LXD supports the following network interface types in an LXD container configuration 1 :

macvlan: Creates a virtual interface on the host with a unique MAC address and attaches it to an existing physical interface.  This allows the container to have direct access to the physical network, but prevents communication with the host and other containers on the same host 2 .

bridged: Connects the container to an existing bridge interface on the host.  This allows the container to communicate with the host and other containers on the same bridge, as well as the external network if the bridge is connected to a physical interface 3 .

physical: Passes an existing physical interface on the host to the container.  This allows the container to have exclusive access to the physical network, but removes the interface from the host 4 .

The other network interface types, ipsec and wifi, are not valid in an LXD container configuration. Ipsec is a protocol for secure communication over IP networks, not a network interface type. Wifi is a wireless technology for connecting devices to a network, not a network interface type.  References :

About networking - Canonical LXD documentation

Macvlan network - Canonical LXD documentation

Bridge network - Canonical LXD documentation

Physical network - Canonical LXD documentation

LXC (Linux Containers) is a lightweight virtualization technology that allows multiple isolated Linux systems (containers) to run on the same host. LXC uses Linux kernel features such as namespaces, cgroups, and AppArmor to create and manage containers. Each container has its own file system, network interfaces, process tree, and resource limits. However, containers share the same kernel and hardware with the host, which makes them more efficient and faster than full virtualization.

By default, an LXC container has a minimal set of devices that are needed for its operation. These devices are created by the LXC library when the container is started, and are removed when the container is stopped. The default devices are:

/dev/log : This is a Unix domain socket that connects to the syslog daemon on the host.  It allows the container to send log messages to the host’s system log 1 .

/dev/console : This is a character device that provides access to the container’s console. It is usually connected to the host’s terminal or a file.  It allows the container to interact with the user or the host’s init system 1 2 .

/dev/urandom : This is a character device that provides an unlimited source of pseudo-random numbers.  It is used by various applications and libraries that need randomness, such as cryptography, UUID generation, and hashing 1 3 .

The other devices listed in the question do not exist by default in an LXC container. They are either not needed, not allowed, or not supported by the container’s namespace or cgroup configuration. These devices are:

/dev/kmem : This is a character device that provides access to the kernel’s virtual memory. It is not needed by the container, as it can access its own memory through the /proc filesystem.  It is also not allowed by the container, as it would expose the host’s kernel memory and compromise its security 4 .

/dev/root : This is a symbolic link that points to the root device of the system. It is not supported by the container, as it does not have a separate root device from the host.  The container’s root file system is mounted from a directory, an image file, or a loop device on the host 5 .

 Libvirt is a toolkit that provides a common API for managing different virtualization technologies, such as KVM, Xen, LXC, and others. Libvirt allows users to configure and control various aspects of a virtual machine (also called a domain), such as its CPU, memory, disk, network, and other resources. Among the resources that can be limited by libvirt for a KVM domain are:

Amount of CPU time : Libvirt allows users to specify the number of virtual CPUs (vCPUs) that a domain can use, as well as the CPU mode, model, topology, and tuning parameters. Users can also set the CPU shares, quota, and period to control the relative or absolute amount of CPU time that a domain can consume. Additionally, users can pin vCPUs to physical CPUs or NUMA nodes to improve performance and isolation.  These settings can be configured in the domain XML file under the  < cpu >  and  < cputune >  elements 1 2 .

Size of available memory : Libvirt allows users to specify the amount of memory that a domain can use, as well as the memory backing, tuning, and NUMA node parameters. Users can also set the memory hard and soft limits, swap hard limit, and minimum guarantee to control the memory allocation and reclaim policies for a domain.  These settings can be configured in the domain XML file under the  < memory > ,  < memoryBacking > , and  < memtune >  elements 1 3 .

The other resources listed in the question are not directly limited by libvirt for a KVM domain.  File systems allowed in the domain are determined by the disk and filesystem devices that are attached to the domain, which can be configured in the domain XML file under the  < disk >  and  < filesystem >  elements 1 4 . Number of running processes and number of available files are determined by the operating system and the file system of the domain, which are not controlled by libvirt.

In libvirt-based virtualization environments, the virsh change-media subcommand is used to change the media attached to removable devices such as CD-ROM drives . According to libvirt documentation, this command allows administrators to insert or eject ISO images from a running virtual machine without shutting it down.

This functionality is commonly used during operating system installations or software updates. The change-media command supports both live and persistent changes depending on the options used.

Therefore, the correct and documented answer is change-media .

The command lxc-attach is used to execute a command in a running LXC container.  It allows the user to start a process inside the container and attach to its standard input, output, and error streams 1 .  For example, the command  lxc-attach -n mycontainer -- ls -lh /home  will list all the files and directories in the /home directory of the container named mycontainer 1 . The other options are not valid LXC commands. The command lxc-batch does not exist.  The command  lxc-run  is an alias for  lxc-start , which is used to start a container, not to execute a command in it 2 .  The command  lxc-enter  is also an alias for  lxc-attach , but it is deprecated and should not be used 3 . The command lxc-eval is also not a valid LXC command.  References :

1 : Executing a command inside a running LXC - Unix & Linux Stack Exchange.

2 : lxc-start: start a container. - SysTutorials.

3 : lxc-attach: start a process inside a running container. - SysTutorials.

 Nested page table extensions, such as Intel Extended Page Table (EPT) or AMD Rapid Virtualization Indexing (RVI), are hardware features that facilitate the virtualization of  memory . They allow the CPU to perform the translation of guest virtual addresses to host physical addresses in a single step, without the need for software-managed shadow page tables. This reduces the overhead and complexity of memory management for virtual machines, and improves their performance and isolation. Nested page table extensions do not directly affect the virtualization of other hardware components, such as network interfaces, host bus adapters, hard disks, or IO cache.

The correct command to boot a QEMU virtual machine using hardware virtualization extensions is qemu -accel kvm -drive file-debian.img -cdrom debian.iso -m 1024 -boot d. This command uses the -accel option to specify the hardware accelerator to use, which in this case is kvm.  KVM is a full virtualization solution for Linux on x86 hardware containing virtualization extensions (Intel VT or AMD-V) 1 . The -drive option specifies the disk image file to use, which in this case is debian.img. The -cdrom option specifies the ISO image file to use as a CD-ROM, which in this case is debian.iso. The -m option specifies the amount of memory to allocate to the virtual machine, which in this case is 1024 MB. The -boot option specifies the boot order, which in this case is d, meaning to boot from the CD-ROM first.  References :

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/virtualization_deployment_and_administration_guide/sect-troubleshooting-enabling_intel_vt_x_and_amd_v_virtualization_hardware_extensions_in_bios

https://fedoraproject.org/wiki/Virtualization

Libvirt uses XML files to store configuration data for objects in the libvirt API, such as domains, networks, storage, etc. This allows for ease of extension in future releases and validation of documents prior to usage. Libvirt does not use any of the other file formats listed in the question.  References :

libvirt: XML Format

LPIC-3 Virtualization and Containerization: Topic 305.1: Virtualization Concepts and Theory

Packer is an image automation and building tool developed by HashiCorp. According to virtualization and DevOps documentation, Packer is used to create machine images for multiple platforms from a single configuration file.

Packer is not an orchestration platform, configuration management tool, or hypervisor. Its primary role is to ensure consistent, repeatable, and automated image creation , making B the correct answer.

A hypervisor is a software that creates and runs virtual machines (VMs) by separating the operating system and resources from the physical hardware. One of the main tasks of a hypervisor is to map the resources of VMs to the resources of the host system, such as CPU, memory, disk, and network.  This allows the hypervisor to allocate and manage the resources among multiple VMs and ensure that they run efficiently and independently 1 2 3 . Another important task of a hypervisor is to isolate the VMs and prevent unauthorized access to resources of other VMs. This ensures the security and privacy of the VMs and their data, as well as the stability and performance of the host system.  The hypervisor can use various techniques to isolate the VMs, such as virtual LANs, firewalls, encryption, and access control 1 4 5 .

The other tasks listed are not part of a hypervisor’s responsibility, but rather of the guest operating system or the application running inside the VM.  A hypervisor does not create filesystems during the installation of new VMs, as this is done by the installer of the guest operating system 6 .  A hypervisor does not provide host-wide unique PIDs to the processes running inside the VMs, as this is done by the kernel of the guest operating system 7 .  A hypervisor does not manage authentication to network services running inside a VM, as this is done by the network service itself or by a directory service such as LDAP or Active Directory 8 .  References :  1  (search for “What is a hypervisor?”),  2  (search for “How does a hypervisor work?”),  3  (search for “The hypervisor gives each virtual machine the resources that have been allocated”),  4  (search for “Benefits of hypervisors”),  5  (search for “Isolate the virtual machines and prevent unauthorized access”),  6  (search for “Create filesystems during the installation of new virtual machine quest operating systems”),  7  (search for “Provide host-wide unique PIDs to the processes running inside the virtual machines”),  8  (search for “Manage authentication to network services running inside a virtual machine”).