LPI 305-300 LPIC-3: Virtualization and Containerization - Exam 305, version 3.0 Exam Practice Test

Containerd is an industry-standard container runtime that uses Runc (a low-level container runtime) by default, but can be configured to use others as well1. Containerd manages the complete container lifecycle of its host system, from image transfer and storage to containerexecution and supervision1. It supports the standards established by the Open Container Initiative (OCI)1. Containerd does not require the Docker engine and Docker CLI to be installed, as it can be used independently or with other container platforms2. Containerd is not a text file format, nor does it run in each Docker container or provide DHCP client functionality. Containerd is not the initial process run at the start of any Docker container, as that is the role of the container runtime, such as Runc3. References: 1 (search for “containerd”), 2 (search for “Containerd is an open source”), 3 (search for “It uses rune to start containers”).

The lxc-attach command allows the user to start a new process within a running LXC container12. It takes the name of the container as an argument and optionally a command to execute inside the container. If no command is specified, it creates a new shell inside the container1. For example, to list all the files in the home directory of a container named myContainer, one can use:

lxc-attach -n myContainer – ls -lh /home

References:

• 1: Executing a command inside a running LXC - Unix & Linux Stack Exchange

The CPU architecture of a QEMU virtual machine is independent of the host system’s architecture. QEMU can emulate many CPU architectures, including x86, ARM, Alpha, and SPARC, regardless of the host system’s architecture1. This allows QEMU to run guest operating systems that are not compatible with the host system’s hardware. Therefore, option A is correct. QEMU virtual machines support multiple virtual CPUs in order to run SMP systems. QEMU uses the concept of virtual CPUs (vCPUs) to map the virtual machines to physical CPUs. Each vCPU is a thread that runs on a physical CPU core. QEMU allows the user to specify the number of vCPUs and the CPU model for each virtual machine. QEMU can run SMP systems with multiple vCPUs, as well as single-processor systems with one vCPU2. Therefore, option E is also correct. The other options are incorrect because they do not describe the CPU of a QEMU virtual machine. Option B is wrong because QEMU virtual machines can have more than one CPU with more than one core. Option C is wrong because QEMU does not require a dedicated physical CPU core for each virtual machine. QEMU can share the physical CPU cores among multiple virtual machines, depending on the load and the scheduling policy. Option D is wrong because QEMU does not use the term CPU, but vCPU, to refer to the virtual machines’ processors. References:

• QEMU vs VirtualBox: What’s the difference? - LinuxConfig.org
• QEMU / KVM CPU model configuration — QEMU documentation
• Introduction — QEMU documentation
• Qemu/KVM Virtual Machines - Proxmox Virtual Environment

The subcommand of virsh that opens the XML configuration of a virtual network in an editor in order to make changes to that configuration is net-edit1. This subcommand takes the name or UUID of the network as a parameter and opens the network XML file in the default editor, which is specified by the $EDITOR shell variable1. The changes made to the network configuration are applied immediately after saving and exiting the editor1.

References:

• 1: net-edit - libvirt.

Cloud-init is a tool that allows users to customize the configuration and behavior of cloud instances during the boot process. Cloud-init can process different kinds of data that are passed to the instance via user-data, which is a mechanism provided by various cloud providers to inject data into the instance. Among the kinds of data that cloud-init can process directly from user-data are:

• Shell scripts to execute: Cloud-init can execute user-data that is formatted as a shell script, starting with the #!/bin/sh or #!/bin/bash shebang. The script can contain any commands that are valid in the shell environment of the instance. The script is executed as the root user during the boot process12.
• Lists of URLs to import: Cloud-init can import user-data that is formatted as a list of URLs, separated by newlines. The URLs can point to any valid data source that cloud-init supports, such as shell scripts, cloud-config files, or include files. The URLs are fetched and processed by cloud-init in the order they appear in the list13.
• cloud-config declarations in YAML: Cloud-init can process user-data that is formatted as a cloud-config file, which is a YAML document that contains declarations for various cloud-init modules. The cloud-config file can specify various aspects of the instance configuration, such as hostname, users, packages, commands, services, and more. The cloud-config file must start with the #cloud-config header14.

The other kinds of data listed in the question are not directly processed by cloud-init from user-data. They are either not supported, not recommended, or require additional steps to be processed. These kinds of data are:

• ISO images to boot from: Cloud-init does not support booting from ISO images that are passed as user-data. ISO images are typically used to install an operating system on a physical or virtual machine, not to customize an existing cloud instance. To boot from an ISO image, the user would need to attach it as a secondary disk to the instance and configure the boot order accordingly5.
• Base64-encoded binary files to execute: Cloud-init does not recommend passing binary files as user-data, as they may not be compatible with the instance’s architecture or operating system. Base64-encoding does not change this fact, as it only converts the binary data into ASCII characters. To execute a binary file, the user would need to decode it and make it executable on the instance6.

References:

• User-Data Formats — cloud-init 22.1 documentation
• User-Data Scripts
• Include File
• Cloud Config
• How to Boot From ISO Image File Directly in Windows
• How to run a binary file as a command in the terminal?.

• Both Vagrant and Docker can share directories from the host file system to a guest. This allows the guest to access files and folders from the host without copying them. Vagrant uses the config.vm.synced_folder option in the Vagrantfile to specify the shared folders1. Docker uses the -v or --volume flag in the docker run command to mount a host directory as a data volume in the container2.
• Both Vagrant and Docker can download required base images. Base images are the starting point for creating a guest environment. Vagrant uses the config.vm.box option in the Vagrantfile to specify the base image to use1. Docker uses the FROM instruction in the Dockerfile to specify the base image to use2. Both Vagrant and Docker can download base images from public repositories or local sources.
• Both Vagrant and Docker can apply changes to a base image. Changes are modifications or additions to the base image that customize the guest environment. Vagrant uses provisioners to run scripts or commands on the guest after it is booted1. Docker uses instructions in the Dockerfile to execute commands on the baseimage and create a new image2. Both Vagrant and Docker can save the changes to a new image or discard them after the guest is destroyed.
• Vagrant and Docker differ in how they start system images. Vagrant starts system images as virtual machines by default, using a provider such as VirtualBox, VMware, or Hyper-V1. Docker starts system images as containers by default, using the native containerization functionality on macOS, Linux, and Windows2. Containers are generally more lightweight and faster than virtual machines, but less secure and flexible. References: 1: Vagrant vs. Docker | Vagrant | HashiCorp Developer 2: Vagrant vs Docker: Which Is Right for You? (Could Be Both) - Kinsta® Web Development Tools

IaaS is a type of cloud computing service that offers essential compute, storage, and networking resources on demand, on a pay-as-you-go basis. IaaS is one of the four types of cloud services, along with software as a service (SaaS), platform as a service (PaaS), and serverless12. IaaS eliminates the need for enterprises to procure, configure, or manage infrastructure themselves, and they only pay for what they use23. Some examples of IaaS providers are Microsoft Azure, Google Cloud, and Amazon Web Services.

 A Pod in Kubernetes is a collection of one or more containers that share the same network and storage resources, and a specification for how to run the containers. A Pod is the smallest unit of workload Kubernetes can run, meaning that it cannot be divided into smaller units. Therefore, option C is correct. All containers of a Pod run on the same node, which is the smallest unit of computing hardware in Kubernetes. A node is a physical or virtual machine that hosts one or more Pods. Therefore, option A is also correct. Pods are not always created automatically and cannot be explicitly configured. Pods can be created manually using YAML or JSON files, or using commands like kubectl run or kubectl create. Pods can also be created automatically by higher-level controllers, such as Deployment, ReplicaSet, or StatefulSet. Therefore, option B is incorrect. When a Pod fails, Kubernetes does not restart the Pod on another node by default. Pods are ephemeral by nature, meaning that they can be terminated or deleted at any time. If a Pod is managed by a controller, the controller will create a new Pod to replace the failed one, but it may not be on the same node. Therefore, option D is incorrect. systemd is not used to manage individual Pods on the Kubernetes nodes. systemd is a system and service manager for Linux operating systems that can start and stop services, such as docker or kubelet. However, systemd does not interact with Podsdirectly. Pods are managed by the kubelet service, which is an agent that runs on each node and communicates with the Kubernetes control plane. Therefore, option E is incorrect. References:

• Pods | Kubernetes
• What is a Kubernetes pod? - Red Hat
• What’s the difference between a pod, a cluster, and a container?
• What are Kubernetes Pods? | VMware Glossary
• Kubernetes Node Vs. Pod Vs.Cluster: Key Differences - CloudZero

The WORKDIR instruction sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY and ADD instructions that follow it in the Dockerfile1. The RUN instruction executes commands in a new layer on top of the current image and commits the results2. The RUN cd command does not change the working directory for the next RUN instruction, because each RUN command runs in a new shell and a new environment3. Therefore, the file test is created in the root directory (/) of the container image, not in the /tmp directory. References:

• Dockerfile reference: WORKDIR
• Dockerfile reference: RUN
• difference between RUN cd and WORKDIR in Dockerfile

 The Linux kernel module that must be loaded in order to use QEMU with hardware virtualization extensions is KVM (Kernel-based Virtual Machine). KVM is a full virtualization solution that allows a user space program (such as QEMU) to utilize the hardware virtualization features of various processors (such as Intel VT or AMD-V). KVM consists of a loadable kernel module, kvm.ko, that provides the core virtualization infrastructure and a processor specific module, kvm-intel.ko or kvm-amd.ko. KVM must be loaded into the kernel of the host system in order to use the virtualization extensions of the host system’s CPU. This enables QEMU to run multiple virtual machines with unmodified Linux or Windows images, each with private virtualized hardware. KVM is integrated with QEMU, so there is no need to load it into the kernel of each virtual machine or the first virtual machine. KVM also does not require paravirtualization, which is a technique that modifies the guest operating system to communicate directly with the hypervisor, bypassing the emulation layer. References:

• Features/KVM - QEMU
• Kernel-based Virtual Machine
• KVM virtualization on Red Hat Enterprise Linux 8 (2023)

 LXC and Docker are both container technologies that use Linux kernel features to create isolated environments for running applications. The main mechanisms that they use are:

• Linux Capabilities: These are a set of privileges that can be assigned to processes to limit their access to certain system resources or operations. For example, a process with the CAP_NET_ADMIN capability can perform network administration tasks, such as creating or deleting network interfaces. Linux capabilities allow containers to run with reduced privileges, enhancing their security and isolation.
• Kernel Namespaces: These are a way of creating separate views of the system resources for different processes. For example, a process in a mount namespace can have a different file system layout than the host or other namespaces. Kernel namespaces allow containers to have their own network interfaces, process IDs, user IDs, and other resources, without interfering with the host or other containers.
• Control Groups: These are a way of grouping processes and applying resource limits and accounting to them. For example, a control group can limit the amount of CPU, memory, disk I/O, or network bandwidth that a process or a group of processes can use. Control groups allow containers to have a fair share of the system resources and prevent them from exhausting the host resources.

POSIX ACLs and file system permissions are not mechanisms used by LXC and Docker to create containers. They are methods of controlling the access to files and directories on a file system, which can be applied to any process, not just containers.

References:

• LXC vs Docker: Which Container Platform Is Right for You?
• LXC vs Docker: Why Docker is Better in 2023 | UpGuard
• What is the Difference Between LXC, LXD and Docker Containers
• lxc - Which container implementation docker is using - Unix & Linux Stack Exchange

Cloud-init is a tool that processes configurations and runs through five stages during the initial boot of Linux VMs in a cloud. It allows users to customize a Linux VM as it boots for the first time, by applying user data to the instance. User data can include scripts, commands, packages, files, users, groups, SSH keys, and more. Cloud-init can also interact with various cloud platforms and services, such as Azure, AWS, OpenStack, and others. The purpose of cloud-init is to prepare the generic image of an laaS instance to fit a specific instance’s configuration, such as hostname, network, security, and application settings. References:

• Cloud-init - The standard for customising cloud instances
• Understanding cloud-init - Azure Virtual Machines
• Tutorial - Customize a Linux VM with cloud-init in Azure - Azure Virtual Machines

Libvirt supports creating and managing various types of virtual networks that can be used to connect virtual machines to each other or to the external network. One of the common types of virtual networks is the NAT-based network, which uses network address translation (NAT) to allow virtual machines to access the outside world through the host’s network interface. By default, libvirt creates a NAT-based network called ‘default’ when it is installed and started. This network appears as a standard Linux bridge device on the host system, named virbr0. The bridge device has an IP address of 192.168.122.1/24 and acts as a gateway and a DHCP server for the virtual machines connected to it. The bridge device also has iptables rules to forward and masquerade the traffic from and to the virtual machines. The virtual machines connected to the ‘default’ network have their own IP addresses in the 192.168.122.0/24 range and their own MAC addresses generated by libvirt. The virtual machines can communicate with each other, with the host, and with the external network through the bridge device and the NAT mechanism12.

The other statements in the question are false regarding networking with libvirt. Libvirt’s network functionality is not limited to connecting virtual machines to a physical network interface of the host system. Libvirt can also create isolated networks that do not have any connection to the outside world, or routed networks that use static routes to connect virtual machines to the external network without NAT3. Libvirt does not assign the same MAC address to all virtual machines and isolate their network interfaces at the link layer. Libvirt assigns a unique MAC address to each virtual machine and allows them to communicate with each other at the network layer4. Libvirt does not require a dedicated network interface that may not be used by the host system. Libvirt can share the host’s network interface with the virtual machines using NAT or bridging, or it can pass a physical network interface to a virtual machine exclusively using PCI passthrough5. Libvirt does not support exactly one virtual network and connect all virtual machines to it. Libvirt supports creating and managing multiple virtual networks with different names and configurations, and connecting virtual machines to different networks according to their needs6. References:

• libvirt: Virtual Networking
• libvirt: NAT forwarding (aka “virtual networks”)
• libvirt: Routed network
• libvirt: MAC address
• libvirt: PCI passthrough of host network devices
• [libvirt: Network XML format]

 Nested page table extensions, such as Intel Extended Page Table (EPT) or AMD Rapid Virtualization Indexing (RVI), are hardware features that facilitate the virtualization of memory. They allow the CPU to perform the translation of guest virtual addresses to host physical addresses in a single step, without the need for software-managed shadow page tables. This reduces the overhead and complexity of memory management for virtual machines, and improves their performance and isolation. Nested page table extensions do not directly affect the virtualization of other hardware components, such as network interfaces, host bus adapters, hard disks, or IO cache.

References:

• Second Level Address Translation - Wikipedia
• c - What is use of extended page table? - Stack Overflow
• Hypervisor From Scratch – Part 4: Address Translation Using Extended …

 Container-based virtualization is a method of operating system-level virtualization that allows multiple isolated user spaces (containers) to run on the same host system1. Each container shares the same operating system kernel as the host, but has its own file system, libraries, and processes2. Therefore, the statements A and C are false, as containers do not run their own kernels or rely on hardware support from the CPU. The statement E is also false, as Linux does support container-based virtualization through various technologies, such as cgroups, namespaces, LXC, Docker, etc12. The statement B is true, as different containers may use different distributions of the same operating system, such as Debian, Ubuntu, Fedora, etc., as long as they are compatible with the host kernel3. The statement D is also true, as all containers run within the operating system kernel of the host system, which provides isolation and resource management for them12. References:

• 1: Containerization (computing) - Wikipedia.
• 2: What are containers? | Google Cloud.
• 3: What is Container-Based Virtualization? - StackHowTo.

 The command vagrant init is used to initialize the current directory to be a Vagrant environment by creating an initial Vagrantfile if one does not already exist1. The Vagrantfile contains the configuration settings for the Vagrant box, such as the box name, box URL, network settings, synced folders, provisioners, etc. The command vagrant init does not execute any provisioning tool, start any box, install Vagrant on a Linux host, or download any box. Those actions are performed by other Vagrant commands, such as vagrant provision, vagrant up, vagrant install, and vagrant box add, respectively. References:

• 1: vagrant init - Command-Line Interface | Vagrant | HashiCorp Developer

The file procs in a cgroup directory contains the list of processes belonging to this cgroup. Each line in the file shows the PID of a process that is a member of the cgroup. A process can be moved to a cgroup by writing its PID into the cgroup’s procs file. For example, to move the process with PID 24982 to the cgroup cg1, the following command can be used: echo 24982 > /sys/fs/cgroup/cg1/procs1. The file procs is different from the file tasks, which lists the threads belonging to the cgroup. The file procs can be used to move all threads in a thread group at once, while the file tasks can be used to move individual threads2. References:

• Creating and organizing cgroups · cgroup2 - GitHub Pages
• Control Groups — The Linux Kernel documentation

Sysprep is a tool that removes all your personal account and security information, and then prepares the machine to be used as an image. It is supported by Windows and some Linux distributions. It can also remove drivers and other machine-specific settings. Sysprep is required when creating a managed image outside of a gallery in Azure