Intermediate interview questions in DevOps & Cloud, page 3
Manage startup order and readiness in Compose
Depends_on only orders start, not readiness; add a healthcheck to the DB and use depends_on with condition: service_healthy so the web app waits until the DB passes its health check.
Defining SLOs for a new critical service
Start from user journeys, pick SLIs, involve product, engineering, and business stakeholders, set realistic targets iteratively.
Compose image directive versus build directive
Image pulls a prebuilt image from a registry; build builds from a local Dockerfile and context; use build for your own custom application code.
Handling planned maintenance in SLOs and error budgets
Either charge maintenance to the error budget or formally exclude it via a maintenance window; each trades honesty against fairness.
Bind mounts versus named volumes
A bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).
How would you block merges when PR coverage drops 2%?
Upload coverage to Codecov, set a project status threshold of 2, and require the check in branch protection.
How would you integrate SAST into CI without alert fatigue?
This tests embedding security into workflow without killing velocity. Run SAST per commit, suppress false positives via rulesets, gate on high-severity findings first and block merges only after calibration. A red flag is zero-tolerance blocking on day one.
Connecting two VPCs privately
VPC peering is simple but non-transitive and full-mesh; a Transit Gateway scales hub-and-spoke; PrivateLink exposes one service narrowly.
Process running but load balancer says unhealthy
The probe path, port, protocol, or expected status may mismatch; a security group may block the probe; the app may be up but not ready.
How do you version Docker images: Git SHA or SemVer?
Your grasp of immutable artifacts and traceability versus human-readable releases. Tag every build with Git SHA for immutability, then apply SemVer aliases only on promoted images. Treating floating tags like latest or v1 as safe production targets.
DNS routing policies for active-passive failover
A failover policy with health checks routes to primary and flips to secondary on failure; keep TTL low; pair with health checks not just policy.
Debugging ImagePullBackOff on a private registry
ImagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors.
Explain proxy repositories in artifact managers and the problems they solve
Tests caching and supply-chain resilience in builds. Strong answers cover: local caching of upstream artifacts, shielding CI from external outages, and policy enforcement at the edge.
OpenTelemetry API, SDK, and Collector
API defines vendor-neutral instrumentation, SDK implements and exports it, Collector receives, processes, and routes telemetry to backends.
CDN caching for static and dynamic content
Cache static assets with long TTLs and versioned filenames; bypass or short-cache dynamic per-user responses; invalidate via fingerprinted URLs not purges.
Three techniques to shrink a Docker image
Multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.
Promote an artifact from staging to release without rebuilding it
Tests immutable artifact discipline. Answer: promote by copying the binary or retagging the image digest, never recompiling, because rebuilds introduce dependency drift and untested bits.
Trace context and propagation across services
Trace context bundles trace ID, span ID, and flags; propagated via headers like W3C traceparent so each service extracts and continues the trace.
Manifest lists and multi-arch images
A manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.
Redesigning a high-cardinality request metric
Cardinality is unique label combinations; user_id and raw path are unbounded; redesign by dropping user_id and templating the path.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles