Everything in Cloud Platforms, page 4
Serverless cold starts and how to mitigate them
A cold start is the latency to provision and initialize a fresh environment; mitigate with provisioned concurrency, smaller packages, and lighter runtimes.
Debug intermittent pod-to-pod connectivity
Scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU.
Isolate tenants in a shared Kubernetes cluster
Namespaces as the boundary, ResourceQuotas plus LimitRanges to cap compute, default-deny NetworkPolicies for traffic, and RBAC per namespace.
Grant an EKS pod IAM access to S3
IRSA maps a service account to an IAM role via the cluster OIDC provider, and pods exchange a projected token for short-lived STS credentials.
Running stateful apps with StatefulSets
Stateful apps need stable identity and storage; a StatefulSet gives stable names, ordered rollout, and per-Pod volumes.
Exposing Kubernetes services to the internet
A Service gives stable access and LoadBalancer exposes one service, while Ingress adds L7 host and path routing with TLS for many services.
Multi-stage Docker builds
A build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface.
Kubernetes Deployment versus Pod
A Pod is the smallest disposable unit, a Deployment maintains a desired replica count, self-heals, and rolls out updates.
Writing a Dockerfile for a web app
FROM a base, set WORKDIR, install dependencies before app code for cache reuse, EXPOSE the port, CMD the start command.
Migrating a stateful monolith to PaaS
Externalize state to backing services, make processes stateless and disposable, read config from the environment per Twelve-Factor.
Cold starts in serverless environments
A cold start is the delay to provision a fresh instance and initialize the runtime; mitigate with provisioned concurrency and by shrinking init work.
Offload long-running tasks from web requests
Enqueue the job to a queue, return immediately, process with separate workers, report status out of band.
CI/CD pipeline for a container PaaS
Run tests, build the image, push the tag to a registry, then deploy it to Cloud Run. The registry is the build-to-deploy handoff.
Securely supplying secrets to an app
Never hardcode credentials, inject them as environment variables or pull from a secrets manager, and rotate them.
Deploying to Heroku via Git
Push to the remote, a buildpack detects the language, builds a slug, and runs the Procfile process.
Why not store uploads on local PaaS disk?
PaaS instances are ephemeral and unshared, so local files vanish on restart and are invisible to peers; store uploads in object storage.
The cloud shared responsibility model
The provider secures the cloud (hardware, OS, runtime), you secure what runs in it (code, data, config, access).
CAP theorem and real database tradeoffs
During a partition you pick consistency or availability, CP systems reject requests, AP systems stay available but stale.
Design a global low-latency database
A distributed store with replicas near users, a tuned consistency level, accepting lag, conflicts, and cross-region cost.
Add a second access pattern to a key-value store
Add a global secondary index on EmailAddress, weighing extra storage, write amplification, and eventual consistency.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles