XK0-006

docker run creates a new container from the image and starts it, and the -i (keep STDIN open) and -t (allocate a pseudo-terminal) options attach an interactive session to it. docker start only starts an existing container, docker build builds an image from a Dockerfile, and docker exec runs a command in a container that is already running, so none of them both create and connect.

A running virtual machine can only move to a host with a compatible CPU architecture (and feature set), because the guest keeps executing the same instructions after the move. The VM's disk must also be reachable at the same storage path on both hosts, typically shared storage, so the destination can open the same disk images. Network speed, swap and USB ports do not have to match, and the destination only needs enough free memory for the VM, not the same amount as the source.

pushd changes into /var/www/html/, cpio -idv reads the archive from standard input and extracts it (-i) into the current directory, creating directories as needed (-d), and popd returns to the previous directory. Option A compresses the file with gzip -c instead of decompressing it, so tar receives gzip data rather than an archive. Option C creates a new archive (-c) and would overwrite the backup, and unzip -c only prints the files to standard output instead of extracting them to the directory.

An Ansible inventory lists the managed nodes and organizes them into groups that playbooks and ad hoc commands target. Facts are data gathered from the hosts, a playbook defines the plays and tasks to run, and a collection is a distribution format for roles, modules and plugins.

/proc is a virtual (procfs) filesystem generated by the kernel in memory; it exposes process and kernel information and nothing in it is stored on disk, so it is rebuilt on every boot. /boot, /usr and /var are on persistent storage: /var holds variable data such as logs and spools, but that data survives a reboot.

getent passwd accounting returns the user's passwd entry from the configured name services, which includes the UID, GID, home directory and login shell. id shows only the UID, GID and group memberships, /etc/shadow holds password hashes and aging data rather than the home directory or shell, and who lists logged-in users.

docker image pull downloads an image from a registry, and with no tag it fetches the latest tag. docker image import creates an image from a tarball, docker image save writes a local image to a tar archive, and docker image init is not a Docker command.

Braces mark exactly where the variable name begins and ends, so ${num} is expanded as the variable num regardless of the characters around it. $(num) is command substitution and tries to run a command called num, single quotes stop all expansion, and backticks are also command substitution, so they would try to run the variable's value as a command.

tail -f follows the log as new lines arrive, and piping it into tee copies standard input both to the screen and to logfile.txt, so the administrator watches the log live and keeps a copy. The > and >> redirections send the output only to the file, so nothing appears on the screen in real time. Piping into logfile.txt is invalid because a pipe needs a command, not a file name.

Log aggregation collects logs and events from many systems and stores them in one central place, where they can be searched and correlated. Health checks test whether a service is up, webhooks send HTTP callbacks when an event occurs, and threshold monitoring raises alerts when a metric crosses a limit. None of those three consolidates events in one location.

chattr +a sets the append-only attribute, so the file can be opened for writing only in append mode: existing data cannot be overwritten or truncated, but new data can be added at the end. setenforce switches the SELinux mode and does not act on a file. chmod +t sets the sticky bit, which controls deletion in directories, and setfacl changes ACL entries, not append behaviour.

ssh-keygen -t rsa creates an RSA key pair, and ssh-copy-id -i ~/.ssh/id_rsa.pub installs the public key in john's authorized_keys on server2, so later logins use the key instead of a password. ssh-keyscan only collects host keys from servers and does not create a user key. ssh-agent and ssh-add manage keys that are already loaded, and copying the whole ~/.ssh folder with scp would expose the private key without setting up authorized_keys properly.

netplan try applies the new configuration and rolls it back automatically unless the administrator confirms it before the timeout, which is 120 seconds by default. If the change cuts off access, the old configuration comes back without manual work. netplan apply makes the change permanent with no rollback, netplan rebind re-binds interfaces, and netplan ip shows IP leases; neither of those last two tests a change safely.

systemd-journald is the systemd service that gathers log messages from the kernel, syslog and service output, and stores them in structured, indexed journals that you read with journalctl. Crash dumps come from kdump, and the filesystem journal is kept by the filesystem itself, for example ext4 or XFS. Audit records are written by auditd.

usermod -aG docker user adds docker to the user's supplementary groups and keeps the groups the user already has, because -a appends to the list given with -G. usermod -g would change the user's primary group, which is what the administrator wants to avoid. groupmod changes the properties of a group, not a user's memberships, and it has no -G option for this.

Python 3 is extended through modules and packages: you import standard-library or third-party modules to add functions without copying their code. Python is open source, under the Python Software Foundation License. Python 3 deliberately broke backward compatibility with Python 2, and it does not run Java bytecode.

A centralized log aggregation solution (for example rsyslog or journald forwarding to a central collector or a SIEM) gathers OS and application events from every server into one secured, searchable place, which is what reliably handles log complexity across many hosts. Pulling logs on demand is manual and misses events if a server fails. Remote backups preserve logs but do not make them manageable or analysable. Log rotation only controls disk usage on each server and does not address multi-server management.

initrd (initial RAM disk, today usually an initramfs) is a temporary root file system loaded into memory by the boot loader together with the kernel. It holds the basic kernel modules, drivers and scripts needed to reach the real root file system, such as storage, RAID, LVM or encryption support, before control passes to init. It has nothing to do with SSH access, certificate storage or initializing the random device.

renice changes the nice value of a running process, so raising the nice value of the maintenance task lowers its scheduling priority and gives other applications more CPU time while the task still completes. pidstat only reports per-process statistics and cannot add CPU time. nohup only keeps a process running after the terminal closes, and bg only moves a stopped job to the background; neither changes CPU priority.

LDAP (Lightweight Directory Access Protocol) is the standard protocol for querying and modifying distributed directory services organized as a hierarchy of entries such as users, groups, machines and organizational units. SMB is a file and printer sharing protocol, TLS is a transport encryption protocol, and Kerberos 5 is an authentication protocol that often works alongside a directory but does not provide access to its hierarchy.