Easy everything in Docker & Kubernetes
kube-state-metrics versus node-exporter
Kube-state-metrics exposes API object state (deployment replicas, pod phase, restarts) from the control plane, while node-exporter exposes OS-level hardware metrics (CPU, memory, disk) per…
Viewing pod logs and durable log collection
Kubectl logs (with -c, --previous, -f) reads container stdout/stderr; because that storage is ephemeral, run a node-level logging agent as a DaemonSet shipping logs to a central store.
First NetworkPolicy flips a pod to default-deny
Once any policy selects a pod for a direction, that direction becomes default-deny and only explicitly allowed traffic passes; unselected pods stay open.
Role versus ClusterRole in RBAC
Role is namespaced, ClusterRole is cluster-wide and covers cluster-scoped resources, and you grant either via a RoleBinding (namespaced) or ClusterRoleBinding (cluster-wide) to a subject.
How do you stop new Pods scheduling on a node?
Kubectl cordon marks the node unschedulable so no new Pods land, while existing Pods keep running; drain is the follow-up that also evicts them.
How do you pin a Pod to nodes with a given label?
The simplest tool is nodeSelector, a key-value map in the Pod spec requiring matching node labels; node affinity is the richer alternative for complex rules.
Requests vs limits for CPU and memory?
Requests guide scheduling and reservation, limits cap usage; exceeding a CPU limit throttles the container, while exceeding a memory limit triggers an OOMKill since memory is incompressible.
Bind mounts vs named volumes for persisting Docker data?
Persist data outside the writable container layer via a bind mount (a host path you control) or a named volume (Docker-managed under its data dir, portable and the recommended default).
What happens to volume data when a Pod is deleted?
EmptyDir is tied to the Pod and erased when the Pod is deleted; a PVC-backed PV with Retain keeps the data after the PVC is released for manual recovery.
What are PersistentVolumes and PersistentVolumeClaims for?
A PV is a cluster storage resource the admin provisions; a PVC is a user's request for size and access mode; Kubernetes binds them, decoupling Pods from storage details.
How Compose services reach each other by name
Services share a default network and the web app uses the database's service name as the hostname; Docker's embedded DNS resolves it to the container IP.
Persist PostgreSQL data across compose down
Define a named volume and mount it at the database's data directory (/var/lib/postgresql/data); named volumes survive compose down.
Start Compose services detached and view one service's logs
Docker compose up -d starts everything detached; docker compose logs -f web follows only the web service's logs.
Dockerfile CMD versus ENTRYPOINT
ENTRYPOINT sets the fixed executable; CMD sets default args or the default command; run-time args override CMD but append to ENTRYPOINT. Use together to make a fixed binary with overridable defaults.
Dockerfile COPY versus ADD
COPY just copies local files; ADD also auto-extracts local tarballs and can fetch remote URLs; prefer COPY for predictability, use ADD for local archive extraction.
Build, tag, and run a container with port mapping
Docker build -t my-app:1.0 . to build and tag; docker run -d -p 8080:80 my-app:1.0 to run detached with host:container port mapping.
What is a container vs a VM?
Containers share the host kernel and isolate via namespaces and cgroups; VMs run a full guest OS on a hypervisor; containers are lighter and faster.
The sidecar proxy pattern in a mesh
A proxy container shares the pod, all in/out traffic is redirected through it, so policy and telemetry apply without code changes.
What a service mesh solves
It adds traffic management, security via mTLS, and observability at the network layer through sidecars, beyond what plain Kubernetes offers.
Creating an instance of a custom resource
Write a manifest with apiVersion (group/version), kind, metadata.name, and a spec matching the CRD schema, then kubectl apply -f it.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles