Intermediate concepts in Docker & Kubernetes, page 4
CSI Volume Cloning: `cp` for Kubernetes Volumes
Think of volume cloning as cp for your Kubernetes data. It creates a new, independent volume pre-populated with data from an existing one, offloading the copy operation to your storage provider.
Pod Topology Spread: Spreading Pods for High Availability
Pod Topology Spread Constraints prevent putting all your pods in one basket. They instruct the scheduler to distribute a service's pods evenly across nodes or zones, improving availability. The main footgun is that it's a soft preference by default.
OPA Gatekeeper: Enforce Kubernetes Policies as Code
OPA Gatekeeper is a Kubernetes admission controller using OPA to enforce policies on resources. Use it to mandate labels or block insecure images. The footgun is thinking it's just OPA; Gatekeeper adds K8s-native CRDs, auditing, and mutation capabilities.
Kubebuilder: Build Kubernetes APIs the Canonical Way
Kubebuilder is a framework for scaffolding custom Kubernetes APIs, letting you define your own resources like MyWebApp. Use it to extend Kubernetes with declarative APIs, making your app a first-class citizen.
Container Images Are Stacked Deltas
Images stack read-only layers like transparent sheets, one per Dockerfile step, topped by a thin writable layer. This enables cache reuse and fast pulls. The footgun: removing a file in a later layer hides but does not delete it; those bytes still ship.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles