Advanced everything in DevOps & Cloud, page 4
Pass build-time secrets securely with BuildKit
Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Run a container as a non-root user
Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
Trace a container process's syscalls from the host
Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
What is the OCI and why do its specs matter?
OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.
Migrate an OLTP database with minimal downtime
Take an initial bulk load, then use change data capture to replicate ongoing changes until source and target are in sync, validate, then cut over during a brief window with a rollback plan.
Design an enterprise cloud landing zone
Multi-account or subscription structure, centralized identity and SSO, network topology like hub-and-spoke, guardrails via policy and SCPs, and centralized logging.
Technical challenges of a multi-cloud strategy
Data consistency and egress costs across providers, cross-cloud networking and latency, and federating disparate IAM systems, plus operational and tooling overhead.
Design petabyte-scale distributed training
Object storage with columnar formats, distributed preprocessing, a data-parallel framework with efficient sharded loading, and managed orchestration.
Design auto drift detection and retraining
Capture inputs and predictions, compute data and concept drift metrics on a schedule, alert on threshold breach, and trigger a retraining and redeploy pipeline.
Schema evolution without rewriting history
Use a table format with metadata-level evolution, add a new column rather than mutating the old, and reconcile types at read time; avoid rewriting petabytes.
The small files problem in data lakes
Too many tiny files inflate metadata and per-file overhead, slowing queries; caused by streaming micro-batches and over-partitioning; fix with compaction and table formats like Iceberg, Delta, or Hudi.
Resilient stateful batch on Spot Instances
Externalize state and checkpoint to durable storage, react to interruption and rebalance notices to drain gracefully, diversify instance pools.
Designing a multi-account cloud chargeback model
Account-per-team or mandatory cost-allocation tags enforced by SCPs and tag policies, plus a pipeline over the cost and usage report grouped by tag/account.
Savings Plans vs Reserved Instances for mixed compute
Compute Savings Plans cover EC2, Fargate, and Lambda flexibly; EC2 Instance Plans and RIs trade flexibility for slightly deeper discounts.
Design automated cloud cost optimization
Target idle resources, oversized instances, orphaned storage, and commitment gaps; act via rightsizing and cleanup; safeguard with tagging, scoping, and approvals.
Monitoring with SLOs and error budgets
Define SLIs from the user's view, set SLO targets, derive an error budget, and alert on burn rate rather than raw thresholds.
Strategy for large multi-team IaC projects
Versioned reusable modules, state split per environment and component, promotion of identical code via variables, and externalized secrets.
High-throughput serverless stream processing
Partition by key for per-user ordering, use a sharded log with batched consumers for backpressure, and tune batch size and shards for cost.
Serverless functions with a relational database
Concurrent function instances each open connections and exhaust the database's bounded pool; fix with a connection proxy or pooler, init-phase reuse, or capped concurrency.
Debug intermittent pod-to-pod connectivity
Scope the failure by path, rule out DNS, inspect kube-proxy iptables and conntrack, check the CNI, then verify cloud security groups and MTU.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles