Intermediate everything in DevOps & Cloud, page 6
How do you restrict a Pod's access to a Secret?
Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.
How do you let Pods pull from a private registry?
Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Bind mounts versus named volumes
A bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).
Compose image directive versus build directive
Image pulls a prebuilt image from a registry; build builds from a local Dockerfile and context; use build for your own custom application code.
Manage startup order and readiness in Compose
Depends_on only orders start, not readiness; add a healthcheck to the DB and use depends_on with condition: service_healthy so the web app waits until the DB passes its health check.
Docker Compose default networking
Compose creates one default user-defined bridge network for the project; all services join it and reach each other by service name via embedded DNS, isolated from other projects.
What is a dangling image and how to prune it
A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.
Debug a running container with the Docker CLI
Docker inspect for full state and config, docker logs -f to follow output live, docker exec -it <id> sh or bash for an interactive shell.
Multi-stage builds for compiled languages
Build in a stage with the full toolchain, then COPY --from only the artifact into a tiny final base, shrinking image size and attack surface.
Optimize Dockerfile layer caching for npm install
Copying all source first invalidates the npm install layer on any code change; instead copy package.json and lockfile, run npm install, then copy the rest.
Migrating a stateful monolith to the cloud
Assess and inventory, pick a migration pattern like rehost or replatform, handle data migration and cutover, mitigate downtime and data-loss risk.
Diagnosing slow auto-scaled PaaS workloads
Application metrics like request latency, throughput, and DB query time; infrastructure metrics like CPU, memory, and scaling lag.
Blue/green versus canary deployments
Blue/green flips all traffic between two full environments; canary shifts a small slice gradually while watching metrics.
High availability versus fault tolerance
HA minimizes downtime via redundancy and failover; fault tolerance survives failure with zero interruption.
Difference between metrics and logs
Metrics are aggregated numeric time series good for trends and alerting; logs are discrete timestamped event records good for detailed root-cause analysis.
Design a multi-tenant model serving platform
Share infrastructure to cut cost while enforcing tenant data isolation, fair resource allocation against noisy neighbors, and per-tenant performance via quotas and autoscaling.
Event bus versus message queue for triggers
A queue is point-to-point buffered work for one consumer group; an event bus routes and filters one event to many decoupled subscribers. Event bus wins when many independent services must react.
Optimize cost of a big-data analytics platform
Storage tiering and lifecycle plus compression and partitioning; compute via spot instances, right-sizing, and efficient file formats; query and pipeline optimization to scan less data.
Strangler Fig with serverless and an event bus
API Gateway acts as the routing facade, new features run as Lambda functions, an event bus decouples and fans out to new services, and traffic shifts feature by feature until the monolith…
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles