LCA Virtualization & Container Management 4 — Questions and Answers
Question 1: What does the Docker flag '--privileged' do when starting a container?
- Runs the container as a non-root user
- Grants the container near-full host kernel access (Correct answer)
- Limits the container to read-only filesystem access
- Enables network isolation for the container
Correct answer: Grants the container near-full host kernel access
--privileged disables most container security restrictions, giving the container almost the same access to the host kernel as a root process.
Question 2: Which cgroup subsystem limits the amount of RAM a container or VM can use?
- cpu
- memory (Correct answer)
- blkio
- devices
Correct answer: memory
The memory cgroup subsystem enforces RAM limits and can trigger OOM killing when a process group exceeds its allocation.
Question 3: What is the function of 'docker inspect' on a running container?
- View real-time resource usage statistics
- Display low-level JSON configuration and state details (Correct answer)
- List all filesystem changes made by the container
- Show container log output
Correct answer: Display low-level JSON configuration and state details
'docker inspect' returns a detailed JSON object with a container's configuration, networking, mounts, and current state.
Question 4: In libvirt XML domain configuration, which element defines the amount of memory allocated to a VM?
- <vcpu>
- <memory> (Correct answer)
- <os>
- <devices>
Correct answer: <memory>
The <memory> element in libvirt domain XML specifies the maximum memory allocation for the virtual machine.
Question 5: What happens when you run 'docker commit' on a container?
- Pushes the container to a registry
- Creates a new image from the container's current state (Correct answer)
- Saves container logs to a file
- Restarts the container with a new configuration
Correct answer: Creates a new image from the container's current state
'docker commit' captures the container's current filesystem state and creates a new image layer from it.
Question 6: Which Linux feature allows containers to have their own hostname independently of the host?
- PID namespace
- UTS namespace (Correct answer)
- IPC namespace
- User namespace
Correct answer: UTS namespace
UTS (UNIX Time-sharing System) namespaces isolate hostname and NIS domain name, giving each container its own identity.
Question 7: What is the role of the Docker daemon (dockerd)?
- Acts as the CLI client for Docker commands
- Manages container lifecycle, images, networks, and volumes on the host (Correct answer)
- Provides container registry authentication
- Schedules containers across multiple hosts
Correct answer: Manages container lifecycle, images, networks, and volumes on the host
dockerd is the background server process that handles all container operations and exposes a REST API consumed by the Docker CLI.
LCA Virtualization & Container Management 4
What does the Docker flag '--privileged' do when starting a container?