More in DevOps & Cloud — page 10
Bind mounts vs named volumes for persisting Docker data?
WHAT IT TESTS: Docker storage options. OUTLINE: persist data outside the writable container layer via a bind mount (a host path you control) or a named volume (Docker-managed under its data dir, portable and the recommended default).
What happens to volume data when a Pod is deleted?
WHAT IT TESTS: volume lifecycle awareness. OUTLINE: emptyDir is tied to the Pod and erased when the Pod is deleted; a PVC-backed PV with Retain keeps the data after the PVC is released for manual recovery.
What are PersistentVolumes and PersistentVolumeClaims for?
WHAT IT TESTS: the storage abstraction split. OUTLINE: a PV is a cluster storage resource the admin provisions; a PVC is a user's request for size and access mode; Kubernetes binds them, decoupling Pods from storage details.
How do Sealed Secrets enable GitOps for secrets?
WHAT IT TESTS: asymmetric-crypto GitOps pattern. OUTLINE: kubeseal encrypts a Secret with the controller's public key into a SealedSecret CR safe for Git; only the in-cluster controller's private key can decrypt it into a real Secret.
What do immutable ConfigMaps and Secrets solve?
WHAT IT TESTS: knowledge of the immutable field. OUTLINE: setting immutable true blocks data edits, preventing accidental updates and letting the kubelet skip watches, reducing API server load.
How do you inject secrets from an external store at runtime?
WHAT IT TESTS: external secret-management patterns. OUTLINE: use a sidecar injector or CSI driver that authenticates via the Pod's ServiceAccount token, fetches secrets at runtime, and mounts them on tmpfs.
How do you restrict a Pod's access to a Secret?
WHAT IT TESTS: how Pods get Secret access via identity. OUTLINE: Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.
How do you let Pods pull from a private registry?
WHAT IT TESTS: knowledge of image-pull secrets. OUTLINE: create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.
Are base64-encoded Kubernetes Secrets actually secure?
WHAT IT TESTS: understanding that encoding is not encryption. OUTLINE: base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Bind mounts versus named volumes
WHAT IT TESTS: Docker storage model. OUTLINE: a bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).
Compose image directive versus build directive
WHAT IT TESTS: Compose service definition. OUTLINE: image pulls a prebuilt image from a registry; build builds from a local Dockerfile and context; use build for your own custom application code.
Manage startup order and readiness in Compose
WHAT IT TESTS: dependency vs readiness distinction. OUTLINE: depends_on only orders start, not readiness; add a healthcheck to the DB and use depends_on with condition: service_healthy so the web app waits until the DB passes its health check.
Docker Compose default networking
WHAT IT TESTS: Compose networking internals. OUTLINE: Compose creates one default user-defined bridge network for the project; all services join it and reach each other by service name via embedded DNS, isolated from other projects.
How Compose services reach each other by name
WHAT IT TESTS: Compose service discovery. OUTLINE: services share a default network and the web app uses the database's service name as the hostname; Docker's embedded DNS resolves it to the container IP.
Persist PostgreSQL data across compose down
WHAT IT TESTS: volume persistence basics. OUTLINE: define a named volume and mount it at the database's data directory (/var/lib/postgresql/data); named volumes survive compose down.
Start Compose services detached and view one service's logs
WHAT IT TESTS: basic Compose CLI usage. OUTLINE: docker compose up -d starts everything detached; docker compose logs -f web follows only the web service's logs.
Distroless images: benefits and trade-offs
WHAT IT TESTS: minimal base image strategy. OUTLINE: distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.
Pass build-time secrets securely with BuildKit
WHAT IT TESTS: secure build secret handling. OUTLINE: use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.
Run a container as a non-root user
WHAT IT TESTS: container security hardening. OUTLINE: create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.
What is a dangling image and how to prune it
WHAT IT TESTS: image lifecycle and cleanup. OUTLINE: a dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.