Container Image Building practice questions

BASE

Why wrong: BASE is not a valid instruction.

INIT

Why wrong: INIT is not a valid instruction.

PARENT

Why wrong: PARENT is not a valid instruction.

LISTEN

Why wrong: LISTEN is not a valid Containerfile instruction.

PORT

Why wrong: PORT is not a valid Containerfile instruction.

OPEN

Why wrong: OPEN is not a valid Containerfile instruction.

podman build --file-path dockerfiles/Customfile .

Why wrong: The flag is -f or --file, not --file-path.

podman build -p dockerfiles/Customfile .

Why wrong: The -p flag is not used for specifying the Containerfile path.

podman build --config dockerfiles/Customfile .

Why wrong: The --config flag is used for podman global configurations.

EXPORT APP_PORT=8080

Why wrong: EXPORT is a bash shell command.

VAR APP_PORT=8080

Why wrong: VAR is not a valid Containerfile instruction.

SET APP_PORT=8080

Why wrong: SET is a Windows shell command, not a Containerfile instruction.

TRANSFER

Why wrong: TRANSFER is not a valid instruction.

ADD

Why wrong: While ADD can copy local files, COPY is preferred for simple file copying as it doesn't have hidden auto-extraction behaviors.

MOVE

Why wrong: MOVE is not a valid instruction.

PATH

Why wrong: PATH is not a valid Containerfile instruction for this purpose.

ENV

Why wrong: ENV sets environment variables.

RUN

Why wrong: RUN executes commands in a new layer.

LOGIN

Why wrong: LOGIN is not a valid instruction.

IDENTITY

Why wrong: IDENTITY is not a valid instruction.

ACCOUNT

Why wrong: ACCOUNT is not a valid instruction.

COPY app.tar.gz /opt/app/

Why wrong: COPY will simply copy the tar file as a tar file without extracting it.

EXTRACT app.tar.gz /opt/app/

Why wrong: EXTRACT is not a valid Containerfile instruction.

RUN tar -xzf app.tar.gz -C /opt/app/

Why wrong: While this works, it adds an unnecessary extra layer and requires cleaning up the tar file.

podman build --proxy http://proxy.example.com:8080 .

Why wrong: There is no --proxy flag for podman build.

podman build --env HTTP_PROXY=http://proxy.example.com:8080 .

Why wrong: The --env flag applies to runtime, not build time.

podman build --set-proxy http://proxy.example.com:8080 .

Why wrong: --set-proxy is not a valid flag.

DEFINE VERSION

Why wrong: DEFINE is not a valid instruction.

ENV VERSION=1.0

Why wrong: ENV makes variables persistent in the final image, which may not be desired for build-only arguments.

VAR VERSION

Why wrong: VAR is not a valid instruction.

RUN ["dnf update -y", "dnf install -y httpd"]

Why wrong: Exec form runs a single executable, it does not chain shell commands this way.

RUN { dnf update -y; dnf install -y httpd; }

Why wrong: Braces without a proper shell context can cause syntax errors depending on the base image shell.

RUN dnf update -y dnf install -y httpd

Why wrong: Newline without continuation creates multiple RUN commands/layers.

RUN

Why wrong: RUN executes at build-time, not container run-time.

EXEC

Why wrong: EXEC is not a standard standalone instruction.

ENTRYPOINT

Why wrong: ENTRYPOINT configures a container that will run as an executable, making it harder to override completely without flags.

RUN /usr/bin/redis-server

Why wrong: RUN executes during the build, not container start.

CMD ["/usr/bin/redis-server", "--protected-mode", "no"]

Why wrong: Using only CMD makes it very easy for the user to override the binary entirely by passing arguments to podman run.

ENV BIN=/usr/bin/redis-server CMD $BIN

Why wrong: Using shell expansion with ENV does not lock down the entrypoint effectively.

COPY --stage=builder /app /app

Why wrong: The correct flag is --from, not --stage.

ADD --stage-name=builder /app /app

Why wrong: ADD does not take a --stage-name flag.

IMPORT --from=builder /app /app

Why wrong: IMPORT is not a valid Containerfile instruction.

Because package managers lock the database across different layers.

Why wrong: Package managers do not maintain locks across independent layer creation.

Because the container build engine will fail if cache cleanup happens in a separate layer.

Why wrong: The build will not fail, but the image size will not decrease.

To ensure environment variables persist between installation and cleanup.

Why wrong: Environment variables persist via ENV, not layer consolidation.

It automatically encrypts environment variables stored in the image layers.

Why wrong: Containerfile instructions and layers are not encrypted by default through multi-stage builds.

It bypasses the need for a container registry when sharing images.

Why wrong: Registries are still required for distribution.

It speeds up local DNS resolution during container execution.

Why wrong: Multi-stage builds affect the build process and resulting image size, not runtime DNS.

EXEC appuser

Why wrong: EXEC is not a valid instruction.

PRIVILEGE drop appuser

Why wrong: PRIVILEGE is not a valid instruction.

SECURITY --user=appuser

Why wrong: SECURITY is not a valid Containerfile instruction.

There is no functional difference; they are syntactic aliases.

Why wrong: They handle signal propagation and argument parsing completely differently.

Shell form is required for multi-stage builds, while exec form is for single-stage builds.

Why wrong: Form choice has no relation to single or multi-stage builds.

Shell form runs the command as PID 1, while exec form spawns a bash shell wrapper.

Why wrong: It is the opposite; exec form runs directly as PID 1.

COPY app.py /app/app.py && chown developer:devgroup /app/app.py

Why wrong: While this works, it adds an unnecessary extra layer compared to using --chown.

COPY --user=developer:devgroup app.py /app/app.py

Why wrong: The flag for ownership in COPY is --chown, not --user.

ADD --owner=developer app.py /app/app.py

Why wrong: The flag is not --owner.

It violates OCI container image specification limits on COPY counts.

Why wrong: There is no limit on the number of COPY instructions.

It causes the ENTRYPOINT instruction to fail at runtime.

Why wrong: COPY placement does not impact runtime ENTRYPOINT execution.

It causes Podman to store duplicate layers in local storage, exhausting disk space.

Why wrong: Podman uses content-addressable storage, avoiding exact duplicate layer data.