Free LPI 305-300 Practice Exam with Questions & Answers

 The correct way to start a new container that shares the /data volume with the datastore container is to use the --volumes-from flag. This flag mounts all the defined volumes from the referenced containers. In this case, the datastore container has a volume named /data, which is mounted in the service container at the same path. The other options are incorrect because they either use invalid flags, such as --share-with or --volume-backend, or they create new volumes instead of sharing the existing one, such as -v datastore:/data or -v /data. References:

• Docker Docs - Volumes
• Stack Overflow - How to map volume paths using Docker’s --volumes-from?
• Docker Docs - docker run

 The command virsh list is used to list all running domains (VMs) on the current host. The command virsh list --all can be used to list both active and inactive domains. The other options are not valid virsh commands. The command virsh list is a basic command that lists all running domains (VMs). You can also list all configured VMs by adding the --all option. This is useful if you want to see all VMs configured in the target hypervisor that you can use on subsequent commands1. References:

• 1: 8 Linux virsh subcommands for managing VMs on the command line | Enable Sysadmin.

Libvirt supports creating and managing various types of virtual networks that can be used to connect virtual machines to each other or to the external network. One of the common types of virtual networks is the NAT-based network, which uses network address translation (NAT) to allow virtual machines to access the outside world through the host’s network interface. By default, libvirt creates a NAT-based network called ‘default’ when it is installed and started. This network appears as a standard Linux bridge device on the host system, named virbr0. The bridge device has an IP address of 192.168.122.1/24 and acts as a gateway and a DHCP server for the virtual machines connected to it. The bridge device also has iptables rules to forward and masquerade the traffic from and to the virtual machines. The virtual machines connected to the ‘default’ network have their own IP addresses in the 192.168.122.0/24 range and their own MAC addresses generated by libvirt. The virtual machines can communicate with each other, with the host, and with the external network through the bridge device and the NAT mechanism12.

The other statements in the question are false regarding networking with libvirt. Libvirt’s network functionality is not limited to connecting virtual machines to a physical network interface of the host system. Libvirt can also create isolated networks that do not have any connection to the outside world, or routed networks that use static routes to connect virtual machines to the external network without NAT3. Libvirt does not assign the same MAC address to all virtual machines and isolate their network interfaces at the link layer. Libvirt assigns a unique MAC address to each virtual machine and allows them to communicate with each other at the network layer4. Libvirt does not require a dedicated network interface that may not be used by the host system. Libvirt can share the host’s network interface with the virtual machines using NAT or bridging, or it can pass a physical network interface to a virtual machine exclusively using PCI passthrough5. Libvirt does not support exactly one virtual network and connect all virtual machines to it. Libvirt supports creating and managing multiple virtual networks with different names and configurations, and connecting virtual machines to different networks according to their needs6. References:

• libvirt: Virtual Networking
• libvirt: NAT forwarding (aka “virtual networks”)
• libvirt: Routed network
• libvirt: MAC address
• libvirt: PCI passthrough of host network devices
• [libvirt: Network XML format]

Libvirt uses XML files to store configuration data for objects in the libvirt API, such as domains, networks, storage, etc. This allows for ease of extension in future releases and validation of documents prior to usage. Libvirt does not use any of the other file formats listed in the question. References:

• libvirt: XML Format
• LPIC-3 Virtualization and Containerization: Topic 305.1: Virtualization Concepts and Theory

LXC implements system containers, which are a type of operating-system-level virtualization. System containers allow running multiple isolated Linux systems on a single Linux control host, using a single Linux kernel. System containers share the same kernel with the host and each other, but have their own file system, libraries, andprocesses. System containers are different from application containers, which are designed to run a single application or service in an isolated environment. Application containers are usually smaller and more portable than system containers, but also more dependent on the host kernel and libraries. Hardware containers, CPU emulation, and paravirtualization are not related to LXC, as they are different kinds of virtualization methods that involve hardware abstraction, instruction translation, or modification of the guest operating system. References:

• 1: LXC - Wikipedia
• 2: Linux Virtualization : Linux Containers (lxc) - GeeksforGeeks
• 3: Features - Proxmox Virtual Environment

The FROM statement in a Dockerfile specifies the base image from which the subsequent instructions are executed1. The value of the FROM statement can be either an image name, an image name with a tag, or an image ID1. The image name can be either a repository name or a repository name with a registry prefix2. For example, ubuntu is a repository name, and docker.io/ubuntu is a repository name with a registry prefix2. The tag is an optional identifier that can be used to specify a particular version or variant of an image1. For example, ubuntu:focal refers to the image with the focal tag in the ubuntu repository2. The image ID is a unique identifier that is automatically generated when an image is built or pulled1. For example, sha256:9b0dafaadb1cd1d14e4db51bd0f4c0d56b6b551b2982b2b7c637ca143ad605d2 is an image ID3.

Therefore, the only valid value in the FROM statement among the given options is ubuntu:focal, which is an image name with a tag. The other options are invalid because:

• docker://ubuntu:focal is not a valid image name format. The docker:// prefix is used to specify a transport protocol, not a registry prefix4.
• registry:ubuntu:focal is not a valid image name format. The registry prefix should be a valid hostname or IP address, not a generic term2.
• file:/tmp/ubuntu/Dockerfile is not a valid image name format. The file: prefix is used to specify a local file path, not an image name5.
• http://docker.example.com/images/ubuntu-focal.iso is not a valid image name format. The http:// prefix is used to specify a web URL, not an image name5.

References:

• 1: Dockerfile reference | Docker Docs
• 2: docker - Using FROM statement in dockerfile - Stack Overflow
• 3: How to get the image id from a docker image - Stack Overflow
• 4: skopeo - Docker Registry v2 API tool - Linux Man Pages (1)
• 5: How to build a Docker image from a local Dockerfile? - Stack Overflow

The lxc-attach command allows the user to start a new process within a running LXC container12. It takes the name of the container as an argument and optionally a command to execute inside the container. If no command is specified, it creates a new shell inside the container1. For example, to list all the files in the home directory of a container named myContainer, one can use:

lxc-attach -n myContainer – ls -lh /home

References:

• 1: Executing a command inside a running LXC - Unix & Linux Stack Exchange

The command lxc-checkpoint is used to checkpoint and restore containers. Checkpointing a container means saving the state of the container, including its memory, processes, file descriptors, and network connections, to a file or a directory. Restoring a container means resuming the container from the saved state, as if it was never stopped. Checkpointing and restoring containers can be useful for various purposes, such as live migration, backup, debugging, or snapshotting. The command lxc-checkpoint has the following syntax:

lxc-checkpoint {-n name} {-D path} [-r] [-s] [-v] [-d] [-F]

The options are:

• -n name: Specify the name of the container to checkpoint or restore.
• -D path: Specify the path to the file or directory where the checkpoint data is dumped or restored.
• -r, --restore: Restore the checkpoint for the container, instead of dumping it. This option is incompatible with -s.
• -s, --stop: Optionally stop the container after dumping. This option is incompatible with -r.
• -v, --verbose: Enable verbose criu logging. Only available when providing -r.
• -d, --daemon: Restore the container in the background (this is the default). Only available when providing -r.
• -F, --foreground: Restore the container in the foreground. Only available when providing -r.

The command lxc-checkpoint uses the CRIU (Checkpoint/Restore In Userspace) tool to perform the checkpoint and restore operations. CRIU is a software that can freeze a running application (or part of it) and checkpoint it to a hard drive as a collection of files. It can then use the files to restore and run the application from the point it was frozen at1.

The other statements about the command lxc-checkpoint are not correct. It does not create a clone or an image of a container, nor does it double the memory consumptionof the container. It can work on both running and stopped containers, depending on the options provided. References:

• Linux Containers - LXC - Manpages - lxc-checkpoint.12
• lxc-checkpoint(1) - Linux manual page - man7.org3
• CRIU4

 LXD supports the following network interface types for containers: macvlan, bridged, physical, sriov, and ovn1. Macvlan creates a virtual interface on the host that is connected to the same network as the parent interface2. Bridged connects the container to a network bridge that acts as a virtual switch3. Physical attaches the container to a physical network interface on the host2. Ipsec and wifi are not valid network interface types for LXD containers. References:

• 1: Bridge network - Canonical LXD documentation
• 2: How to create a network - Canonical LXD documentation
• 4: LXD containers and networking with static IP - Super User

LXC (Linux Containers) is a lightweight virtualization technology that allows multiple isolated Linux systems (containers) to run on the same host. LXC uses Linux kernel features such as namespaces, cgroups, and AppArmor to create and manage containers. Each container has its own file system, network interfaces, process tree, and resource limits. However, containers share the same kernel and hardware with the host, which makes them more efficient and faster than full virtualization.

By default, an LXC container has a minimal set of devices that are needed for its operation. These devices are created by the LXC library when the container is started, and are removed when the container is stopped. The default devices are:

• /dev/log: This is a Unix domain socket that connects to the syslog daemon on the host. It allows the container to send log messages to the host’s system log1.
• /dev/console: This is a character device that provides access to the container’s console. It is usually connected to the host’s terminal or a file. It allows the container to interact with the user or the host’s init system12.
• /dev/urandom: This is a character device that provides an unlimited source of pseudo-random numbers. It is used by various applications and libraries that need randomness, such as cryptography, UUID generation, and hashing13.

The other devices listed in the question do not exist by default in an LXC container. They are either not needed, not allowed, or not supported by the container’s namespace or cgroup configuration. These devices are:

• /dev/kmem: This is a character device that provides access to the kernel’s virtual memory. It is not needed by the container, as it can access its own memory through the /proc filesystem. It isalso not allowed by the container, as it would expose the host’s kernel memory and compromise its security4.
• /dev/root: This is a symbolic link that points to the root device of the system. It is not supported by the container, as it does not have a separate root device from the host. The container’s root file system is mounted from a directory, an image file, or a loop device on the host5.

References:

• Linux Containers - LXC - Manpages - lxc.container.conf.5
• Linux Containers - LXC - Getting started
• Random number generation - Wikipedia
• /dev/kmem - Wikipedia
• Linux Containers - LXC - Manpages - lxc.container.conf.5