Easy everything in DevOps & Cloud
Critical vm2 sandbox escape (CVSS 10.0) traced to its own README example
GitLab's Threat Research Group found a CVSS 3.1: 10.0 sandbox escape in vm2, a widely used Node.js sandbox library, in a config copied from vm2's own README. Version 3.11.7 fixes the attack, but the underlying risk remains for anyone using require.external. Update immediately and prefer containers for untrusted code.
What is an error budget and how is it used?
The budget is the allowed unreliability (100 percent minus the SLO); track its burn, ship freely when budget remains, and freeze risky changes to focus on reliability when exhausted.
Defining SLIs and an SLO for an auth service?
Pick user-centric SLIs like login availability and latency, measure good over valid events at the right boundary, then set an achievable SLO with a window.
Design a simple chaos experiment for a cache dependency?
Hypothesis that the service degrades gracefully when Redis is unavailable, monitor error rate, latency, DB load, and cache hit rate.
What is blast radius and how do you limit it?
Blast radius is the scope of users or systems an experiment can harm; limit it by targeting a small traffic percentage and by having an automated abort.
How does chaos engineering differ from other testing?
It experiments on real systems by injecting faults to test a steady-state hypothesis, versus verifying known behaviors like integration or load tests.
What is an SLO and how do you define API availability?
SLO is a target on an SLI, availability SLI is good requests over valid requests, you need labeled request counts over a window.
What telemetry must a new microservice ship with?
Metrics for trends like p99 latency and error rate, structured logs for per-request detail, traces for cross-service causality.
Load vs stress vs soak testing
Load tests expected traffic, stress pushes past limits to find the breaking point, soak runs sustained load for hours to expose leaks.
Golden signals for capacity planning
Monitor the four golden signals, latency, traffic, errors, and saturation, from day one, watching percentiles and saturation to forecast scaling.
Automate temporary elevated database access securely
Self-service request with approval, short-lived auto-expiring grants scoped to least privilege, and full audit logging.
Distinguishing toil from necessary ops work
Toil is manual, repetitive, automatable, tactical, and scales with growth; engineering and judgment-heavy work is not toil.
Automating a recurring manual cache clear
Recognize the repetitive manual task, document the runbook, then automate it into the deploy pipeline as a post-deploy hook with monitoring.
Why blameless culture matters for reviews
Blame causes people to hide facts, so reviews miss systemic causes; blamelessness surfaces honest detail.
The 5 Whys root cause technique
Repeatedly ask why to move from symptom to systemic cause, stop at an actionable systemic fix.
Essential sections of a post-mortem
Summary, impact, timeline, root cause, lessons, and owned action items, each with a clear purpose.
Primary goal and sections of a post-mortem
Goal is organizational learning and prevention, not blame; include summary, timeline, impact, root cause, action items.
Triaging a 5xx error spike
Confirm impact and scope, declare and assign roles, check recent changes, stop the bleeding before root cause.
First steps on a p99 latency page
Confirm scope and blast radius, check recent changes and deploys, then look at dependencies and resource saturation.
Symptom-based versus cause-based alerting
Symptom alerts fire on user impact like high error rate or latency; cause alerts fire on internal conditions like high CPU. Page on symptoms, treat causes as diagnostic.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles