LPIC-3 Virtualization and Containerization cheat sheet

KVM is a Linux kernel module exposing Intel VT-x or AMD-V; /dev/kvm is the character device QEMU opens to run guest vCPUs, while QEMU emulates disks, NICs and other devices.

libvirtd is the management daemon; virsh, virt-install, virt-manager and OpenStack all speak the libvirt API, which drives the qemu, xen and lxc drivers.

virsh define writes persistent domain XML, virsh create starts a transient domain from XML, virsh destroy is a hard power-off, and virsh undefine removes the definition.

qcow2 supports thin provisioning, internal snapshots and backing files; raw images have no metadata overhead but cannot take internal snapshots, and qemu-img info/convert inspects and converts formats.

libvirt's default network is NAT on virbr0 with 192.168.122.0/24 and dnsmasq DHCP/DNS; a bridged network is required when guests must be reachable from the physical LAN.

macvtap in bridge mode attaches a guest directly to a host NIC, but host and guest cannot communicate over that same interface; SR-IOV virtual functions bypass the virtual switch entirely.

Memory ballooning reclaims guest RAM when the virtio balloon inflates; KSM merges identical pages across VMs copy-on-write; hugepages must be reserved at boot and cannot be swapped.

Live migration requires libvirt connectivity on both hosts, compatible CPU features (or --unsafe), and either shared storage or --copy-storage-all/--copy-storage-inc for local disks.

Storage pools of type dir, logical, iscsi or rbd allocate volumes with virsh vol-create-as; snapshot-create-as --disk-only creates external disk snapshots, while internal snapshots live inside the qcow2 file.

Namespaces isolate PID, mount, network, IPC, UTS, user and cgroup views; cgroup v2 limits CPU, memory, pids and IO; a container is a namespaced, cgrouped process with a root filesystem.

OCI image-spec defines layers and config, runtime-spec defines config.json plus rootfs, and runc is the reference runtime driven by containerd or CRI-O.

Docker image layers are immutable and content-addressed; RUN, COPY and ADD create layers, while ENV, CMD, ENTRYPOINT, EXPOSE and WORKDIR only change image config metadata.

ENTRYPOINT fixes the executable and CMD supplies default arguments; docker run replaces CMD, and --entrypoint replaces ENTRYPOINT at runtime.

Named volumes live under /var/lib/docker/volumes and outlive containers; bind mounts reference an existing host path; tmpfs mounts are memory-only and vanish with the container.

overlay2 stacks read-only image layers as lowerdirs and the container layer as upperdir; it is the default storage driver on ext4/xfs and shares page cache between containers.

Rootless Docker and Podman run inside a user namespace mapping container UID 0 to an unprivileged host UID; /etc/subuid, /etc/subgid and newuidmap/newgidmap are required.

Podman is daemonless, supports pods, and generates systemd units with podman generate systemd; LXD/Incus manages unprivileged system containers that run a full init.

Hardening options: --cap-drop=ALL removes all capabilities, --security-opt no-new-privileges blocks setuid escalation, seccomp filters syscalls, and :z/:Z relabels SELinux contexts on volumes.

Control plane: kube-apiserver is the only component writing to etcd, etcd stores all cluster state, kube-scheduler binds pods to nodes, and kube-controller-manager runs controllers; nodes run kubelet (via CRI) and kube-proxy.

Service types: ClusterIP (default internal VIP), NodePort (30000-32767 on every node), LoadBalancer (cloud LB) and ExternalName (DNS CNAME); clusterIP: None creates a headless Service returning pod A records.

Deployments manage ReplicaSets with rolling updates bounded by maxSurge/maxUnavailable, and kubectl rollout undo --to-revision reverts; Helm packages the same manifests as charts (Chart.yaml, templates/, values.yaml) deployed with helm upgrade --install and reverted with helm rollback.

Probes: liveness restarts a failing container, readiness removes the pod from Service endpoints, and startup delays the other two until a slow application has booted.

Requests drive scheduling and QoS class; limits cap runtime usage, a container exceeding its memory limit is OOMKilled, and CPU overuse is throttled rather than killed.

StatefulSet pods get stable ordinal names and a volumeClaimTemplate per replica; DaemonSet runs one pod per eligible node; Job and CronJob run workloads to completion on a schedule.

Scheduling: taints (key=value:effect) repel pods unless a toleration matches, nodeSelector and nodeAffinity attract pods, podAntiAffinity spreads replicas, and a PVC binds to a PV through its StorageClass.

NetworkPolicy selects pods by label and denies traffic not explicitly allowed once any policy matches; enforcement requires a CNI plugin such as Calico or Cilium, and namespaces are otherwise flat.

RBAC: Role and RoleBinding are namespaced, ClusterRole and ClusterRoleBinding are cluster-scoped, and kubectl auth can-i --as verifies effective permissions for a user or ServiceAccount.