LPIC-3 Virtualization and Containerization flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

KVM

Linux kernel module that exposes Intel VT-x or AMD-V hardware virtualization extensions; /dev/kvm is the interface QEMU uses to execute guest vCPUs at near-native speed.

libvirt

Management API and daemon (libvirtd) abstracting KVM/QEMU, Xen and LXC; virsh, virt-manager and OpenStack drivers all communicate with it over a local socket or TLS.

qcow2

QEMU copy-on-write disk format supporting thin provisioning, internal snapshots and backing files; it grows on demand but is slower than raw because of metadata lookups.

virsh define vs create

define writes a persistent domain XML that survives host reboot; create starts a transient domain from XML whose definition disappears when the domain is destroyed.

libvirt default network

NAT network on virbr0 using 192.168.122.0/24 with dnsmasq providing DHCP and DNS; guests reach the internet, but inbound connections require explicit port forwarding.

macvtap

Guest NIC mode attaching a VM directly to a host interface without a bridge; the host and guest cannot exchange traffic over that same interface.

Memory ballooning

Virtio balloon driver lets the host reclaim unused guest RAM by inflating the balloon; it requires the driver in the guest and a memballoon device in the domain XML.

KSM

Kernel Samepage Merging scans memory and merges identical pages across virtual machines copy-on-write; enabled by writing 1 to /sys/kernel/mm/ksm/run.

Live migration

virsh migrate --live moves a running domain to another host; it needs libvirt connectivity on both sides, compatible CPU features, and shared storage or --copy-storage-all.

libvirt storage pool

Managed storage backend of type dir, logical (LVM), iscsi or rbd; volumes are allocated from it with virsh vol-create-as and attached to guests as disk devices.

Xen dom0

Privileged control domain in Xen that runs the driver domain and the xl toolstack; unprivileged domU guests are started by xl from configuration files.

Namespaces

Linux kernel feature isolating PID, mount, network, IPC, UTS, user and cgroup views; a container is a process placed in its own set of these namespaces.

cgroups v2

Unified kernel hierarchy accounting and limiting CPU, memory, IO and pids; the single-hierarchy design is required for rootless containers to enforce resource limits.

OCI runtime spec

Standard describing how to configure and run a container bundle of config.json plus rootfs; runc is the reference implementation used by containerd and CRI-O.

containerd

Daemon that pulls images, manages snapshots and supervises runc containers; Docker and Kubernetes through the CRI both use it as their runtime layer.

overlay2

Default Docker storage driver on modern distributions; it stacks read-only image layers as lowerdirs beneath a writable upperdir, giving fast copy-on-write and shared page cache.

ENTRYPOINT vs CMD

ENTRYPOINT sets the fixed executable; CMD supplies default arguments that docker run can override, and CMD is discarded entirely when ENTRYPOINT is replaced.

Docker named volume

Volume stored under /var/lib/docker/volumes with a lifecycle independent of containers; created with docker volume create and mounted using -v name:/path.

Rootless container

Runs the engine and containers inside a user namespace so container UID 0 maps to an unprivileged host UID; requires /etc/subuid, /etc/subgid and newuidmap.

Podman

Daemonless OCI container engine with a Docker-compatible CLI; it supports pods, runs rootless, and generates systemd units through podman generate systemd.

LXD

System container and VM manager exposing the LXD/Incus API; lxc launch images:ubuntu/22.04 c1 creates an unprivileged container running a full init.

Seccomp profile

Filters which syscalls a container may make; Docker applies a default profile blocking dangerous calls, and --security-opt seccomp=unconfined disables the filter.

kube-apiserver

Front end of the Kubernetes control plane; all kubectl and controller traffic passes through it, and it is the only component that reads and writes etcd.

etcd

Consistent key-value store holding all Kubernetes cluster state; losing it loses the cluster, so it is backed up with etcdctl snapshot save and restored offline.

kube-scheduler

Assigns pending pods to nodes by filtering candidates against requests, taints and affinity, scoring the survivors, then binding the chosen node through the API server.

Deployment

Controller managing a ReplicaSet for stateless pods; it performs rolling updates bounded by maxSurge and maxUnavailable, and kubectl rollout undo reverts to a prior revision.

Service ClusterIP

Default Service type providing a stable virtual IP and DNS name that load-balances traffic to pod endpoints chosen by the Service's label selector.

Headless Service

Service with clusterIP: None; DNS returns individual pod A records rather than a virtual IP, which StatefulSets use to give each replica a stable name.

Liveness probe

Periodic httpGet, tcpSocket or exec check that restarts a container after failureThreshold consecutive failures; readiness probes instead remove the pod from Service endpoints.

StatefulSet

Workload giving pods stable ordinal names, ordered rollout and a PersistentVolumeClaim per replica; suited to databases and clustered applications needing stable identity.

Taint and toleration

Taint on a node repels pods unless the pod declares a matching toleration; used to reserve nodes for dedicated workloads such as GPUs or control-plane-only duties.

NetworkPolicy

Namespaced resource selecting pods by label and allowing only listed ingress and egress traffic; enforcement requires a CNI plugin such as Calico or Cilium.

RBAC RoleBinding

Grants a Role's permissions to users, groups or ServiceAccounts inside one namespace; a ClusterRoleBinding grants permissions cluster-wide or across all namespaces.