LPIC-3 Exam 305: Virtualization and Containerization (305-300) (305-300) (305-300) — Questions 76–150

Kubernetes satisfies the orchestration requirement by automating container deployment, scaling and management across clusters. It provides declarative configuration, self-healing, service discovery and load balancing, which are the defining capabilities the question demands. Unlike standalone runtimes such as Docker Engine, Kubernetes coordinates workloads across multiple hosts, making it a valid orchestration platform.

scripts-per-instance is a cloud-init module that runs scripts exactly once per instance, on the first boot. It is designed for tasks that should only happen during initial provisioning. By providing the script as a MIME part with the appropriate content type, cloud-init will execute it only on the first boot, satisfying the requirement.

docker tag assigns an additional repository name and tag to an existing local image, creating a new reference without rebuilding layers. This is an image-management operation, satisfying the stem's requirement for commands that manage images rather than containers or networks.

The `<hugepages/>` element sits inside `<memoryBacking>` and enables backing the guest's memory with pre-allocated huge pages, reducing TLB pressure. This satisfies the stem's requirement that the attribute be definable within that block, since libvirt documents hugepages as a valid memoryBacking child alongside locked and nosharepages.

devicemapper is a Docker storage driver using thin provisioning on block devices via the kernel's device-mapper framework, controlling layers through snapshots. It satisfies the stem by being one of the drivers Docker documents and supports for managing image and container layers.

Containers share the host kernel and isolate processes via namespaces and cgroups, avoiding the full guest operating system a virtual machine must boot. This architectural difference yields smaller images and startup in seconds rather than the minutes a hypervisor-based VM typically needs.

docker manifest inspect queries the registry API directly, returning the image's manifest, layers, platform variants and digests without downloading layer blobs to the local daemon. That satisfies the stem's constraint of inspecting metadata without pulling the image.

Docker passes proxy settings into the build through --build-arg, which injects values such as HTTP_PROXY as environment variables available to RUN instructions. Without it, the build container cannot reach external repositories, so the RUN step fails despite valid host network access.

--copy-storage-all copies every guest disk to the destination as part of the migration, removing the shared-storage requirement that triggered the error. This enables true block migration when the destination has no access to the source's storage pool.

The jail utility is FreeBSD's standard administrative command for creating, starting, stopping and listing jails. Running 'jail' with a configuration or parameters starts the jail and executes its command, directly fulfilling the requirement to start a jail.

virsh save writes the VM's complete memory and device state to a file and stops it, allowing later restoration via virsh restore. This matches the stem's requirement to save state to a file and resume it later.

virsh start boots a defined, persistent domain, and virsh list displays only domains that are currently running. Together they start db01 and confirm its running state in one step. This is the standard operational workflow for libvirt-managed guests and matches the administrator's goal exactly.

virsh attach-disk adds a block device to a running domain, hot-plugging the image at the specified target such as vda. This satisfies the requirement to attach a new disk without shutting down the VM, provided the guest supports hot-plug.

Virtio-scsi multi-queue parallelism is configured on the SCSI controller via the queues attribute, and the disk must be attached to that controller by setting its target bus to scsi. This combination enables multiple virtqueues between guest and host, improving throughput under concurrent I/O without touching the guest OS installation itself, since virtio-scsi drivers are present in modern Linux guests.

Ballooning uses a paravirtualised driver to inflate or deflate a guest's memory allocation at runtime, reclaiming unused pages for other VMs. This satisfies the requirement to dynamically resize guest memory without rebooting, unlike static allocation at domain start.

Removing a set of host CPUs from the general scheduler means other host tasks will not run there, so the guest's pinned vCPUs are not preempted by unrelated work. Combined with pinning, this sharply reduces jitter and keeps the guest's working set in cache. It is a core technique for latency-sensitive virtualization on Linux.

qemu-img convert with -f raw and -O qcow2 reads the source as a raw image and writes QCOW2 output, satisfying the snapshotting requirement. The explicit input and output format flags prevent misdetection, unlike qemu-img create or resize.

`virsh net-define` imports a persistent network definition from an XML file, registering it with libvirt without starting it. This satisfies the requirement to manage virtual networks, since defining, editing and removing networks are core management operations, and the command operates on the network object itself rather than on individual domains.

User Beancounters are per-container resource limits enforced by the OpenVZ kernel, controlling CPU, memory and disk quotas. They appear in the container's configuration file alongside other parameters, satisfying the requirement for a typical OpenVZ configuration item.

`docker system df -v` shows detailed disk usage of images, containers, volumes, and build cache, including which items consume space. Since the Docker data root is on a separate partition, `df -h` on the host root may not reflect it. This command reveals the actual consumption within Docker's storage area, helping identify the cause of the 'no space left' error.

`virsh net-list --all` queries the libvirt daemon and returns every network defined in the hypervisor, including inactive ones. The `--all` flag satisfies the stem's requirement to list *all* defined virtual networks, whereas the bare `virsh net-list` shows only currently active networks.

Placing `<hugepages/>` inside `<memoryBacking>` instructs libvirt to back the guest's memory with huge pages rather than standard 4 KiB pages, satisfying the stem's requirement to enable hugepages for the VM. The element must sit within `<memoryBacking>` in the domain XML; standalone placement is invalid.

Vagrant resolves a missing box by fetching it from the Vagrant Cloud registry, downloading and installing it locally before provisioning. This default behaviour means no manual box installation is needed, satisfying the scenario where the box is absent from the host.

packer validate parses the template and reports syntax, schema, and configuration errors without starting a build, letting you catch mistakes cheaply. It satisfies the pre-build validation requirement, unlike packer build, which would attempt the full image creation.

The --device flag allows passing a host device into the container, making it accessible as /dev/sdb inside the container. This grants direct access to the block device, enabling I/O operations. It is the correct way to expose specific devices without using privileged mode. Other options do not provide device access.

This sequence defines a directory-type storage pool with the given target path and then starts it, making it active. The pool-define-as command creates a persistent definition, and pool-start activates it. This is the correct way to create and enable a directory-based pool without using an XML file.

The #cloud-config shebang on the first line signals cloud-init to parse the file as YAML configuration rather than a shell script or other user-data format. Without it, cloud-init treats the payload as an unrecognised script and skips the declared modules.

Ingress mode publishes a service on the swarm's routing mesh, so every node accepts traffic on the published port and forwards it to healthy replicas regardless of placement. This provides the load-balancing across all healthy container replicas that the scenario requires.

The docker images command queries the local image cache and returns every stored image with repository, tag, image ID, creation time and size. It requires no running container and reads directly from the host's Docker daemon, satisfying the stem's request to list images on the host.

config.vm.define creates a named machine configuration block within the Vagrantfile, allowing per-machine settings such as hostname and private network IP. Each block inherits the global configuration but can override it. This is the standard way to define multiple machines in a single Vagrantfile, exactly matching the requirement for three web servers and one load balancer with distinct identities.

docker system prune removes stopped containers, unused networks and dangling images in a single invocation, matching the requirement to clean these resources in one step. Adding -a extends it to all unused images, but the base command already covers the three specified categories.

Using `config.vm.define :name` creates a named machine block within the single Vagrantfile, letting each machine carry its own settings such as box, network and provider configuration. This satisfies the stem's requirement to define individual configurations for multiple machines, since each block is scoped separately rather than sharing one global definition.

Kernel-based Virtual Machine is the Linux kernel module that turns the kernel itself into a type-1 hypervisor, exposing hardware virtualisation extensions (Intel VT-x or AMD-V) through /dev/kvm. This directly satisfies the stem's request for the expansion of the acronym KVM, distinguishing it from keyboard-video-mouse switching hardware.

pool-define-as creates a persistent pool definition in libvirt's configuration without starting it, letting you specify type, name and source devices. This is the correct utility for establishing a new pool before building or starting it.

docker stats streams live CPU, memory, network and block I/O metrics for each running container, refreshed continuously. This directly satisfies the requirement to display resource usage of running containers, unlike docker ps, which only lists containers without consumption figures.

The cloud-init hostname module reads the instance's configured hostname from metadata and applies it during initial boot, setting both the transient and persistent hostname. This directly satisfies the stem's requirement for the module responsible for hostname configuration at first boot.

The pool-define-as command creates a persistent pool definition. The first argument is the pool name, followed by the pool type (dir), and then the target path. After defining, the pool must be started with pool-start. This correctly sets up a directory-based storage pool. The pool will be automatically started on host boot if pool-autostart is set, but pool-start is needed for immediate use.

In Vagrant, each machine defined in a multi-machine Vagrantfile has its own config block where you can override the default SSH forwarded port. Specifying guest: 22 with a unique host port and a stable id (such as "ssh") replaces the default 2222 mapping for that machine, preventing collisions when several VMs run simultaneously on the same host.

virsh define loads a new persistent configuration for the domain from the specified XML file. This is the correct way to apply changes to a guest's definition without starting it. It replaces the existing persistent definition, so you can correct errors and then start the guest when ready.

The kernel panic occurs because the guest initramfs has no virtio_blk driver, so the root filesystem on the virtio disk is invisible. Injecting the module via the installer boot command, or ensuring the installed initramfs includes it, lets the kernel enumerate the disk and mount root. This is the standard fix when a KVM image built by Packer fails to boot under `-drive if=virtio`.

CPU shares are a cgroup CPU-scheduling control, letting LXC allocate relative processor time between containers. This satisfies the stem's requirement for a manageable cgroup item, since shares directly tune CPU distribution rather than merely reporting usage or configuring storage and networking.

`ARG` defines a build-time variable that can be passed with `--build-arg` and is available only during the build stage. It is not persisted in the image's environment or history in a way that exposes the value to running containers. This matches the requirement of a variable that is used during build but not retained in the final image.

Libvirt stores persistent domain definitions as individual XML files under /etc/libvirt/qemu/, named after each guest. This satisfies the question's requirement for the default configuration location, since transient domains exist only in memory and the runtime state directory /var/run/libvirt/qemu/ holds no persistent XML.

Defines the builder(s) to use.

APT leaves package index caches under /var/lib/apt/lists/* after installation; deleting them in the same layer prevents that metadata persisting into the final image. This directly satisfies the image-size reduction constraint, since those cached lists are otherwise retained in the layer.

The `--rm` flag tells Docker to automatically remove the container's filesystem when it exits. This is ideal for short-lived tasks where the container does not need to persist. It prevents accumulation of stopped containers and matches the requirement of self-removal after the command completes.

LVM presents logical volumes as block devices under /dev/vg_name/lv_name, which QEMU can attach directly as a virtual disk backing file. This satisfies the stem's LVM constraint, since the path resolves through the volume group to the logical volume rather than exposing a raw partition or plain image file.

The cputune element with vcpupin binds a virtual CPU to a host cpuset, satisfying the pinning requirement. Placing it under cputune rather than cpu or numa distinguishes per-vCPU affinity from topology definitions or memory placement.

virsh list queries the libvirt daemon and enumerates running domains on the local hypervisor, matching the stem's requirement to list active running domains. Other virsh subcommands target storage pools, networks or interfaces, or require the --all flag to include inactive, shut-off domains.

libvirt refuses to migrate a domain to what it considers the same host. If the destination URI resolves to the source host's address, for example due to a stale /etc/hosts entry or a mistaken qemu+tcp:// URI, the check fails with exactly this message. Verifying name resolution and the destination argument is the correct first step.

A sidecar runs alongside the main container in the same pod, sharing its network namespace and lifecycle, to handle auxiliary concerns such as log shipping, metrics collection or proxying. This offloads cross-cutting functions without altering the primary application image.

The format option specifies the output image format produced by the QEMU builder, satisfying the stem's requirement. It controls the on-disk artefact type, such as qcow2 or raw, and is distinct from accelerator, which selects the CPU virtualisation backend rather than the image encoding.

Libvirt provides an iscsi storage pool type that connects to an iSCSI target and exposes its LUNs as volumes. It is a recognised pool driver, distinct from dir, fs, netfs, logical, disk, scsi, mpath, rbd, gluster and zfs.

The overlay driver encapsulates container traffic in VXLAN, extending a single logical network across multiple Docker hosts. This satisfies the stem's multi-host constraint, which bridge and host drivers cannot meet since they are confined to one host.

Virtio provides a paravirtualised block driver, letting the guest issue I/O through shared memory rings rather than emulating a full storage controller. This bypasses the trap-and-emulate overhead of IDE or SATA emulation, delivering the lowest latency and highest throughput — exactly the disk I/O optimisation the scenario demands.

The shutdown subcommand sends an ACPI shutdown signal or, if the QEMU guest agent is configured, a guest-agent shutdown request. This lets the guest OS perform an orderly halt, flushing buffers and stopping services. It matches the requirement for a graceful maintenance shutdown.

docker inspect returns the container's full JSON metadata: configuration, network settings, mounts, environment variables and state. It reads the daemon's stored object rather than live process output, matching the stem's requirement to examine metadata and configuration of a running container.

xl vcpu-set adjusts the virtual CPU count of a running domain through the Xen hypervisor toolstack, applying the new value to dom1 immediately. It changes the live allocation to four VCPUs without rebooting the guest.

The Docker daemon (dockerd) is the persistent background process that builds images, runs containers and manages Docker objects via the Docker API. It is a core architectural component, so it belongs in the correct three-part selection.

The domain XML must reference the UEFI firmware through a pflash loader or the newer firmware autoselection attributes. This tells QEMU to boot via UEFI and where to find the code and variable store. Without this configuration change, the guest would still boot with legacy BIOS.

qemu-system-arm is the full-system emulator binary that models an ARM machine, so it can boot an ARM kernel and OS on an x86 host. The stem specifies full ARM architecture emulation, which qemu-arm-user (user-mode only) cannot provide.

docker exec runs a new command inside a container that is already running, which is exactly the requirement. It differs from docker run, which starts a fresh container, and from docker attach, which merely connects to the existing main process.

VNC traffic is unencrypted by default, so credentials and screen data traverse the network in cleartext and can be captured by anyone with access to the path. This satisfies the scenario's requirement to identify a legitimate security concern affecting virtualisation host management.

Using `-o preallocation=full` instructs qemu-img to allocate every data block on the host filesystem immediately, rather than lazily on first write. This satisfies the stem's requirement for a preallocated image, avoiding fragmentation and runtime allocation overhead during guest writes.

Packer authenticates to the target cloud provider's API using credentials such as access keys or service principal secrets before it can create, snapshot and register images. Without these credentials the builder cannot provision temporary instances, so they are mandatory for any existing cloud environment.

`useradd -u 1000 -m appuser` creates the user with the specified UID and a home directory during the build, while running as root. The subsequent `USER appuser` instruction sets the runtime user for the rest of the build and the container. This order ensures the user exists before it is referenced, which is the correct and reliable pattern.

The net-dumpxml subcommand outputs the full XML definition of a libvirt virtual network. For the default network it reveals the forward mode='nat' element, the 192.168.122.0/24 address range, and the DHCP configuration. This is exactly the inspection needed to confirm how guests on the default network reach the host and external networks.

The ssh_authorized_keys directive under the users list injects the specified public keys into that user's authorized_keys file during first boot. It satisfies the requirement to target the correct account rather than a default or root user.

Network namespaces give each container its own isolated set of interfaces, routing tables, firewall rules and ports, so processes cannot see or interfere with the host's or other containers' networking. This satisfies the isolation requirement by virtualising the network stack per container.

Installing qemu-guest-agent inside the guest provides the in-VM daemon that communicates over the virtio-serial channel, enabling the host to issue commands such as graceful shutdown and filesystem freeze. Without this agent running, the host has no channel endpoint, so guest-agent integration cannot function regardless of host-side configuration.

A snapshot captures the complete state of a virtual machine — disk, memory, and configuration — at a specific moment, enabling rollback to that exact point. This differs from clones, which create independent copies rather than point-in-time restore states.

COPY --from=builder references the earlier build stage by name, pulling only the compiled binary into the final image without dragging along the builder's toolchain or layers. This satisfies the stem's multi-stage requirement, keeping the runtime image minimal while the build dependencies stay confined to the discarded stage.

The cgroup devices controller filters access by major:minor numbers, so 'b 8:0 rwm' permits block device 8:0 (/dev/sda) with read, write and mknod rights. Without this allow rule, the container's device cgroup denies access, satisfying the requirement to expose the host block device.

The KVM kernel module operates in kernel space and uses hardware virtualisation extensions (Intel VT-x or AMD-V) to execute guest code directly on the CPU. It satisfies the stem's requirement for hardware-assisted virtualisation, unlike QEMU, which handles device emulation in user space.

The `<source bridge='br0'/>` element names the host bridge that the guest's virtual NIC attaches to, satisfying the requirement for a valid child element within `<interface type='bridge'>`. Libvirt uses this attribute to bind the domain interface to an existing Linux bridge, so traffic egresses via br0 rather than a virtual network.