305-300 LPIC-3: Virtualization and Containerization - Exam 305, version 3.0 Questions and Answers

Cloud-init is a tool that allows users to customize the configuration and behavior of cloud instances during the boot process. Cloud-init can process different kinds of data that are passed to the instance via user-data, which is a mechanism provided by various cloud providers to inject data into the instance. Among the kinds of data that cloud-init can process directly from user-data are:

• Shell scripts to execute: Cloud-init can execute user-data that is formatted as a shell script, starting with the #!/bin/sh or #!/bin/bash shebang. The script can contain any commands that are valid in the shell environment of the instance. The script is executed as the root user during the boot process12.
• Lists of URLs to import: Cloud-init can import user-data that is formatted as a list of URLs, separated by newlines. The URLs can point to any valid data source that cloud-init supports, such as shell scripts, cloud-config files, or include files. The URLs are fetched and processed by cloud-init in the order they appear in the list13.
• cloud-config declarations in YAML: Cloud-init can process user-data that is formatted as a cloud-config file, which is a YAML document that contains declarations for various cloud-init modules. The cloud-config file can specify various aspects of the instance configuration, such as hostname, users, packages, commands, services, and more. The cloud-config file must start with the #cloud-config header14.

The other kinds of data listed in the question are not directly processed by cloud-init from user-data. They are either not supported, not recommended, or require additional steps to be processed. These kinds of data are:

• ISO images to boot from: Cloud-init does not support booting from ISO images that are passed as user-data. ISO images are typically used to install an operating system on a physical or virtual machine, not to customize an existing cloud instance. To boot from an ISO image, the user would need to attach it as a secondary disk to the instance and configure the boot order accordingly5.
• Base64-encoded binary files to execute: Cloud-init does not recommend passing binary files as user-data, as they may not be compatible with the instance’s architecture or operating system. Base64-encoding does not change this fact, as it only converts the binary data into ASCII characters. To execute a binary file, the user would need to decode it and make it executable on the instance6.

References:

• User-Data Formats — cloud-init 22.1 documentation
• User-Data Scripts
• Include File
• Cloud Config
• How to Boot From ISO Image File Directly in Windows
• How to run a binary file as a command in the terminal?.

A hypervisor is a software that creates and runs virtual machines (VMs) by separating the operating system and resources from the physical hardware. One of the main tasks of a hypervisor is to map the resources of VMs to the resources of the host system, such as CPU, memory, disk, and network. This allows the hypervisor to allocate and manage the resources among multiple VMs and ensure that they run efficiently and independently123. Another important task of a hypervisor is to isolate the VMs and prevent unauthorized access to resources of other VMs. This ensures the security and privacy of the VMs and their data, as well as the stability and performance of the host system. The hypervisor can use various techniques to isolate the VMs, such as virtual LANs, firewalls, encryption, and access control145.

The other tasks listed are not part of a hypervisor’s responsibility, but rather of the guest operating system or the application running inside the VM. A hypervisor does not create filesystems during the installation of new VMs, as this is done by the installer of the guest operating system6. A hypervisor does not provide host-wide unique PIDs to the processes running inside the VMs, as this is done by the kernel of the guest operating system7. A hypervisor does not manage authentication to network services running inside a VM, as this is done by the network service itself or by a directory service such as LDAP or Active Directory8. References: 1 (search for “What is a hypervisor?”), 2 (search for “How does a hypervisor work?”), 3 (search for “The hypervisor gives each virtual machine the resources that have been allocated”), 4 (search for “Benefits ofhypervisors”), 5 (search for “Isolate the virtual machines and prevent unauthorized access”), 6 (search for “Create filesystems during the installation of new virtual machine quest operating systems”), 7 (search for “Provide host-wide unique PIDs to the processes running inside the virtual machines”), 8 (search for “Manage authentication to network services running inside a virtual machine”).

The firmware attribute of the element in a libvirt domain definition specifies the type of firmware used to boot the virtual machine. The valid values for this attribute are efi and bios, which correspond to the Extensible Firmware Interface (EFI) and the Basic Input/Output System (BIOS) respectively. EFI is a newer standard that supports more features and security than BIOS, such as Secure Boot and faster boot times. BIOS is an older standard that is widely compatible and supported by most hypervisors and operating systems. The other values, scsi, virtio, and pcie, are not related to firmware, but to different types of devices or drivers that can be used in a virtual machine. References: 1 (search for firmware enum)

The lxc-attach command allows the user to start a new process within a running LXC container12. It takes the name of the container as an argument and optionally a command to execute inside the container. If no command is specified, it creates a new shell inside the container1. For example, to list all the files in the home directory of a container named myContainer, one can use:

lxc-attach -n myContainer – ls -lh /home

References:

• 1: Executing a command inside a running LXC - Unix & Linux Stack Exchange

• The purpose of the packer inspect subcommand is to display an overview of the configuration contained in a Packer template1. A Packer template is a file that defines the various components a Packer build requires, such as variables, sources, provisioners, and post-processors2. The packer inspect subcommand can help you quickly learn about a template without having to dive into the HCL (HashiCorp Configuration Language) itself1. The subcommand will tell you things like what variables a template accepts, the sources it defines, the provisioners it defines and the order they’ll run, and more1.
• The other options are not correct because:

• Both Vagrant and Docker can share directories from the host file system to a guest. This allows the guest to access files and folders from the host without copying them. Vagrant uses the config.vm.synced_folder option in the Vagrantfile to specify the shared folders1. Docker uses the -v or --volume flag in the docker run command to mount a host directory as a data volume in the container2.
• Both Vagrant and Docker can download required base images. Base images are the starting point for creating a guest environment. Vagrant uses the config.vm.box option in the Vagrantfile to specify the base image to use1. Docker uses the FROM instruction in the Dockerfile to specify the base image to use2. Both Vagrant and Docker can download base images from public repositories or local sources.
• Both Vagrant and Docker can apply changes to a base image. Changes are modifications or additions to the base image that customize the guest environment. Vagrant uses provisioners to run scripts or commands on the guest after it is booted1. Docker uses instructions in the Dockerfile to execute commands on the baseimage and create a new image2. Both Vagrant and Docker can save the changes to a new image or discard them after the guest is destroyed.
• Vagrant and Docker differ in how they start system images. Vagrant starts system images as virtual machines by default, using a provider such as VirtualBox, VMware, or Hyper-V1. Docker starts system images as containers by default, using the native containerization functionality on macOS, Linux, and Windows2. Containers are generally more lightweight and faster than virtual machines, but less secure and flexible. References: 1: Vagrant vs. Docker | Vagrant | HashiCorp Developer 2: Vagrant vs Docker: Which Is Right for You? (Could Be Both) - Kinsta® Web Development Tools

The ENTRYPOINT instruction in a Dockerfile specifies the default command to run when a container is started from the image. The ENTRYPOINT instruction can be written in two forms: exec form and shell form. The exec form uses a JSON array to specify the command and its arguments, such as [ “executable”, “param1”, “param2” ]. The shell form uses a single string to specify the command and its arguments, such as “executable param1 param2”. The shell form is converted to the exec form by adding /bin/sh -c to the beginning of the command. Therefore, the following statements in a Dockerfile are equivalent and will lead to a container that outputs hello world:

ENTRYPOINT [ “echo hello world” ] ENTRYPOINT [ “/bin/sh”, “-c”, “echo hello world” ] ENTRYPOINT “echo hello world” ENTRYPOINT [ “echo”, “hello”, “world” ] ENTRYPOINT [ “/bin/sh”, “-c”, “echo”, “hello”, “world” ] ENTRYPOINT “echo hello world”

The other statements in the question are invalid or incorrect. The statement A. ENTRYPOINT “echo Hello World” is invalid because it uses double quotes to enclose the entire command, which is not allowed in the shell form. The statement D. ENTRYPOINT echo Hello World is incorrect because it does not use quotes to enclose the command, which is required in the shell form. The statement E. ENTRYPOINT “echo”, “Hello”, “World” is invalid because it uses double quotes to separate the command and its arguments, which is not allowed in the exec form. References:

• Dockerfile reference | Docker Docs
• Using the Dockerfile ENTRYPOINT and CMD Instructions - ATA Learning
• Difference Between run, cmd and entrypoint in a Dockerfile

The CPU flag that indicates the hardware virtualization capability on an AMD CPU is SVM. SVM stands for Secure Virtual Machine, and it is a feature of AMD processors that enables the CPU to run virtual machines with hardware assistance. SVM is also known as AMD-V, which is AMD’s brand name for its virtualization technology. SVM allows the CPU to support a hypervisor, which is a software layer that creates and manages virtual machines. A hypervisor can run multiple virtual machines on a single physical machine, each with its own operating system and applications. SVM improves the performance and security of virtual machines by allowing the CPU to directly execute privileged instructions and handle memory access, instead of relying on software emulation or binary translation. SVM also provides nested virtualization, which is the ability to run avirtual machine inside another virtual machine. To use SVM, the CPU must support it and the BIOS must enable it. The user can check if the CPU supports SVM by looking for the svm flag in the /proc/cpuinfo file or by using the lscpu command. The user can also use the virt-host-validate command to verify if the CPU and the BIOS are properly configured for hardware virtualization123. References:

• How to check if CPU supports hardware virtualization (VT technology)1
• Processor support - KVM3
• How to Enable Virtualization in BIOS for Intel and AMD4

Sparse images are a type of virtual disk images that grow in size as data is written to them, but do not shrink when data is deleted from them. Sparse images may consume an amount of space different from their nominal size, which is the maximum size that the image can grow to. For example, a sparse image with a nominal size of 100 GB may only take up 20 GB of physical storage if only 20 GB of data is written to it. Sparse images allocate backend storage at the first usage of a block, which means that the physical storage is only used when the virtual machine actually writes data to a block. This can save storage space and improve performance, as the image does not need to be pre-allocated or zeroed out.

Sparse images are not automatically shrunk when files within the image are deleted, because the virtual machine does not inform the host system about the freed blocks. To reclaim the unused space, a special tool such as virt-sparsify1 or qemu-img2 must be used to compact the image. Sparse images can be used with both full virtualization and paravirtualization, as the type of virtualization does not affect the format of the disk image. Sparse images are not automatically resized when their maximum capacity is about to be exceeded, because this would require changing the partition table and the filesystem of the image, which is not a trivial task. To resize a sparse image, a tool such as virt-resize3 or qemu-img2 must be used to increase the nominal size and the filesystem size of the image. References: 1 (search for “virt-sparsify”), 2 (search for “qemu-img”), 3 (search for “virt-resize”).

 LXC and Docker are both container technologies that use Linux kernel features to create isolated environments for running applications. The main mechanisms that they use are:

• Linux Capabilities: These are a set of privileges that can be assigned to processes to limit their access to certain system resources or operations. For example, a process with the CAP_NET_ADMIN capability can perform network administration tasks, such as creating or deleting network interfaces. Linux capabilities allow containers to run with reduced privileges, enhancing their security and isolation.
• Kernel Namespaces: These are a way of creating separate views of the system resources for different processes. For example, a process in a mount namespace can have a different file system layout than the host or other namespaces. Kernel namespaces allow containers to have their own network interfaces, process IDs, user IDs, and other resources, without interfering with the host or other containers.
• Control Groups: These are a way of grouping processes and applying resource limits and accounting to them. For example, a control group can limit the amount of CPU, memory, disk I/O, or network bandwidth that a process or a group of processes can use. Control groups allow containers to have a fair share of the system resources and prevent them from exhausting the host resources.

POSIX ACLs and file system permissions are not mechanisms used by LXC and Docker to create containers. They are methods of controlling the access to files and directories on a file system, which can be applied to any process, not just containers.

References:

• LXC vs Docker: Which Container Platform Is Right for You?
• LXC vs Docker: Why Docker is Better in 2023 | UpGuard
• What is the Difference Between LXC, LXD and Docker Containers
• lxc - Which container implementation docker is using - Unix & Linux Stack Exchange

The correct command to boot a QEMU virtual machine using hardware virtualization extensions is qemu -accel kvm -drive file-debian.img -cdrom debian.iso -m 1024 -boot d. This command uses the -accel option to specify the hardware accelerator to use, which in this case is kvm. KVM is a full virtualization solution for Linux on x86 hardware containing virtualization extensions (Intel VT or AMD-V)1. The -drive option specifies the disk image file to use, which in this case is debian.img. The -cdrom option specifies the ISO image file to use as a CD-ROM, which in this case is debian.iso. The -m option specifies the amount of memory to allocate to the virtualmachine, which in this case is 1024 MB. The -boot option specifies the boot order, which in this case is d, meaning to boot from the CD-ROM first. References:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/virtualization_deployment_and_administration_guide/sect-troubleshooting-enabling_intel_vt_x_and_amd_v_virtualization_hardware_extensions_in_bios

https://fedoraproject.org/wiki/Virtualization

Docker stack is a command that allows users to deploy and manage a stack of services on a Docker Swarm cluster. A stack is a group of interrelated services that share dependencies and can be orchestrated and scaled together. A stack is typically defined by a Compose file, which is a YAML file that describes the services, networks, volumes, and other resources of the stack. To use docker stack to run a Compose file on a Swarm, the user must first create and initialize a Swarm cluster, which is a group of machines (nodes) that are running the Docker Engine and are joined into a single entity. The Swarm cluster has one or more managers, which are responsible for maintaining the cluster state and orchestrating the services, and one or more workers, which are the nodes that run the services.

When the user runs docker stack deploy with a Compose file, the command parses the file and creates the services as specified. However, docker stack does not build or upload the images referenced in the Compose file to any registry. Instead, it instructs the Swarm nodes to pull the images from a registry, which can be the public Docker Hub or a private registry. The user must ensure that the images are available in the registry before deploying the stack, otherwise the deployment will fail. The user can use docker build and docker push commands to create and upload the images to the registry, or use an automated build service such as Docker Hub or GitHub Actions. The user must also make sure that the image names and tags in the Compose file match the ones in the registry, and that the Swarm nodes have access to the registry if it is private. By pulling the images from a registry, docker stack ensures that the Swarm nodes have the same and latest version of the images, and that the images are distributed across the cluster in an efficient way.

The other options are not correct. Docker stack does not build the images locally or on the Swarm nodes, nor does it copy or transfer the images to the Swarm nodes. Dockerstack also does not pass the images to the Swarm master, as this would create a bottleneck and a single point of failure. Docker stack relies on the registry as the source of truth for the images, and delegates the image pulling to the Swarm nodes. References:

• Deploy a stack to a swarm | Docker Docs1
• docker stack deploy | Docker Docs2
• docker build | Docker Docs3
• docker push | Docker Docs4

QEMU can provide some network services in a user network, which is a mode of networking that does not require any administrator privilege to run. The user network uses the SLIRP TCP/IP emulator to create a virtual NAT’ted subnet, with a DHCP server started by QEMU that gives out IP addresses to the guest machines and puts the host on 10.0.2.21. QEMU can also provide a TFTP server in the user network, which can be used to boot the guest machines from a network image. The TFTP server can be configured with the -tftp option2. QEMU does not provide BGP, CIFS, or AppleTalk services in the user network. BGP is a routing protocol that is used to exchange routing information between autonomous systems on the Internet3. CIFS is a file-sharing protocol that is used to access files and printers on a network4. AppleTalk is a deprecated network protocol suite that was used by Apple devices5. These services require more advanced networking features than the user network can offer, such as bridging, routing, or tunneling.

References:

• Documentation/Networking - QEMU
• QEMU/Networking - Wikibooks, open books for an open world
• Border Gateway Protocol - Wikipedia
• Common Internet File System - Wikipedia
• AppleTalk - Wikipedia

Libvirt uses XML files to store configuration data for objects in the libvirt API, such as domains, networks, storage, etc. This allows for ease of extension in future releases and validation of documents prior to usage. Libvirt does not use any of the other file formats listed in the question. References:

• libvirt: XML Format
• LPIC-3 Virtualization and Containerization: Topic 305.1: Virtualization Concepts and Theory

LXC implements system containers, which are a type of operating-system-level virtualization. System containers allow running multiple isolated Linux systems on a single Linux control host, using a single Linux kernel. System containers share the same kernel with the host and each other, but have their own file system, libraries, andprocesses. System containers are different from application containers, which are designed to run a single application or service in an isolated environment. Application containers are usually smaller and more portable than system containers, but also more dependent on the host kernel and libraries. Hardware containers, CPU emulation, and paravirtualization are not related to LXC, as they are different kinds of virtualization methods that involve hardware abstraction, instruction translation, or modification of the guest operating system. References:

• 1: LXC - Wikipedia
• 2: Linux Virtualization : Linux Containers (lxc) - GeeksforGeeks
• 3: Features - Proxmox Virtual Environment