Intermediate everything in Docker & Kubernetes, page 4
What happens after kubectl apply
Apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.
Manifest lists and multi-arch images
A manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.
Three techniques to shrink a Docker image
Multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.
Debugging ImagePullBackOff on a private registry
ImagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors.
Explain layered filesystems like OverlayFS and their efficiency vs monolithic models
This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.
Describe the relationship between containerd and runc in starting a container.
Tests the OCI runtime split and lifecycle ownership. A great answer states containerd handles image pull, storage, and API lifecycle, then invokes runC to spawn the isolated process.
How do containers enforce CPU and memory limits via cgroups?
Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config.
Name three Linux namespaces and explain what each one isolates.
Name three of PID, Network, Mount, UTS, IPC, User, Cgroup, Time; say what each hides; cite CLONE_NEW* or /proc/pid/ns.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
Container Images Are Stacked Deltas
Images stack read-only layers like transparent sheets, one per Dockerfile step, topped by a thin writable layer. This enables cache reuse and fast pulls. The footgun: removing a file in a later layer hides but does not delete it; those bytes still ship.
OLM: Kubernetes' App Store for Operators
OLM is the app store for Kubernetes Operators: it installs, updates, and resolves dependencies declaratively. Use it when managing third-party or custom Operators across clusters.
ResourceQuota: Namespace Resource Budgets
ResourceQuota is a namespace budget: it rejects pods once total requests hit the cap. Use it to keep multi-tenant clusters fair. The footgun: it counts requested resources, not real usage, and pods missing requests may be rejected without LimitRange defaults.
OCI: The USB-C of Containers
OCI is the USB-C of containers: open standards that let any compliant runtime execute any image. It prevents vendor lock-in by decoupling image format from runtime. The footgun is treating "Docker image" as proprietary rather than an OCI-compliant bundle.
Kubebuilder: Build Kubernetes APIs the Canonical Way
Kubebuilder is a framework for scaffolding custom Kubernetes APIs, letting you define your own resources like MyWebApp. Use it to extend Kubernetes with declarative APIs, making your app a first-class citizen.
OPA Gatekeeper: Enforce Kubernetes Policies as Code
OPA Gatekeeper is a Kubernetes admission controller using OPA to enforce policies on resources. Use it to mandate labels or block insecure images. The footgun is thinking it's just OPA; Gatekeeper adds K8s-native CRDs, auditing, and mutation capabilities.
Pod Topology Spread: Spreading Pods for High Availability
Pod Topology Spread Constraints prevent putting all your pods in one basket. They instruct the scheduler to distribute a service's pods evenly across nodes or zones, improving availability. The main footgun is that it's a soft preference by default.
CSI Volume Cloning: `cp` for Kubernetes Volumes
Think of volume cloning as cp for your Kubernetes data. It creates a new, independent volume pre-populated with data from an existing one, offloading the copy operation to your storage provider.
Kubernetes Secrets: Encrypting Data at Rest
By default, Kubernetes Secrets are only base64-encoded, not encrypted. Encryption at rest makes the API server encrypt Secret data before saving to etcd, protecting against compromised backups.
Kubernetes Gateway API: The Successor to Ingress
The Gateway API replaces Kubernetes Ingress with a role-oriented model, separating infrastructure from application routing. Use it when different teams need to manage their own traffic rules.
kube-apiserver: The Front Door to Your Kubernetes Cluster
The kube-apiserver is the front door to your Kubernetes control plane. All requests to query or modify the cluster's state must pass through it, from kubectl commands to automated controller actions. The footgun is bypassing it to modify etcd directly.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles