Intermediate interview questions in Docker & Kubernetes, page 4
What makes a process a container to the kernel
Namespaces isolate and cgroups limit, but also capabilities, seccomp filters, mount/pivot_root for the rootfs, and SELinux/AppArmor labels.
Container registries: public vs private
A registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation.
Impact of losing etcd quorum
Without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods.
Scaling on queue length with the HPA
Expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this.
Docker layers and build cache efficiency
Each instruction makes a content-addressed read-only layer stacked by a union FS; shared layers are pushed/pulled once, and ordering the Dockerfile so volatile steps come last maximizes cache reuse.
Image signing with Cosign vs trusting a digest
A digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission.
How mounted ConfigMap updates propagate to pods
Kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
Mesh control plane vs data plane availability
The control plane configures and distributes policy; the data plane is the sidecars carrying traffic with cached config, so a brief control-plane outage keeps existing traffic flowing but…
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles