305-300 Exam Dumps : LPIC-3: Virtualization and Containerization - Exam 305, version 3.0

 LXC and Docker are both container technologies that use Linux kernel features to create isolated environments for running applications. The main mechanisms that they use are:

• Linux Capabilities: These are a set of privileges that can be assigned to processes to limit their access to certain system resources or operations. For example, a process with the CAP_NET_ADMIN capability can perform network administration tasks, such as creating or deleting network interfaces. Linux capabilities allow containers to run with reduced privileges, enhancing their security and isolation.
• Kernel Namespaces: These are a way of creating separate views of the system resources for different processes. For example, a process in a mount namespace can have a different file system layout than the host or other namespaces. Kernel namespaces allow containers to have their own network interfaces, process IDs, user IDs, and other resources, without interfering with the host or other containers.
• Control Groups: These are a way of grouping processes and applying resource limits and accounting to them. For example, a control group can limit the amount of CPU, memory, disk I/O, or network bandwidth that a process or a group of processes can use. Control groups allow containers to have a fair share of the system resources and prevent them from exhausting the host resources.

POSIX ACLs and file system permissions are not mechanisms used by LXC and Docker to create containers. They are methods of controlling the access to files and directories on a file system, which can be applied to any process, not just containers.

References:

• LXC vs Docker: Which Container Platform Is Right for You?
• LXC vs Docker: Why Docker is Better in 2023 | UpGuard
• What is the Difference Between LXC, LXD and Docker Containers
• lxc - Which container implementation docker is using - Unix & Linux Stack Exchange

 The Linux kernel module that must be loaded in order to use QEMU with hardware virtualization extensions is KVM (Kernel-based Virtual Machine). KVM is a full virtualization solution that allows a user space program (such as QEMU) to utilize the hardware virtualization features of various processors (such as Intel VT or AMD-V). KVM consists of a loadable kernel module, kvm.ko, that provides the core virtualization infrastructure and a processor specific module, kvm-intel.ko or kvm-amd.ko. KVM must be loaded into the kernel of the host system in order to use the virtualization extensions of the host system’s CPU. This enables QEMU to run multiple virtual machines with unmodified Linux or Windows images, each with private virtualized hardware. KVM is integrated with QEMU, so there is no need to load it into the kernel of each virtual machine or the first virtual machine. KVM also does not require paravirtualization, which is a technique that modifies the guest operating system to communicate directly with the hypervisor, bypassing the emulation layer. References:

• Features/KVM - QEMU
• Kernel-based Virtual Machine
• KVM virtualization on Red Hat Enterprise Linux 8 (2023)

The subcommand of virsh that opens the XML configuration of a virtual network in an editor in order to make changes to that configuration is net-edit1. This subcommand takes the name or UUID of the network as a parameter and opens the network XML file in the default editor, which is specified by the $EDITOR shell variable1. The changes made to the network configuration are applied immediately after saving and exiting the editor1.

References:

• 1: net-edit - libvirt.