Search
Find a bite, explore a topic or look for a role.
Results for “Kubernetes”
Bites 384
Describe the difference between online and batch inference.
Online uses autoscaling APIs for millisecond-to-second latency; batch uses scheduled compute for minute-to-hour latency.
How would you systematically debug an inference API latency breach?
This tests structured debugging across the full inference stack. A strong answer traces the request path from ingress to GPU, splits TTFT from token-generation latency, inspects queuing and batching, then applies targeted fixes.
Design multi-tenant GPU cluster scheduling and preemption policies
Tests ability to design fair GPU scheduling preventing starvation and noisy-neighbor issues. Answer: Kueue for fair-share, namespace quotas with MIG, priority classes with backoff.
Compare Airflow and Kubeflow for ML training pipelines
Tests orchestrator-to-workload fit. Strong answers contrast Airflow's data integration and Python DAGs with Kubeflow's K8s scaling, container reproducibility, and experiment tracking. Red flag: claiming one is always better without stage-specific reasoning.
How do you containerize a Python training script for GPU cloud VMs?
This tests reproducible GPU containerization. A strong answer uses an NVIDIA CUDA base image, installs Python dependencies at build time, copies the training script, and runs with --gpus.
Design on-demand containerized dev environments for data scientists
Tests multi-tenant notebook infrastructure design. Cover a Notebook Controller, curated Jupyter and VS Code images, namespace isolation with RBAC, resource quotas, and persistent storage. Red flag: a single shared VM without tenancy or idle shutdown.
Describe two secure methods for providing secrets to a running container
Mention runtime mounts like Docker secrets, orchestrator secret injection, and cloud IAM patterns.
Design an MLOps platform for a mid-sized company: components and build-vs-buy trade-offs
Tests pragmatic scoping and build-vs-buy reasoning. Strong answers rank data estate, feature store, registry, CI/CD/CT, and monitoring above exotic serving, buying commodity and building differentiators. Red flag: custom orchestrators or missing governance.
Docker Image vs. Container: Blueprint vs. Runtime
A Docker image is a read-only blueprint; a container is a live instance with a writable layer. You build an image once in CI and run many containers from it in production. The footgun is mutating a running container without updating the image recipe.
TCP Listeners: Go vs Rust
Go spins up TCP listeners and handles connections with lightweight goroutines—1 million costs ~500MB—but GC pauses introduce 2-5ms latency. Rust trades boilerplate for zero-cost safety and consistent sub-100µs response times without garbage collection.
Describe the relationship between containerd and runc in starting a container.
Tests the OCI runtime split and lifecycle ownership. A great answer states containerd handles image pull, storage, and API lifecycle, then invokes runC to spawn the isolated process.
How do containers enforce CPU and memory limits via cgroups?
Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
ResourceQuota: Namespace Resource Budgets
ResourceQuota is a namespace budget: it rejects pods once total requests hit the cap. Use it to keep multi-tenant clusters fair. The footgun: it counts requested resources, not real usage, and pods missing requests may be rejected without LimitRange defaults.
ConfigMap decouples config from container images
A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.
EndpointSlice: Splitting the Monolithic Endpoints List
EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.
Design a highly scalable headless CMS architecture
Tests write-heavy authoring versus read-heavy delivery separation at scale. Strong answers outline dual-cluster isolation, event-driven invalidation, and CDN edge caching. Red flag: a monolithic service with only database query caching.
Explain the difference between IaaS, PaaS, and SaaS with examples
This tests your grasp of cloud abstraction layers and shared responsibility. A strong answer maps IaaS to raw infrastructure like EC2, PaaS to managed runtimes like Heroku, and SaaS to end-user apps like Gmail.
Design short-lived dynamic database credentials and their security benefits
This tests automated least-privilege credential lifecycle design. A strong answer covers a secrets broker with database plugins, short TTL leases tied to workload identity, and automatic revocation. Red flag: manual rotation or long-lived CI variables.
What is an artifact repository and why not just a shared filesystem?
Tests your grasp of immutability, metadata, and access control for build artifacts. A strong answer covers versioning, checksums, RBAC, and API retrieval that NFS lacks. Red flag: saying a shared filesystem is simpler and therefore enough for production.