Intermediate everything in DevOps & Cloud, page 21
Kubernetes Ingress: The Cluster's Smart Receptionist
Ingress acts as a smart receptionist for your cluster, routing external HTTP/S traffic to internal services based on host or path. This lets you expose many apps with one load balancer.
Kubernetes CronJob: Scheduled Tasks in Your Cluster
A Kubernetes CronJob is like a recurring alarm for your cluster. It automatically runs tasks like backups or reports on a schedule, creating a new Job for each run. The main footgun is concurrency: by default, jobs can overlap if one runs too long.
Init Containers: Setup Tasks Before Your Main App Runs
Init containers are setup tasks that run to completion before your main application starts. Use them to wait for dependencies, fetch configs, or run database migrations.
Kubernetes Probes: Liveness, Readiness, and Startup
Kubernetes probes ask your app about its health. Liveness asks 'are you alive?' (restart if not), readiness asks 'can you take work?' (pause traffic if not), and startup protects slow-starting apps. This is key for self-healing and zero-downtime deployments.
Kubelet: The Node Agent of Kubernetes
The kubelet is the primary agent on each Kubernetes node, ensuring containers described in PodSpecs are running and healthy. It watches the API server for work and reports status back. The footgun is trying to manage it directly; always use the API server.
etcd: Kubernetes's Single Source of Truth
etcd is the distributed key-value store that acts as the brain for a Kubernetes cluster, storing its entire configuration and state. The API server uses it to persist all objects, from Pods to Secrets.
Docker Registry Mirror: A Local Cache for Faster Pulls
A registry mirror is like a CDN for Docker images, caching public images on your local network to speed up pulls and avoid rate limits. Use it in CI/CD pipelines to reduce build times. The footgun: you can't docker push to a mirror; it's a.
Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like :latest. The footgun is assuming a tag is immutable.
Artifact Registry: Google's Universal Package Manager
Artifact Registry is a private, universal package manager for all your software components, not just Docker images. Use it to store your company's Docker images, Java JARs, and Helm charts in one place, integrated with GCP CI/CD.
Amazon EC2: Rentable Virtual Servers on AWS
Amazon EC2 is like renting virtual computers, letting you run applications without buying physical hardware. It's used for scalable deployments where you can launch and terminate servers as needed, paying only for what you use.
Building Images with Docker Compose
Docker Compose builds images from a compose.yml file, turning a Dockerfile into a runnable service within a multi-container app. It's for local dev where you need a database and backend to start together. The footgun: up won't rebuild without --build.
Docker Compose: Control Startup with `depends_on`
depends_on controls service startup order in Docker Compose, ensuring a database starts before your app. The footgun: it only waits for the container to start, not for the application inside to be ready. Use healthcheck for true readiness.
Environment Variables in Docker Compose
Environment variables are the runtime knobs for your Docker Compose services, letting you pass configuration like API keys or database URLs without rebuilding your image. Use them to connect services or set feature flags.
Docker Compose Networking: How Services Talk to Each Other
Docker Compose puts your services on a private network, letting them communicate using service names as hostnames. This is how a 'web' container finds your 'db' container. The footgun is using localhost; always use the service name for inter-container calls.
The .dockerignore File: Keep Your Build Context Lean
.dockerignore is like .gitignore for your Docker build. It tells the daemon which files to exclude from the build context, preventing large or sensitive files from slowing your build and bloating your image. The footgun is forgetting it and sending everything.
Docker Build Cache: Don't Rebuild What Hasn't Changed
Docker's build cache is like a saved game for your image layers. It skips rebuilding if instructions and files haven't changed. A common footgun is an early COPY . . command, which can invalidate the cache for all subsequent steps on every code change.
Docker Networking: How Containers Talk to Each Other
Docker gives each container its own isolated network, preventing port conflicts. Containers connect via networks, like bridge for local communication. For containers to find each other by name, you must use a user-defined bridge network; the default one…
Docker Volumes: Persistent Data for Ephemeral Containers
Think of a Docker Volume as an external hard drive for your container. It persists data even after a container is removed, perfect for databases or user uploads. The footgun is confusing volumes with bind mounts, which are less portable.
Container Runtime: The Engine That Runs Your Containers
A container runtime is the low-level engine that executes containers. Kubernetes uses a runtime like containerd or CRI-O on each node to pull images and manage container lifecycles.
Linux cgroups: Resource Fences for Processes
Cgroups are resource fences for processes, letting the Linux kernel enforce CPU and memory limits. Container runtimes use them to isolate containers, which is how Kubernetes enforces Pod resource limits.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles