Intermediate everything in DevOps & Cloud, page 12
AWS Fault Injection Simulator
AWS Fault Injection Simulator is a controlled chaos button: it breaks resources on purpose to prove your failover works before real disasters. Run it before peak traffic to validate auto-healing.
Explain layered filesystems like OverlayFS and their efficiency vs monolithic models
This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.
Describe the relationship between containerd and runc in starting a container.
Tests the OCI runtime split and lifecycle ownership. A great answer states containerd handles image pull, storage, and API lifecycle, then invokes runC to spawn the isolated process.
How do containers enforce CPU and memory limits via cgroups?
Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config.
Name three Linux namespaces and explain what each one isolates.
Name three of PID, Network, Mount, UTS, IPC, User, Cgroup, Time; say what each hides; cite CLONE_NEW* or /proc/pid/ns.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
Container Images Are Stacked Deltas
Images stack read-only layers like transparent sheets, one per Dockerfile step, topped by a thin writable layer. This enables cache reuse and fast pulls. The footgun: removing a file in a later layer hides but does not delete it; those bytes still ship.
OLM: Kubernetes' App Store for Operators
OLM is the app store for Kubernetes Operators: it installs, updates, and resolves dependencies declaratively. Use it when managing third-party or custom Operators across clusters.
ResourceQuota: Namespace Resource Budgets
ResourceQuota is a namespace budget: it rejects pods once total requests hit the cap. Use it to keep multi-tenant clusters fair. The footgun: it counts requested resources, not real usage, and pods missing requests may be rejected without LimitRange defaults.
OCI: The USB-C of Containers
OCI is the USB-C of containers: open standards that let any compliant runtime execute any image. It prevents vendor lock-in by decoupling image format from runtime. The footgun is treating "Docker image" as proprietary rather than an OCI-compliant bundle.
Kappa Architecture Unifies Batch and Stream
Kappa treats batch as a special case of streaming: store every event in an immutable log, compute views in real time, and replay the log when logic changes. It removes Lambda's dual codebase but forces you to pay for infinite retention and replay costs.
AWS Cost and Usage Report (CUR)
Think of CUR as your AWS itemized receipt, delivered daily to S3. It breaks down charges by hour, product, resource, and tag for spreadsheets or Athena queries. Mid-month numbers are estimates, so do not lock budgets until the report finalizes after invoicing.
CloudEvents: The Event Data Standard
CloudEvents provides a common envelope for event data, enabling routing without custom parsers. Use it when events cross clouds, SaaS tools, or internal services. It standardizes wrappers, not payloads, so producers and consumers still need aligned schemas.
GitLab Flex merges seats and AI into one budget
GitLab Flex reshapes one annual budget monthly across seats, AI credits, and features without re-procurement. Engineering leaders can shift spend from idle seats to agent usage instead of guessing headcount six months out. Ask at renewal.
GitLab Orbit unifies code lifecycle in live graph
GitLab Orbit beta unifies code, pipelines, and ownership in a live graph. Compare the Market tests show Orbit-grounded reviewers hit 70% accuracy versus 58% for RAG.
GitLab patches 13 CVEs including SAML account takeover flaw
GitLab 19.0.2, 18.11.5, and 18.10.8 patch 13 security flaws, including four High-severity CVEs like SAML account takeover (CVSS 8.7) and unauthenticated API DoS. Self-managed instances must upgrade immediately; GitLab.com is already patched.
Design a golden path CI/CD pipeline for a Go API
Propose build, test, SAST, containerize, deploy stages with hooks or config overlays for flexibility.
Design a workflow for managing security scanner vulnerabilities
This tests scaling security without developer noise fatigue. A strong answer covers centralized ingestion, severity SLAs with exploitability, auto-triage rules, and CI gates on critical findings only. A red flag is forcing manual review of all scanner output.
What strategies reduce DAST scan time while maintaining security coverage?
It tests balancing security depth with CI velocity through DAST tuning. A strong answer covers incremental scans, parallel workers, scoped targets, and shift-left complements.
Design short-lived dynamic database credentials and their security benefits
This tests automated least-privilege credential lifecycle design. A strong answer covers a secrets broker with database plugins, short TTL leases tied to workload identity, and automatic revocation. Red flag: manual rotation or long-lived CI variables.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles