Advanced concepts in DevOps & Cloud
Service Level Agreement (SLA): The Contract Behind Uptime
An SLA is a business contract, not a technical target. It defines the minimum service quality a provider promises a customer, with financial penalties for failure. You see them in every cloud provider contract.
Union File Systems: Docker's Layered Magic
A Union File System stacks read-only layers and adds a writable one on top, like transparent overlays. This lets containers share base images, saving disk space, while isolating changes via copy-on-write. The footgun is performance on write-heavy apps.
OCI Runtime Spec: The 'How to Run' Standard for Containers
The OCI Runtime Spec is the universal instruction manual for executing a container. It defines a standard config.json and lifecycle actions, ensuring a container runs the same way across different runtimes like runc or crun.
Pipeline as Code: Versioning Your Build Process
Treat your CI/CD pipeline not as clicks in a UI, but as a version-controlled file (Jenkinsfile) living with your code. This enables automated, reviewable build processes for every branch. The footgun is defining pipelines in the UI, creating a black box.
SRE Engagement Models: From Gatekeeper to Platform Builder
SRE engagement models define how reliability experts help product teams, evolving from gatekeeping existing services to providing reliable platforms. This applies when scaling an SRE team's impact.
Container Runtime Shim: Decoupling the Container Lifecycle
A runtime shim is a small process that decouples the container daemon (like containerd) from the container itself. This lets the daemon restart without killing running containers.
Immutable Infrastructure: Treat Servers Like Cattle, Not Pets
Immutable infrastructure means you never modify running servers. To deploy, you replace them with new ones built from a golden image. This is key for CI/CD and autoscaling, ensuring consistency. The footgun is configuration drift from manual, one-off fixes.
seccomp: A Kernel-Level Allowlist for Syscalls
seccomp is a Linux kernel firewall for system calls (syscalls), restricting which operations a process can request. Docker and Kubernetes use it to harden containers against exploits. The footgun is creating a custom profile so restrictive it breaks your app.
GitOps: Your Git Repo is the Single Source of Truth
GitOps makes a Git repo the single source of truth for your infrastructure's desired state. An automated process makes production match what's declared in Git, enabling continuous deployment.
Idempotency: Safe to Retry Automation
Idempotent automation ensures an operation has the same effect whether run once or many times. This is vital for safely retrying failed CI/CD jobs or configuration scripts. The footgun: thinking it means 'no side effects'.
Multi-cloud: Spreading Bets Across Cloud Providers
Multi-cloud is a strategy for using services from two or more cloud providers to avoid vendor lock-in. It's used to cherry-pick best-in-class services or improve resilience. The footgun is underestimating the complexity of managing disparate APIs and security.
FaaS: Run Code, Not Servers
FaaS lets you run code without managing servers, like renting a contractor for one task. It's ideal for event-driven actions like processing uploads or handling webhooks. The footgun is cost: for high, steady traffic, a dedicated server is often cheaper.
Cardinality: The Hidden Cost of Time-Series Metrics
Cardinality is the number of unique label combinations in your metrics. High cardinality, from labels like user IDs, is the silent killer of monitoring systems like Prometheus, exploding memory and cost. The footgun is adding a label with unbounded values.
Sampling: Tracing Everything Without Storing Everything
Sampling makes high-volume observability affordable by deciding which traces to keep and which to discard. It's essential in distributed systems where capturing every request is too costly.
Docker Multi-stage Builds: Slimmer, Faster Images
Treat your Dockerfile like a pipeline: build your app in one stage with all its tools, then copy only the final artifact to a clean production stage. This keeps images small by excluding build-time dependencies.
Docker Image Scanning: A Background Check for Your Code
Docker image scanning is a background check for your software dependencies, checking packages against known vulnerability lists (CVEs). It's used in CI/CD to block vulnerable builds and in registries for continuous monitoring.
Spot Instances: Trade Reliability for Huge Cost Savings
Spot Instances let you use spare AWS compute for up to 90% off. They're great for fault-tolerant jobs like batch processing or CI/CD. The footgun: AWS can reclaim your instance with a two-minute warning, so don't use them for critical workloads.
GitFlow: A Branching Model for Versioned Releases
GitFlow organizes your repo around two main branches: master for production and develop for integration. It's designed for projects with distinct, numbered releases, like desktop apps, not for continuously delivered web apps where simpler models are…
Bare Metal Instances: Your Own Dedicated Cloud Server
A bare metal instance is your own dedicated physical server in the cloud—no sharing, no virtualization layer. Use it for workloads needing direct hardware access or for licensing that forbids VMs. The footgun: you trade cloud elasticity for this control.
Git Cherry-Pick: Copy a Commit to Another Branch
Think of git cherry-pick as copying a single commit's changes from one branch and reapplying them as a new commit on another. It's for backporting a bug fix without merging an entire feature branch.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles