Advanced everything in Docker & Kubernetes, page 2
Trace a container process's syscalls from the host
Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.
What is the OCI and why do its specs matter?
OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.
Method-aware authorization with Istio policy
An ALLOW policy on user-service granting frontend's principal POST plus the users path, another granting all principals GET; deny is implicit once any ALLOW exists.
Diagnosing latency with distributed tracing
Follow the trace ID across spans, compare per-span durations to find the slow hop, distinguish service time from network and queueing.
Preventing split-brain in HA Operators
Run active-passive replicas, only the leader reconciles, election uses a Lease object renewed under a TTL.
Mutating vs Validating webhooks with an Operator
Mutating runs first to inject defaults or sidecars, validating runs after to reject bad specs, both keyed to your CRD.
Keeping operator .status accurate under failures
Status can lag or go stale during partitions and crashes; make reconcile idempotent, observe true state each loop, use conditions and observedGeneration, handle conflicts.
Helm migration hooks under GitOps
Use a pre-upgrade hook Job with weights and delete policy; the challenge is GitOps tools render statically and reconcile, conflicting with Helm's imperative hook lifecycle.
GitOps repo layout for environment promotion
Shared base plus per-env overlays via Kustomize or value files, promotion by PR moving a pinned version forward, separating app source from config repos.
Head-based vs tail-based trace sampling
Head decides up front (cheap, may miss rare errors); tail decides after the trace completes (catches errors and slow traces but needs buffering).
Diagnose a Prometheus cardinality explosion
Find offenders via TSDB stats and topk count by __name__, identify unbounded labels, then drop or aggregate them with relabeling.
Ingress resource vs Ingress controller
The Ingress resource is declarative routing rules; the controller is the running proxy (NGINX, etc.) that reads them and serves traffic.
Restricting Pod ingress with a NetworkPolicy
Create a NetworkPolicy with podSelector app=frontend, policyTypes Ingress, and one ingress from-rule matching podSelector role=api-gateway; requires a CNI that enforces policies.
kube-proxy and iptables vs IPVS modes
Kube-proxy watches Services/endpoints and programs node rules so ClusterIP traffic is DNAT'd to a backend Pod; iptables uses sequential rule chains, IPVS uses a hash table with real…
Spreading Pods one-per-node for availability
Use required podAntiAffinity with topologyKey kubernetes.io/hostname matching the Deployment's own pod labels, so the scheduler refuses to co-locate two Pods on a node.
Stalled rollouts and progressDeadlineSeconds
With maxUnavailable respected, the rollout pauses partway and old Pods keep serving; progressDeadlineSeconds marks the Deployment as failed after no progress for that window.
Tuning maxSurge and maxUnavailable
MaxSurge allows Pods above desired; maxUnavailable allows Pods below desired during update. For zero downtime and speed, set maxUnavailable 0 and maxSurge high (e.g. 100%).
CRDs and the Operator pattern
CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.
Scheduler filtering and scoring phases
Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.
Reducing cross-region image pull costs
A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles