Red Hat Certified Specialist in Containers (EX188, Podman-based) (EX188) (EX188) — Questions 1–75

`podman volume inspect` returns a volume's configuration as JSON, including its mountpoint, driver, and labels, satisfying the stem's requirement to inspect storage volumes. It queries volume metadata directly rather than container or image state, which is the axis distinguishing volume subcommands from other Podman inspection commands.

Chaining with `&&` executes both commands within one RUN instruction, producing a single image layer and satisfying the layer-minimisation constraint. The shell only proceeds to `dnf install` if `dnf update` succeeds, so failures halt the build rather than silently continuing. This is standard Containerfile syntax.

podman cp supports copying from host to container using host_path:container_path syntax.

`podman network disconnect` detaches a running container's network interface from the named network without stopping it, satisfying the stem's requirement to disconnect while the container keeps running. The arguments are ordered network first, then container, matching `mynet` and `mycontainer` exactly as specified.

podman logs retrieves a container's captured stdout and stderr, satisfying the stem's requirement to examine output logs. It reads the container's logging driver output, unlike podman events, which reports lifecycle actions rather than application output.

To assign a static IP, the network must have a defined subnet. The ipam configuration with a subnet provides the address range from which the static IP is drawn. Without this, Podman cannot validate or assign a fixed address, and the static IP setting would be rejected or ignored. This element is therefore required for the scenario.

podman update modifies container resource limits like CPU shares on a running container.

`podman image build` is the fully qualified form of the build command, invoking Buildah's image-building engine to read a Containerfile and produce a local image. It satisfies the stem's requirement for a valid Podman build command, functioning identically to `podman build` but with the explicit `image` subcommand namespace.

ENV sets a persistent environment variable that remains available to processes at build and runtime within the image. Unlike ARG, which applies only during the build, ENV satisfies the requirement for a persistent APP_PORT value of 8080 in the Containerfile.

podman events streams real-time system events, including container creation, start, stop and removal, which is exactly the auditing visibility required. Other Podman commands list current state rather than a live event stream, so they cannot satisfy the monitoring requirement.

This command correctly uses the short -v syntax to mount the named volume pgdata at the container path /var/lib/postgresql/data. The volume name is specified before the colon, and the container path after, which is the standard format for named volumes in Podman. The environment variable sets the database password. This is the simplest and most common way to attach a named volume to a container.

podman volume rm removes one or more named volumes by passing their names as arguments, directly satisfying the requirement to delete specific volumes. Other volume subcommands create, inspect or prune volumes, but only rm targets named volumes for deletion.

Rootless Podman relies on Linux user namespaces to map the unprivileged user to a pseudo-root inside the container, with subuid/subgid ranges from /etc/subuid and /etc/subgid enabling that mapping. This is what lets the non-root user run containers without root privileges.

The podman network inspect command outputs the full JSON configuration of the named network, including subnet, gateway and driver details. Appending the network name 'appnet' targets that specific network, satisfying the requirement to examine its configuration.

Placing the CA in /etc/pki/ca-trust/source/anchors/ and running update-ca-trust regenerates the consolidated trust store, so the container trusts the internal registries and repositories required behind the corporate firewall. This satisfies the stem's custom CA constraint by installing the certificate into the system trust bundle at build time.

Podman secrets store credentials encrypted at rest and inject them as tmpfs-mounted files, never as environment variables. The `type=mount` flag writes the secret to `/run/secrets/pass` inside the container, satisfying the requirement to avoid plaintext environment variables while keeping credentials readable only within the container's memory-backed filesystem.

A scratch image contains no libraries or system files, so a dynamically linked binary cannot resolve its interpreter or glibc dependencies at runtime, producing 'file not found'. Statically compiling the Go binary with CGO disabled removes those external dependencies.

Podman mounts secrets under /run/secrets by default, using the secret's name as the filename, so db_password appears at /run/secrets/db_password without any destination flag. This satisfies the stem's constraint of specifying no target path, unlike /etc or /var locations that require explicit configuration.

Multi-stage builds let earlier stages compile and build, while the final stage copies only the binary and required runtime libraries. Build tools, source and caches are excluded, shrinking the production image and reducing its exploitable attack surface.

The --uidmap and --gidmap flags pass explicit UID and GID translation ranges to the container runtime, mapping host accounts to different identities inside the user namespace. This satisfies the rootless mapping requirement, unlike --userns=keep-id, which preserves the invoking user's identity rather than remapping it.

The type=env parameter on --secret injects the secret's value directly as an environment variable inside the container rather than mounting it as a file under /run/secrets. This matches the application's requirement for environment-variable exposure using Podman's native secret handling.

Running `loginctl enable-linger <username>` keeps the user's systemd instance alive after logout, so user-scoped units can start at boot without an interactive session. Without lingering, rootless Podman containers defined as user services would only run while that user is logged in, breaking the persist-across-reboot requirement.

The `--mount` flag requires explicit key-value pairs, so `type=bind` declares a bind mount rather than a named volume or tmpfs. `source` and `destination` map the host directory to the container path, satisfying the stem's demand for correct advanced syntax. The comma-separated form is parsed without ambiguity, unlike `-v` shorthand.

The `unqualified-search-registries` parameter in `/etc/containers/registries.conf` lists registries that Podman queries when an image name lacks a registry hostname. Adding `registry.access.redhat.com` there makes `podman pull rhel9` resolve to `registry.access.redhat.com/rhel9`, satisfying the system-wide shortcut requirement for all developers.

The podman network connect subcommand attaches a running container to an existing user-defined network at runtime, requiring no container restart or recreation. It satisfies the constraint of connecting web1 to backend-net while the container keeps running.

COPY transfers files or directories from the build context into the image filesystem, without ADD's URL fetching or tar auto-extraction. It satisfies the stem's requirement for an instruction that copies build-context content into the container image.

Using --network host places the container directly in the host's network namespace, so it shares the host stack with no NAT or virtual interface. This satisfies the stem's requirement to bypass that overhead entirely, unlike bridge or slirp4netns modes.

'ss -ltnp' shows listening TCP sockets with the owning process, so filtering for port 8080 identifies exactly which host process already holds that port. This directly confirms the conflict that prevented Podman from binding the requested host port, giving the administrator the information needed to stop or move the competing service before retrying the container.

Pausing a container with podman pause freezes its processes via the cgroup freezer without stopping them. The paired subcommand podman unpause thaws that same cgroup, resuming execution from the exact frozen state, so it is the only command that restores db_master.

The sysctl parameter net.ipv4.ip_unprivileged_port_start defines the lowest port number an unprivileged user may bind. Lowering it below 80 lets rootless Podman containers bind TCP port 80 without elevated privileges, directly resolving the binding failure described.

type=env injects the secret's value directly into the container as an environment variable, readable by processes via standard environment lookups. This satisfies the scenario's requirement for a valid Podman secret mounting option, though environment variables are more readily exposed through process inspection than file-mounted secrets.

`podman events` streams real-time lifecycle events from the Podman service, reporting actions such as create, start, stop and die for every container on the system. It satisfies the stem's requirement for system-wide, real-time monitoring, unlike `podman ps`, which only lists current container state.

The env_file directive names a file whose KEY=VALUE lines Podman Compose reads and injects as environment variables into the service container at creation, satisfying the requirement to load configuration automatically rather than declaring each variable inline under environment.

podman top runs ps inside a running container, and arguments after the container name pass through to ps, so -ef returns every process with full command lines. Docker-style exec would need an explicit ps invocation.

ENTRYPOINT fixes the executable, while CMD supplies default arguments that a user can override at runtime by appending values to `podman run`. This pairing satisfies the stem's requirement for defaults with override flexibility, unlike CMD alone, which is fully replaced when arguments are passed.

The uppercase -P flag publishes the container's exposed port to a randomly assigned ephemeral port on the host, whereas lowercase -p requires an explicit host-to-container mapping. This suits scenarios where the specific host port is irrelevant.

RUN accepts both forms: shell form executes via `/bin/sh -c`, while exec form runs the command directly without a shell. This satisfies the stem's requirement for instructions supporting either syntax, since RUN genuinely permits both, unlike CMD or ENTRYPOINT where the distinction affects signal handling and argument passing.

The exec form runs the executable directly without a shell, allowing it to receive signals like SIGTERM from Podman and forward arguments correctly. This is critical for graceful shutdown and proper argument handling. The shell form wraps the command in /bin/sh -c, which can interfere with signal propagation and argument forwarding, so switching to exec form is a best practice.

The -d flag detaches the container so it runs in the background, and --name webapp assigns the required container name. Specifying docker.io/library/httpd as the image pulls and starts it, satisfying both the naming and background constraints in one command.

EXPOSE documents the network ports a container listens on at runtime, functioning as metadata for image consumers and tooling. It satisfies the stem's requirement for declaring listening ports, unlike RUN or CMD, which execute commands rather than record port information.

'podman rmi' accepts a tag reference and deletes that specific tag from local storage, removing only the named reference while the underlying image layers remain if other tags still point to them. This satisfies the stem's requirement for managing tags in local Podman storage.

The `--format` flag with Go template syntax extracts exactly the `Config.Entrypoint` and `Config.Cmd` fields from the container's image configuration, satisfying the requirement to inspect entrypoint and command arguments without starting the container. This targets the precise metadata fields rather than the full JSON output.

Persistently setting the directory's default context to container_file_t and applying it with restorecon makes the host path compatible with container access under SELinux enforcement. This is appropriate when the directory is dedicated to container use, and it does not require disabling SELinux or weakening the confinement of the container.

'expose' documents and opens the container port for the Compose network without publishing it to the host, so sibling containers can reach the service by its name and port while the host has no listener for it. Attaching the service to the shared network provides the DNS name resolution. This matches the requirement of internal-only reachability without host exposure.

The podman network connect subcommand attaches an already running container to an existing network, taking the network name then the container. This satisfies the requirement to join 'mynet' without recreating the container, unlike podman run --network, which only applies at creation.

Podman reads per-registry certificate files from /etc/containers/certs.d/<registry-host>:<port>/. Placing the CA certificate there allows Podman to trust the self-signed certificate for that specific registry during login and push operations, without modifying the system-wide trust store or disabling TLS verification.

Removes locally stored images from Podman's storage, freeing disk space and clearing unwanted container images. The rmi subcommand targets image removal specifically, satisfying the requirement to delete items held in local storage rather than containers or volumes.

The --driver flag specifies which volume driver Podman uses when creating the volume, overriding the default local driver. Naming nfs here instructs Podman to provision the volume through the NFS driver plugin, matching the requirement for a non-default driver.

Under a service definition, `networks` is a valid key that attaches the container to one or more named networks declared in the top-level `networks` section, satisfying the networking configuration requirement. It accepts a list or mapping, letting you set per-network aliases and static IPs, unlike `network_mode`, which joins a single existing namespace.

The --mount flag attaches volumes or bind mounts to a container, accepting key-value parameters such as type, source, and destination. It satisfies the stem's requirement for mounting storage at container runtime, and is the modern, more explicit alternative to the legacy --volume flag.

The `podman inspect` command reads the container's persisted state, and the Go template extracts the `State.Health.Status` field, returning values such as `healthy`, `unhealthy`, or `starting`. This satisfies the requirement to review health status without executing anything inside the container, since the healthcheck results are recorded by Podman itself.

Docker's -p flag maps host port to container port as host:container. Since the host must expose 8080 and the application listens on 80 inside the container, -p 8080:80 satisfies both constraints, routing host traffic on 8080 to container port 80.

Passing '--ip 192.168.100.50' alongside '--network mynet' assigns the static address within that custom CNI network at container creation. Podman only honours the static IP when the named network is specified, satisfying the requirement to fix the address during 'podman run'.

The :U option tells Podman to adjust the ownership of the host directory so that it matches the UID/GID mapping inside the container. In rootless mode, the container's UID 1000 corresponds to a different host UID (often in the high range) due to user namespace remapping. Using :U ensures the container process has write access by changing the host directory's ownership to the mapped UID. This is the recommended solution for permission issues with bind mounts in rootless containers.

The podman image trust show command displays the active signature verification policy derived from policy.json and related configuration. It shows which registries or repositories are allowed, and what signature requirements apply. It is read-only and does not alter the policy, making it suitable for inspecting the effective settings before pulling images.

`podman-compose up -d` creates and starts every service declared in the Compose file, with `-d` detaching the containers so the terminal returns immediately. This directly satisfies the stem's requirement for detached mode, unlike `up` alone, which streams logs and blocks the session.

The -e or --env flag passes a single variable directly on the podman run command line, setting it inside the container at launch. This satisfies the requirement to supply environment variables without needing an external file, ideal for quick, ad-hoc values.

ENV values are baked into the image configuration and exported to the container's process environment at runtime, so the application can read configuration such as database hosts without rebuilds. ARG would not survive into the running container.

The docker:// transport prefix explicitly forces Podman to treat the reference as a Docker Hub registry image, pulling library/alpine with the latest tag. This satisfies the stem's requirement for explicit transport syntax rather than relying on Podman's default registry resolution.

The `{{.State.FinishedAt}}` field exposes the container's termination timestamp from its state object, satisfying the requirement to inspect when the failed container finished. Unlike `StartedAt` or `ExitCode`, this field specifically reports the completion time recorded by Podman, giving the exact finished timestamp the administrator needs.

The `:ro` suffix on the `-v` bind mount sets the mount's read-only attribute in the kernel, so writes to `/container/data` fail with EROFS. This directly satisfies the stem's constraint of preventing accidental modification of the host directory, while still exposing its contents to the container.

Placing the .container file in /etc/containers/systemd/ satisfies the system-wide root requirement, since Quadlet's system generator scans this directory for root-owned units. Files here are processed by the systemd system manager, unlike user-scoped paths such as ~/.config/containers/systemd/, which only apply to rootless user services.

Podman's systemd generators parse Quadlet files at daemon-reload and emit native unit files, so systemd manages the containers directly without a separate Podman service. This satisfies the stem's requirement that Quadlets manage container lifecycles via systemd, since the generated units are what systemd actually starts and stops.

The podman images command lists all container images in local storage, showing repository, tag, image ID and size. That directly matches the requirement to view every locally stored image with its size, tag and ID.

`podman commit` creates a new image from a container's current writable layer, satisfying the requirement to create new images from containers. It captures filesystem changes made inside a running or stopped container, unlike `podman export`, which streams the filesystem as a tar archive without producing a reusable image.

Minimal trusted base images shrink the installed package set, directly reducing the vulnerability surface and satisfying least privilege by removing unnecessary software. Fewer components mean fewer exploitable paths and less to patch, which is the mechanism that limits attacker opportunity.

The -f flag forces removal of a running container, sending SIGKILL and deleting it without a prior stop step. This satisfies the requirement to stop and remove temp_test in a single command, unlike plain podman rm, which fails on running containers.

Multi-stage builds let earlier stages carry compilers, SDKs and build dependencies, while the final stage copies only the finished artefacts. This keeps the production image minimal, since heavyweight build tooling never ships in the runtime layer, directly reducing image size.

Using curl/wget in a RUN instruction gives granular control over downloads, headers, and cache handling.

For dir:// transports, Podman verifies signatures against keys in the local GnuPG keyring, so the public key must be imported there with gpg --import. Registry-scoped key files or policy entries alone do not satisfy verification for a directory transport.

The :ro option mounts the file as read-only inside the container, preventing any writes. This directly meets the requirement to read but not modify, and it uses a bind mount to map the specific host file. It is the correct and safe choice.

The :Z option tells Podman to relabel the host directory with a private SELinux label unique to the container. This allows the container process to write while keeping SELinux enforcing. It is the recommended way to handle SELinux denials for bind mounts in rootless mode, and it does not require disabling or weakening SELinux.

WORKDIR sets the working directory for subsequent RUN, CMD, ENTRYPOINT, COPY and ADD instructions, satisfying the stem's requirement to affect all following instructions. Unlike cd inside a single RUN, it persists across build stages and layers, so later instructions resolve relative paths from that directory.

The writable layer sits atop the container's image and is destroyed with the container, so logs and temporary state written there vanish on restart. This is ephemeral container storage, the default pattern absent any mounted volume.

podman restart stops and starts an existing container, applying updated configuration such as changed resource limits or environment settings. It is a valid container-management subcommand, satisfying the administrator's need to modify container state without recreating it.