, Xen and LXC guests, decoupling management tooling from each hypervisor's native control interface.

libvirt's QEMU process runs as a confined domain, and by default it is not permitted to access NFS-mounted storage. The virt_use_nfs boolean grants that access, and the -P flag makes it persistent across reboots. Enabling it lets the guest start immediately without relabeling files or disabling SELinux, which is the least-disruptive correct fix for this scenario.

This is correct because a libvirt network using <forward mode='bridge'/> and a <bridge name='...'/> connects guests to an existing host bridge, giving them direct Layer 2 access to the physical LAN. Without this forwarding mode, libvirt would create an isolated NAT-based network, which would not allow external hosts to reach guests directly.

qcow2 is QEMU's native disk image format, storing guest data in a sparse, redirect-on-write structure that natively supports internal snapshots, zlib/zstd compression and backing files. Raw images and VMDK lack these integrated copy-on-write capabilities, so qcow2 uniquely satisfies the stem's requirement for advanced QEMU/KVM features.

The pci parameter in the guest domain configuration file lists host PCI devices to assign via passthrough, using BDF notation such as '00:1f.1'. Specifying it binds that NIC exclusively to the guest, satisfying the direct hardware access requirement.

`vagrant provision` re-runs the configured provisioners against the already-running guest, so a newly added shell script executes in place. It satisfies the stem's constraint of applying configuration changes without destroying the existing virtual machine, unlike `vagrant destroy` followed by `vagrant up`, which rebuilds from scratch.

The `<bandwidth>` element nests `<inbound>` and `<outbound>` children whose `average` attributes set throughput in kilobytes per second, directly satisfying the requirement to cap a virtual network interface's traffic. No other `<interface>` child exposes rate limiting, so this is the only element that configures the bandwidth constraint described.

By default, systemd-nspawn does not create a separate network namespace, so the container shares the host's network stack. If you omit all network options such as `--private-network` or `--network-interface`, the container uses the host's interfaces and routing directly. This is the intended way to achieve host network sharing with systemd-nspawn.

A .env file excluded from git keeps API keys out of version control while remaining readable by provisioning scripts and applications at runtime. Adding it to .gitignore satisfies the stem's constraint of avoiding committed secrets, unlike hardcoding values or relying on tracked configuration files that would expose credentials in repository history.

virsh domstats queries the libvirt hypervisor directly for per-domain metrics, returning CPU time, memory ballooning, block I/O and network interface counters for running guests. This satisfies the stem's requirement to monitor VM resource utilisation without relying on in-guest agents, which may be absent or unresponsive.

`lxc.cgroup.cpu.cfs_quota_us` sets the CFS bandwidth quota in microseconds per period, directly satisfying the stem's requirement for a CPU-time quota. Unlike `cpu.shares`, which only weights relative contention, this parameter enforces an absolute ceiling on runtime, so the container cannot exceed its allotted CPU time.

Nested virtualization depends on hardware-assisted memory virtualization: Intel EPT or AMD NPT. These provide second-level address translation for the guest hypervisor's own guests. If the host does not expose ept or npt to the guest, nested VMs will either fail to start with hardware acceleration or fall back to slow shadow paging, making the feature impractical.

Virtio provides paravirtualised disk and network drivers, letting the guest cooperate with the host hypervisor rather than emulating real hardware. This bypasses the slow emulated IDE or SCSI path, delivering the highest disk I/O throughput and lowest latency the stem demands.

The bridge mode is Docker's default, creating a private internal network on the host and connecting containers to it through a virtual bridge interface. It is natively supported, making it one of the three networking modes the question requires.

The import suboption tells virt-install to use the existing disk image without creating, resizing, or formatting it. This is the correct way to attach a pre-built image to a new domain definition. Without import, virt-install may attempt to create or modify the file, which is undesirable when the image already contains an installed OS.

systemd-nspawn by default creates a PID namespace for the container, which isolates its processes from the host's process tree. Processes inside the container only see other processes in the same container, not those on the host. This is a fundamental isolation feature and does not require an extra flag. While other options like --private-users add user isolation, PID namespace isolation is always active unless explicitly disabled with --private-pid or similar, which is not the case here.

PID namespaces give each container its own process ID numbering, so processes inside see themselves starting at PID 1 and cannot observe or signal host processes. This delivers the process isolation the question asks for, preventing cross-container visibility of the host process tree.

The `gui` setting in the VirtualBox provider block controls whether the virtual machine boots with a graphical interface or runs headless. Setting `gui = true` launches the VM window, satisfying scenarios requiring desktop interaction during provisioning, while the default headless mode suits automated, terminal-only workflows.

virsh shutdown sends an ACPI shutdown signal or, if the QEMU guest agent is configured, requests a graceful shutdown through the agent. The guest OS then runs its normal shutdown sequence, flushing filesystems and stopping services. This matches the requirement for a graceful shutdown of the running domain.

An interface of type bridge with source bridge br0 attaches the guest's virtio NIC directly to the host bridge, which is enslaved to the physical NIC. The guest then appears on the same Layer 2 segment as the host and can obtain an IP from the physical LAN's DHCP server without NAT, exactly as required.

`vagrant status` queries the active Vagrant environment and reports each machine's state, showing "running" for the libvirt-backed VM, while the provider in use is confirmed through the environment's configuration. It satisfies both constraints in the stem: verifying the running state and identifying the libvirt provider.

The <os> element defines the guest operating system type and boot configuration, including <type> for the hypervisor (hvm or kvm) and optional <loader> or <boot> entries. It is a mandatory child of the libvirt domain element, so it is a valid component of domain XML.

'docker rm' deletes a stopped container from the local Docker host, removing its writable layer and metadata. It does not touch images, volumes, or running containers unless forced with -f, distinguishing it from 'docker rmi', which removes images.

Xen is a bare-metal hypervisor that runs directly on host hardware beneath guest domains, which defines Type 1. It does not require a host operating system, unlike Type 2 products such as VirtualBox or VMware Workstation.

Docker adds rules to the NAT table for port forwarding and masquerading.

Each <interface> element defines one NIC, and its nested <mac address='...'/> sets that NIC's hardware address. Supplying a second interface block with a distinct MAC value guarantees the new NIC differs from the first, which libvirt requires to avoid conflicts.

/etc/vz/conf/CTID.conf holds each OpenVZ container's configuration, including environment variables and resource limits, with CTID replaced by the container's numeric ID. This satisfies the stem's requirement for the file defining configuration and environment variables, since OpenVZ reads per-container settings from this path rather than a global file.

Using `machinectl export-tar` streams a running or stopped container's entire filesystem into a tar archive, which can later be imported as a template. This satisfies the stem's requirement to create a reusable image from a systemd-nspawn container, since nspawn containers are managed as machines via machinectl rather than Docker-style commits.

The virtio-balloon driver lets the host reclaim guest memory dynamically by inflating or deflating a balloon inside the guest; inflated pages are returned to the hypervisor, satisfying the need to adjust guest RAM at runtime without rebooting.

The packages key lists packages for cloud-init to install during first boot, invoking the system package manager before configuration modules run. Placing package names here guarantees installation on initial provisioning, satisfying the requirement without custom scripts or manual intervention.

`packer inspect` parses a template and prints its declared variables, builders, provisioners and post-processors as structured, human-readable output, without executing a build. This directly satisfies the stem's requirement to display build configuration readably, unlike `packer validate`, which only checks syntax, or `packer build`, which runs the build.

A registry acts as the central repository that stores versioned container images and serves them to hosts on request, satisfying the need to persist and distribute artefacts. It is not a build tool or runtime; its function is storage plus retrieval over the network, enabling consistent image pulls across environments.

User-defined networks in Podman allow containers to communicate with each other by name via an embedded DNS server. Creating a network with podman network create and then running the container with --network <name> enables inter-container communication. This is necessary because the default network may not provide name resolution or isolation. It fulfills the requirement for communication between containers on the same host.

During container initialization, runc attempts to mount a new proc filesystem at /proc inside the container's root filesystem. If the /proc directory does not exist in the container image, the mount call fails with 'no such file or directory'. This is a common issue when building minimal images from scratch without creating the standard directories. The solution is to ensure the image includes an empty /proc directory.

virt-top displays live resource statistics for running virtual machines, including CPU, memory, disk and network usage, refreshed continuously like top. It satisfies the requirement for real-time per-VM monitoring rather than static inventory or configuration reporting.

A public_network bridges the VM's virtual NIC onto the host's physical interface, so DHCP broadcasts reach the physical network's server and the VM obtains a routable address from that subnet. This satisfies the stem's requirement for an IP assigned directly by the external DHCP server rather than by libvirt's private NAT.

virsh vol-resize enlarges the qcow2 volume in the pool, after which the guest sees a larger block device and the partition and filesystem can be grown from inside. This keeps the existing disk and data intact, which is exactly what the scenario requires. It is the supported way to add capacity to a libvirt-managed qcow2 volume.

Vagrant reads the Vagrantfile in the project root automatically on every vagrant command, using Ruby syntax to declare the box, provider, networking and provisioning. No other file is parsed by default, so this is the configuration entry point the stem asks for.

An isolated libvirt network provides connectivity between guest VMs and the host through a virtual bridge, but applies no NAT or forwarding to external networks. This satisfies the stem's constraint of internal communication while blocking outbound access, unlike routed or NAT modes.

This is the correct command-line argument for virtio-9p filesystem passthrough.

This option sets a CPU bandwidth limit using cgroup v2. The values represent quota and period in microseconds, so 50000 100000 means the container can use 50% of one CPU core. It is a valid and current way to restrict CPU usage in LXC when using cgroup v2, which is the default on modern systems.

Compose's declarative service definitions rely on YAML's indentation-based mapping, which expresses nested services, images and volumes without the verbosity of JSON or XML. The stem asks which format defines services, and Compose reads docker-compose.yml as YAML by default.

A bind mount maps a specific host directory path, chosen by the user, into the container, so data written there persists on the host filesystem at that exact location. Named volumes persist too, but Docker manages their path rather than the user defining it.

The `-netdev tap` backend binds the host tap0 interface, while `-device virtio-net-pci,netdev=net0` attaches the paravirtualised NIC and links it via the matching id. This two-part split satisfies the stem's requirement to enable virtio-net-pci with a tap interface named tap0.

virsh is the command-line interface to libvirt, managing virtual domains — starting, stopping, listing, snapshotting and reconfiguring them. This satisfies the requirement to manage virtual domains, offering scripting and remote control over the libvirt API.

The write_files module's path key specifies the absolute filesystem location where each file is created, which is mandatory for every entry. This satisfies the stem's requirement by defining where the managed file content is written on the instance.

The `env` hash on a shell provisioner injects the specified variables directly into the guest's provisioning environment, satisfying the requirement to pass values during provisioning rather than at boot. Vagrant exports these into the script's process, so the guest sees them without editing the box or using a separate configuration management tool.

virsh vol-create-as creates a new volume inside an existing storage pool, taking the pool name, volume name, and capacity as positional arguments. The --format qcow2 flag ensures the volume is created as a qcow2 image rather than a raw sparse file. This is the correct, direct way to allocate a 40 GB qcow2 volume in the 'default' pool.

Source NAT for outbound container traffic is performed in the nat table's POSTROUTING chain, where MASQUERADE or SNAT rules rewrite the source address after routing. Inspecting this chain reveals whether the SNAT rule is present, correctly matched, or bypassed by an earlier rule.

docker rmi removes images from the local image store, deleting tagged references and, with -f, dependent layers. It is the dedicated image-removal command, directly satisfying the stem's requirement to delete an unused image rather than containers or volumes.