I85PREP
⌘ K
LPIC-3 Virtualization and Containerization study materials
LPIC-3 Virtualization and Containerization study resources

LPIC-3 Virtualization and Containerization: Containerization

LPIC-3 Virtualization and Containerization · Work through your exam, one topic at a time.

All guide sections

Containerization

Containers are ordinary processes constrained by kernel features: namespaces for isolation, cgroups for accounting and limits. This domain tests the mechanics behind docker and podman - which namespace does what, how cgroup v2 limits are expressed, how images and layers are addressed, and where rootless operation changes behaviour.

Isolation primitives

  • Namespaces: pid (own process tree), net (interfaces and routes), mnt (mount table), uts (hostname), ipc, user (UID mapping), cgroup and time. A container is a process with a set of these unshared.
  • cgroup v2 uses one unified hierarchy under /sys/fs/cgroup with files such as memory.max, cpu.max and pids.max; v1 split controllers into separate trees.
  • Capabilities, seccomp profiles and SELinux/AppArmor labels narrow what a container may do. Dropping CAP_NET_RAW or using --security-opt no-new-privileges are routine hardening steps.

Images and engines

  • An image is an ordered stack of layers plus a config; each Dockerfile instruction adds a layer, layers are content-addressed by digest, and the engine verifies the digest from the registry manifest.
  • dockerd runs as a root daemon and serves clients over a socket. podman is daemonless: it fork-execs a per-container conmon monitor, which composes cleanly with systemd via quadlet units.
  • Rootless podman depends on user namespaces. /etc/subuid and /etc/subgid grant a UID/GID range; container UID 0 maps to the invoking user and container UID 1 upward maps into the subuid range. Storage falls back to fuse-overlayfs when unprivileged overlay is unavailable.

Worked example

A rootless container writing to a bind-mounted host directory fails with permission denied. The directory is owned by host uid 1000; inside the container it appears as 65534 (nobody) because uid 1000 is outside the mapped range - only host 1000 to container 0, and host 100000+ to container 1+, are mapped. Bind mounts bypass the storage driver and expose raw host UIDs, so the fix is --userns=keep-id or chowning the directory to the subuid that container UID maps to.

Traps that cost marks

  • The container exits when PID 1 exits; a backgrounded daemon in the entrypoint kills it.
  • Arguments to docker run replace CMD, not ENTRYPOINT.
  • podman and docker keep separate image stores unless configured to share.
  • --privileged disables most isolation and is not a fix for permission errors.