Virtualization & Container Management Flashcards

What does the Docker flag '--privileged' do when starting a container?

Answer: Grants the container near-full host kernel access

--privileged disables most container security restrictions, giving the container almost the same access to the host kernel as a root process.

Which cgroup subsystem limits the amount of RAM a container or VM can use?

Answer: memory

The memory cgroup subsystem enforces RAM limits and can trigger OOM killing when a process group exceeds its allocation.

What is the function of 'docker inspect' on a running container?

Answer: Display low-level JSON configuration and state details

'docker inspect' returns a detailed JSON object with a container's configuration, networking, mounts, and current state.

In libvirt XML domain configuration, which element defines the amount of memory allocated to a VM?

Answer:

The element in libvirt domain XML specifies the maximum memory allocation for the virtual machine.

What happens when you run 'docker commit' on a container?

Answer: Creates a new image from the container's current state

'docker commit' captures the container's current filesystem state and creates a new image layer from it.

Which Linux feature allows containers to have their own hostname independently of the host?

Answer: UTS namespace

UTS (UNIX Time-sharing System) namespaces isolate hostname and NIS domain name, giving each container its own identity.

What is the role of the Docker daemon (dockerd)?

Answer: Manages container lifecycle, images, networks, and volumes on the host

dockerd is the background server process that handles all container operations and exposes a REST API consumed by the Docker CLI.