Intermediate concepts in Docker & Kubernetes
Linux Namespaces: A Virtual Slice of the OS
Linux namespaces give a process a virtualized slice of OS resources, like its own process tree or network stack. This is the core magic behind containers, providing the illusion of a separate machine without the overhead of a full virtual machine.
Linux cgroups: Resource Fences for Processes
Cgroups are resource fences for processes, letting the Linux kernel enforce CPU and memory limits. Container runtimes use them to isolate containers, which is how Kubernetes enforces Pod resource limits.
Container Runtime: The Engine That Runs Your Containers
A container runtime is the low-level engine that executes containers. Kubernetes uses a runtime like containerd or CRI-O on each node to pull images and manage container lifecycles.
OCI: The USB-C of Containers
OCI is the USB-C of containers: open standards that let any compliant runtime execute any image. It prevents vendor lock-in by decoupling image format from runtime. The footgun is treating "Docker image" as proprietary rather than an OCI-compliant bundle.
Docker Volumes: Persistent Data for Ephemeral Containers
Think of a Docker Volume as an external hard drive for your container. It persists data even after a container is removed, perfect for databases or user uploads. The footgun is confusing volumes with bind mounts, which are less portable.
Docker Networking: How Containers Talk to Each Other
Docker gives each container its own isolated network, preventing port conflicts. Containers connect via networks, like bridge for local communication. For containers to find each other by name, you must use a user-defined bridge network; the default one…
Docker Build Cache: Don't Rebuild What Hasn't Changed
Docker's build cache is like a saved game for your image layers. It skips rebuilding if instructions and files haven't changed. A common footgun is an early COPY . . command, which can invalidate the cache for all subsequent steps on every code change.
The .dockerignore File: Keep Your Build Context Lean
.dockerignore is like .gitignore for your Docker build. It tells the daemon which files to exclude from the build context, preventing large or sensitive files from slowing your build and bloating your image. The footgun is forgetting it and sending everything.
Docker Compose Networking: How Services Talk to Each Other
Docker Compose puts your services on a private network, letting them communicate using service names as hostnames. This is how a 'web' container finds your 'db' container. The footgun is using localhost; always use the service name for inter-container calls.
Environment Variables in Docker Compose
Environment variables are the runtime knobs for your Docker Compose services, letting you pass configuration like API keys or database URLs without rebuilding your image. Use them to connect services or set feature flags.
Docker Compose: Control Startup with `depends_on`
depends_on controls service startup order in Docker Compose, ensuring a database starts before your app. The footgun: it only waits for the container to start, not for the application inside to be ready. Use healthcheck for true readiness.
Building Images with Docker Compose
Docker Compose builds images from a compose.yml file, turning a Dockerfile into a runnable service within a multi-container app. It's for local dev where you need a database and backend to start together. The footgun: up won't rebuild without --build.
Amazon EC2: Rentable Virtual Servers on AWS
Amazon EC2 is like renting virtual computers, letting you run applications without buying physical hardware. It's used for scalable deployments where you can launch and terminate servers as needed, paying only for what you use.
Artifact Registry: Google's Universal Package Manager
Artifact Registry is a private, universal package manager for all your software components, not just Docker images. Use it to store your company's Docker images, Java JARs, and Helm charts in one place, integrated with GCP CI/CD.
Image Digest: The Immutable Image Identifier
An image digest is a unique fingerprint for a container image, guaranteeing you get the exact version you expect. Use it in production to pin an image, preventing unexpected updates from mutable tags like :latest. The footgun is assuming a tag is immutable.
Docker Registry Mirror: A Local Cache for Faster Pulls
A registry mirror is like a CDN for Docker images, caching public images on your local network to speed up pulls and avoid rate limits. Use it in CI/CD pipelines to reduce build times. The footgun: you can't docker push to a mirror; it's a.
etcd: Kubernetes's Single Source of Truth
etcd is the distributed key-value store that acts as the brain for a Kubernetes cluster, storing its entire configuration and state. The API server uses it to persist all objects, from Pods to Secrets.
Kubelet: The Node Agent of Kubernetes
The kubelet is the primary agent on each Kubernetes node, ensuring containers described in PodSpecs are running and healthy. It watches the API server for work and reports status back. The footgun is trying to manage it directly; always use the API server.
Kubernetes Probes: Liveness, Readiness, and Startup
Kubernetes probes ask your app about its health. Liveness asks 'are you alive?' (restart if not), readiness asks 'can you take work?' (pause traffic if not), and startup protects slow-starting apps. This is key for self-healing and zero-downtime deployments.
Init Containers: Setup Tasks Before Your Main App Runs
Init containers are setup tasks that run to completion before your main application starts. Use them to wait for dependencies, fetch configs, or run database migrations.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles