Easy everything in CI/CD & Automation
Critical vm2 sandbox escape (CVSS 10.0) traced to its own README example
GitLab's Threat Research Group found a CVSS 3.1: 10.0 sandbox escape in vm2, a widely used Node.js sandbox library, in a config copied from vm2's own README. Version 3.11.7 fixes the attack, but the underlying risk remains for anyone using require.external. Update immediately and prefer containers for untrusted code.
Explain GitOps and how an agent knows when to apply changes
Tests declarative infrastructure and pull-based reconciliation. A strong answer says Git is the source of truth and the agent polls or watches for drift, then applies diffs. Red flag: calling a push-based CI pipeline GitOps.
What is SAST and which CI/CD stage integrates it best?
Define SAST as source-code scanning; run it in the test stage on every commit; note early detection is cheapest.
What is the difference between a Service and an Ingress?
This tests L4 versus L7 networking abstractions. A good answer says Services load-balance to Pods internally while Ingresses route external HTTP to Services via a controller, then gives a path-based scenario.
What is IaC and its CI/CD benefits over manual provisioning?
Cover descriptive models, idempotency, and on-demand environments for repeatable CI/CD.
GitLab Flex merges seats and AI into one budget
GitLab Flex reshapes one annual budget monthly across seats, AI credits, and features without re-procurement. Engineering leaders can shift spend from idle seats to agent usage instead of guessing headcount six months out. Ask at renewal.
GitLab Orbit unifies code lifecycle in live graph
GitLab Orbit beta unifies code, pipelines, and ownership in a live graph. Compare the Market tests show Orbit-grounded reviewers hit 70% accuracy versus 58% for RAG.
GitLab patches 13 CVEs including SAML account takeover flaw
GitLab 19.0.2, 18.11.5, and 18.10.8 patch 13 security flaws, including four High-severity CVEs like SAML account takeover (CVSS 8.7) and unauthenticated API DoS. Self-managed instances must upgrade immediately; GitLab.com is already patched.
How do you manage secrets for hundreds of services in centralized CI/CD?
It tests secret sprawl prevention and least privilege in CI/CD. Answer: use a secrets manager with RBAC, short-lived credentials, runtime injection, and audit logs. Red flag: secrets in Git, plain env vars, or one shared master key.
How do you version shared CI steps and handle breaking changes?
This tests CI hygiene and consumer safety. Pin shared steps to immutable tags or SHAs, use semantic versioning, and force consumers to opt into breaking changes. Red flag: referencing a mutable branch like main for reusable workflows.
Describe high-level steps to onboard a microservice via self-service CI/CD
Tests platform thinking and developer experience design. A strong answer outlines a golden path: templated repo setup, standardized build/test stages, environment promotion, and observability hooks, plus guardrails not blockers.
Walk me through deploying a new version using a GitOps workflow
Merge updates manifests; the GitOps controller compares desired state in Git to live state and reconciles.
Blue/green vs canary release: differences and when to choose each.
This tests release-automation risk mitigation. A strong answer contrasts instant full-environment swaps with gradual traffic shifts, pairing blue/green with hotfixes and canary with risky changes. A red flag is calling them identical or ignoring blast radius.
What are the four Golden Signals for service health monitoring?
Tests whether you can name the four essential metrics—latency, traffic, errors, saturation—and explain why each matters for detecting user-facing regressions after a release, rather than drowning in infrastructure noise.
Committed an API key to Git. Describe two automated CI/CD prevention methods.
This tests layered secret protection in Git workflows. A strong answer names pre-commit scanning and server-side push protection or pipeline scanning. Mention rotating that key. A weak answer only suggests manual review without automated gates.
What problem can a breaking API change cause during a rolling update?
Tests if you know rolling updates run mixed versions, so breaking API changes crash cross-traffic. Good answer: note old and new pods serve together, watch probes fail, and monitor 5xx spikes. Red flag: claiming Kubernetes isolates versions during rollout.
Explain canary releases and why choose them over rolling updates
This tests risk mitigation via user routing versus in-place replacement. A strong answer defines canary as exposing a subset to the new version first, contrasts rolling updates lacking user segmentation, and cites fast rollback.
Rolling vs blue/green deployments: differences and trade-offs
Tests risk-cost-downtime judgment. Contrast rolling's gradual swap with blue/green's parallel swap; rolling is cheaper but mixes versions, while blue/green doubles capacity for instant rollback. Red flag: saying blue/green cheaper or rolling double-capacity
Walk me through a production-ready Dockerfile for a web app
Tests multi-stage builds, layer caching, and security hardening. A strong answer covers a pinned slim FROM, multi-stage separation of build and runtime, ordered COPY for cache, and a non-root USER.
What is Twelve-Factor's config recommendation for CI/CD and scalability?
Tests Factor III and CI/CD scaling implications. Strong answer: config lives in env vars, never in code, so one build promotes across stages and new instances start with correct context immediately. Red flag: config files checked into version control.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles