Intermediate everything in Docker & Kubernetes, page 2
What is a StorageClass and dynamic provisioning?
A StorageClass names a provisioner and parameters; a PVC referencing it triggers on-demand PV creation, so admins do not pre-create volumes.
StatefulSet vs Deployment: what's the difference?
Deployments treat Pods as interchangeable; StatefulSets give stable ordinal names, stable per-Pod storage via volumeClaimTemplates, and ordered rollout.
How do you restrict a Pod's access to a Secret?
Pods read Secrets through their ServiceAccount and RBAC, scoped with resourceNames; mounted Secrets are governed by the Pod spec.
How do you let Pods pull from a private registry?
Create a dockerconfigjson Secret with registry creds; reference it via imagePullSecrets on the Pod or ServiceAccount.
Are base64-encoded Kubernetes Secrets actually secure?
Base64 is reversible, not a protection; default guards against accidental shoulder-surfing only; real defenses are encryption-at-rest, RBAC, audit.
Bind mounts versus named volumes
A bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).
Compose image directive versus build directive
Image pulls a prebuilt image from a registry; build builds from a local Dockerfile and context; use build for your own custom application code.
Manage startup order and readiness in Compose
Depends_on only orders start, not readiness; add a healthcheck to the DB and use depends_on with condition: service_healthy so the web app waits until the DB passes its health check.
Docker Compose default networking
Compose creates one default user-defined bridge network for the project; all services join it and reach each other by service name via embedded DNS, isolated from other projects.
What is a dangling image and how to prune it
A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.
Debug a running container with the Docker CLI
Docker inspect for full state and config, docker logs -f to follow output live, docker exec -it <id> sh or bash for an interactive shell.
Multi-stage builds for compiled languages
Build in a stage with the full toolchain, then COPY --from only the artifact into a tiny final base, shrinking image size and attack surface.
Optimize Dockerfile layer caching for npm install
Copying all source first invalidates the npm install layer on any code change; instead copy package.json and lockfile, run npm install, then copy the rest.
Mesh control plane vs data plane availability
The control plane configures and distributes policy; the data plane is the sidecars carrying traffic with cached config, so a brief control-plane outage keeps existing traffic flowing but…
How mounted ConfigMap updates propagate to pods
Kubelet refreshes mounted files within roughly a sync period via an atomic symlink swap, but the app must reload on its own; env-var injection never updates.
Image signing with Cosign vs trusting a digest
A digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission.
Docker layers and build cache efficiency
Each instruction makes a content-addressed read-only layer stacked by a union FS; shared layers are pushed/pulled once, and ordering the Dockerfile so volatile steps come last maximizes cache reuse.
Scaling on queue length with the HPA
Expose queue length through an external metrics adapter behind the metrics API, point the HPA at that external metric with a target per pod; KEDA packages this.
Impact of losing etcd quorum
Without quorum etcd goes read-only-ish and the API server cannot persist writes, so scheduling and changes stall, but kubelets keep running existing pods.
Container registries: public vs private
A registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles