Interview questions in DevOps & Cloud, page 4
Black-box vs white-box monitoring for legacy apps
Black-box probes from outside, white-box reads internal state; start black-box for fast user-facing signal.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
Cost-effective fault-tolerant batch processing
Spot fleets across types, a durable work queue, idempotent checkpointed tasks, retries.
Compare git submodules and git subtree for CI/CD
Tests dependency integration trade-offs in CI. Submodules need recursive clones and pinned commits, complicating checkout; subtree inlines code, simplifying clone but bloating history. Red flag: omitting submodule detached HEAD pain or calling subtree free.
What is high-cardinality data in Prometheus?
Cardinality is the count of unique label combinations; each is a separate series; explosion blows up memory and query cost.
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Object vs block vs file storage
Object stores flat keyed blobs over HTTP, block gives raw volumes for one VM, file offers a shared hierarchical mount.
How do build tools differ from compilers or interpreters?
This tests whether you see compilation as only one step in a repeatable pipeline. A strong answer covers dependency resolution, transitive libraries, task automation, and artifact packaging.
Head-based vs tail-based trace sampling
Head-based decides at trace start cheaply but blindly; tail-based waits for the full trace to keep errors and slow requests.
Distroless images: benefits and trade-offs
Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
Serving user images securely from object storage
Store images in a private bucket, serve via a CDN with origin access control, use signed URLs for private content.
Your build times increased significantly. How do you investigate and optimize?
Tests methodical CI/CD bottleneck analysis and build optimization tactics. Strong answers baseline the timeline, isolate the slowest stage with metrics, then apply parallelism, caching, or dependency pruning.
Symptom-based vs cause-based alerting
Symptom alerts fire on user-visible impact, cause alerts on internal conditions; page on symptoms to cut noise and catch unforeseen failures.
Start Compose services detached and view one service's logs
Docker compose up -d starts everything detached; docker compose logs -f web follows only the web service's logs.
Diagnosing high I/O wait on a database volume
Check IOPS and throughput against the volume limit, look for burst-credit exhaustion, then move to provisioned IOPS or a larger volume.
Explain dependency management and diamond conflicts in automated builds
Tests transitive dependency resolution and conflict strategies in build pipelines. Strong answers mention nearest-wins eviction, strict versioning, shading, or classloader isolation. Red flag: manual jar swaps or pinning without understanding ABI breakage.
Relationship between SLI, SLO, and SLA
SLI is the measured metric, SLO is the internal target for that metric, SLA is the external contract with consequences.
Persist PostgreSQL data across compose down
Define a named volume and mount it at the database's data directory (/var/lib/postgresql/data); named volumes survive compose down.
Shared file system access across many VMs
Use a managed NFS service like EFS or Filestore; watch per-operation latency, throughput modes, and metadata-heavy small-file workloads.
Compare ephemeral container agents versus persistent build agents
Ephemeral agents ensure clean state but add cold-start latency; persistent agents speed builds via caching yet risk config drift.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles