Advanced concepts in Docker & Kubernetes
Union File Systems: Docker's Layered Magic
A Union File System stacks read-only layers and adds a writable one on top, like transparent overlays. This lets containers share base images, saving disk space, while isolating changes via copy-on-write. The footgun is performance on write-heavy apps.
OCI Runtime Spec: The 'How to Run' Standard for Containers
The OCI Runtime Spec is the universal instruction manual for executing a container. It defines a standard config.json and lifecycle actions, ensuring a container runs the same way across different runtimes like runc or crun.
Container Runtime Shim: Decoupling the Container Lifecycle
A runtime shim is a small process that decouples the container daemon (like containerd) from the container itself. This lets the daemon restart without killing running containers.
seccomp: A Kernel-Level Allowlist for Syscalls
seccomp is a Linux kernel firewall for system calls (syscalls), restricting which operations a process can request. Docker and Kubernetes use it to harden containers against exploits. The footgun is creating a custom profile so restrictive it breaks your app.
Docker Multi-stage Builds: Slimmer, Faster Images
Treat your Dockerfile like a pipeline: build your app in one stage with all its tools, then copy only the final artifact to a clean production stage. This keeps images small by excluding build-time dependencies.
Docker Image Scanning: A Background Check for Your Code
Docker image scanning is a background check for your software dependencies, checking packages against known vulnerability lists (CVEs). It's used in CI/CD to block vulnerable builds and in registries for continuous monitoring.
Docker Compose Profiles: Activate Service Groups
Docker Compose profiles let you toggle groups of services on or off within a single compose.yaml file. Use it to separate your core app from debugging utilities or to define a "local dev" setup versus a "CI" setup.
Extending Compose Files for Different Environments
Think of extending Compose files like CSS for your services; a base file defines the structure, and override files style it for different environments. This is used to manage settings like local code mounts for dev vs. restart policies for prod.
Docker Compose Secrets: Keep Credentials Out of Your Code
Docker Compose Secrets inject sensitive data into containers as files at runtime, keeping credentials out of your version-controlled docker-compose.yml. Use them for API keys and passwords. The footgun: your app must read from a file, not an env var.
OCI Image Manifest: The Recipe for a Container Image
An OCI Image Manifest is the recipe for a single container image, listing its configuration and filesystem layers for one specific architecture. It's what a runtime uses to assemble an image like ubuntu:22.04 on your linux/amd64 machine.
Harbor: A Private, Secure Artifact Registry
Think of Harbor as a private Docker Hub with built-in security. Use it to scan images for vulnerabilities, enforce role-based access control, and sign artifacts before deploying to Kubernetes.
Container Image Signing: Verifying What You Run
Think of image signing as a digital "tamper-evident seal" on your containers. It proves who built an image and that it hasn't been altered. This is crucial for production systems to prevent running malicious code.
Kubernetes Controllers: The Reconciliation Loop
A Kubernetes controller acts like a thermostat for your cluster, constantly working to make the actual state match your desired state. It's the engine behind Deployments and ReplicaSets, ensuring the right number of pods are always running.
kube-scheduler: The Cluster's Matchmaker
The kube-scheduler is your cluster's matchmaker, assigning new Pods to the best possible Node based on their needs. This is the default workload placement engine. The footgun is thinking it runs Pods; it only *assigns* them to a Node.
kube-controller-manager: The Cluster's Reconciliation Engine
The kube-controller-manager is Kubernetes' reconciliation engine, running multiple control loops to make the cluster's actual state match your desired state. It handles tasks like ensuring a Deployment has the correct pod count.
Pod QoS Classes: Guaranteed, Burstable, BestEffort
Kubernetes QoS classes are eviction priorities, not performance guarantees. Under node pressure, the kubelet kills BestEffort pods first, then Burstable, then Guaranteed. Omitting limits does not grant infinite headroom; it makes your pod die first.
Pod Disruption Budgets: Stop Upgrades From Killing Your App
A Pod Disruption Budget (PDB) is a contract with Kubernetes to maintain minimum availability. It limits how many pods can be voluntarily terminated at once during node drains or cluster upgrades, preventing self-inflicted outages.
Pod Affinity: Grouping or Separating Your Pods
Pod affinity tells Kubernetes to place pods together for performance or apart for high availability. Use it to co-locate a web server and cache for low latency, or spread database replicas across nodes to prevent a single point of failure.
EndpointSlice: Splitting the Monolithic Endpoints List
EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.
Kubernetes NetworkPolicy: A Firewall for Pods
NetworkPolicy is a firewall for pods, locking down traffic in a cluster where everything can talk to everything by default. Use it to isolate services, like preventing a web frontend from directly accessing a database.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles