Advanced everything in DevOps & Cloud, page 12
kube-scheduler: The Cluster's Matchmaker
The kube-scheduler is your cluster's matchmaker, assigning new Pods to the best possible Node based on their needs. This is the default workload placement engine. The footgun is thinking it runs Pods; it only *assigns* them to a Node.
Kubernetes Controllers: The Reconciliation Loop
A Kubernetes controller acts like a thermostat for your cluster, constantly working to make the actual state match your desired state. It's the engine behind Deployments and ReplicaSets, ensuring the right number of pods are always running.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like ubuntu:22.04 on your linux/amd64 machine.
Docker Compose Secrets: Keep Credentials Out of Your Code
Docker Compose Secrets inject sensitive data into containers as files at runtime, keeping credentials out of your version-controlled docker-compose.yml. Use them for API keys and passwords. The footgun: your app must read from a file, not an env var.
Extending Compose Files for Different Environments
Think of extending Compose files like CSS for your services; a base file defines the structure, and override files style it for different environments. This is used to manage settings like local code mounts for dev vs. restart policies for prod.
Docker Compose Profiles: Activate Service Groups
Docker Compose profiles let you toggle groups of services on or off within a single compose.yaml file. Use it to separate your core app from debugging utilities or to define a "local dev" setup versus a "CI" setup.
Docker Image Scanning: A Background Check for Your Code
Docker image scanning is a background check for your software dependencies, checking packages against known vulnerability lists (CVEs). It's used in CI/CD to block vulnerable builds and in registries for continuous monitoring.
Docker Multi-stage Builds: Slimmer, Faster Images
Treat your Dockerfile like a pipeline: build your app in one stage with all its tools, then copy only the final artifact to a clean production stage. This keeps images small by excluding build-time dependencies.
seccomp: A Kernel-Level Allowlist for Syscalls
seccomp is a Linux kernel firewall for system calls (syscalls), restricting which operations a process can request. Docker and Kubernetes use it to harden containers against exploits. The footgun is creating a custom profile so restrictive it breaks your app.
Container Runtime Shim: Decoupling the Container Lifecycle
A runtime shim is a small process that decouples the container daemon (like containerd) from the container itself. This lets the daemon restart without killing running containers.
OCI Runtime Spec: The 'How to Run' Standard for Containers
The OCI Runtime Spec is the universal instruction manual for executing a container. It defines a standard config.json and lifecycle actions, ensuring a container runs the same way across different runtimes like runc or crun.
Union File Systems: Docker's Layered Magic
A Union File System stacks read-only layers and adds a writable one on top, like transparent overlays. This lets containers share base images, saving disk space, while isolating changes via copy-on-write. The footgun is performance on write-heavy apps.
The Ambassador Pattern: Your App's Diplomatic Sidecar
The Ambassador pattern places a proxy next to your application to handle its network communication, like a diplomat. This adds modern features like monitoring, security, and retries to legacy apps or across languages without changing app code.
The Sidecar Pattern: Offload and Isolate Application Logic
The Sidecar Pattern attaches a helper container to your main application, like a sidecar on a motorcycle. It offloads tasks like logging or proxying, letting you add features without changing the main app's code. The footgun is over-engineering a solution.
Circuit Breaker Pattern: Fail Fast, Not Hard
A circuit breaker wraps network calls to prevent cascading failures. It monitors for errors, and if a service seems down, it 'trips' to fail requests instantly without hitting the network. This gives the failing service time to recover.
Explainable AI (XAI): Why Did the Model Do That?
Explainable AI (XAI) translates a model's 'black box' decision into a human-readable reason. Use it to debug predictions, build user trust, or meet regulatory needs. The footgun: explanations are approximations of the model's logic, not absolute truth.
Model Drift: When Good Models Go Bad
A model is a snapshot of the world; model drift is the alarm that fires when the world changes but your snapshot has not. It detects when production data no longer statistically matches the training data, a common issue for models predicting user behavior.
Distributed Model Training: Splitting the Workload
Don't wait for one GPU to finish; use many. Distributed training splits a model's workload across multiple processors to finish faster. It's essential for massive deep learning models.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles