Containers
76 bites tagged Containers — interview questions with model answers, and 60-second explainers.
How do you version Docker images: Git SHA or SemVer?
Your grasp of immutable artifacts and traceability versus human-readable releases. Tag every build with Git SHA for immutability, then apply SemVer aliases only on promoted images. Treating floating tags like latest or v1 as safe production targets.
Describe essential CI/CD stages for a containerized app and critical quality gates
This tests your ability to design a commit-to-prod pipeline with quality controls. A strong answer covers: build and unit tests, vulnerability scanning, staging deployment with integration tests, and production rollout with rollback.
Describe a CI/CD pipeline for a containerized web app
This tests your grasp of automated quality control in software delivery. A strong answer details the CI, build, staging, and production stages, emphasizing quality gates like security scans and E2E tests.
Describe the stages of a CI/CD pipeline for a containerized app
This tests your practical knowledge of automated software delivery and risk management. A strong answer outlines CI, build, test, and deploy stages, including container-specific steps like image scanning and quality gates like automated testing and…
Dockerizing Next.js with Multi-Stage Builds
Use a multi-stage Dockerfile to create lean, production-ready Next.js images. This separates build-time dependencies from the runtime environment, shrinking image size.
Your First Python Dockerfile Blueprint
A Dockerfile is a recipe for building a self-contained environment for your Python app. Use it to ensure your app runs identically everywhere, from your laptop to production. The common footgun is forgetting a .dockerignore file, which bloats your image.
Optimize Node.js Images with Multi-Stage Builds
Multi-stage builds separate your build environment from your final runtime. This lets you use heavy tools to build your Node.js app, then ship only the lean production code, drastically reducing image size and attack surface.
Creating a Basic Node.js Dockerfile
A Dockerfile is a recipe for building a portable image of your app. Use it to ensure your Node.js app runs identically everywhere, from your laptop to production.
Dev Containers: Your Dev Environment as Code
A dev container packages your entire development environment—tools, libraries, and settings—into a single, portable container. Use it to standardize team environments, simplify onboarding, and ensure consistency between local dev and CI.
Docker Bind Mounts: A Portal to Your Host Filesystem
A bind mount is a portal from your host machine's filesystem directly into a container, where changes on either side are reflected instantly. Use it for live code development, but never for production data, as it creates a major security risk.
Private Container Registry: Own Your Image Pipeline
A private container registry is your own personal Docker Hub, giving you full control over image storage and access. It's crucial for secure, in-house CI/CD pipelines.
The Sidecar Pattern: Your App's Helper Container
The Sidecar pattern attaches a helper container to your main application, like a sidecar on a motorcycle. It handles peripheral tasks like logging or networking, letting you add features without changing the app's code.
Falco: Real-Time Threat Detection for Cloud-Native
Falco is a runtime security camera, watching Linux syscalls to detect threats in real time. It's used in Kubernetes to spot abnormal behavior like privilege escalation or writing to /etc. The key is it only *detects* and *alerts*; it doesn't block threats.
Container Storage Interface (CSI): The Universal Adapter for K8s Storage
CSI is a universal adapter for storage in Kubernetes, letting any storage system speak a common language. This allows providers to create plugins for their systems without touching core Kubernetes code.
The Kubernetes Downward API: Pod Self-Awareness
The Downward API gives a container self-awareness, injecting Pod metadata like its name or IP address as environment variables or files. Use it so apps can self-configure without calling the main K8s API.
Init Containers: Setup Tasks Before Your Main App Runs
Init containers are setup tasks that run to completion before your main application starts. Use them to wait for dependencies, fetch configs, or run database migrations.
Kubernetes Probes: Liveness, Readiness, and Startup
Kubernetes probes ask your app about its health. Liveness asks 'are you alive?' (restart if not), readiness asks 'can you take work?' (pause traffic if not), and startup protects slow-starting apps. This is key for self-healing and zero-downtime deployments.
Kubernetes Requests and Limits: Your Pod's Resource Contract
Kubernetes Requests and Limits are your pod's resource contract: `requests` guarantee a minimum for scheduling, while `limits` enforce a maximum at runtime. This prevents one greedy app from crashing others.
Kubernetes Pods: The Atomic Unit of Deployment
A Pod is the smallest deployable unit in Kubernetes, a wrapper for one or more containers that run together on one machine. It's used for tightly coupled 'sidecar' helpers, like a log shipper.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like `ubuntu:22.04` on your `linux/amd64` machine.
Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like `:latest`. The footgun is assuming a tag is immutable.
Docker Login: Authenticating to a Container Registry
docker login saves your credentials for a container registry, letting you push and pull private images. Use it before interacting with private repos on Docker Hub, ECR, or GCR. The footgun: credentials are often stored unencrypted by default.
Docker Hub: The Central Repository for Containers
Think of Docker Hub as the GitHub for Docker images. It's a central repository from Docker, Inc. for finding, storing, and sharing pre-built software containers to automate code deployment.
Get Containers bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.