Docker &amp; Kubernetes

Liveness vs readiness probes

Liveness restarts a stuck container; readiness gates traffic by controlling Service endpoint membership. Readiness-only fits an app that pauses to reload a large cache but is still healthy.

Rolling back a bad Deployment

Kubectl rollout undo deployment/NAME reverts to the prior revision by scaling the old ReplicaSet back up and the bad one down.

How a Deployment rolling update works

New image creates a new ReplicaSet; Deployment scales it up while scaling the old one down per maxSurge/maxUnavailable; old ReplicaSet is retained at zero for rollback.

Debugging a Pod in CrashLoopBackOff

Kubectl describe pod for events, restarts, and last state; kubectl logs (with --previous) for the crashed container's output.

Create a Deployment with 3 replicas via kubectl

Kubectl create deployment webapp --image=my-app:1.0, then kubectl scale to 3 replicas, or use --replicas if supported.

Deployment, ReplicaSet, and Pod hierarchy

A Deployment manages ReplicaSets, each ReplicaSet keeps a set of identical Pods, and Deployments add rolling updates, rollback, and self-healing.

CRDs and the Operator pattern

CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.

Scheduler filtering and scoring phases

Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.

Deployment versus StatefulSet

Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.

The Kubernetes reconciliation loop

A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.

etcd as the cluster source of truth

Etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.

What happens after kubectl apply

Apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.

Minimal objects to expose a stateless app

A Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.

Core control plane components

Api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.

Node, Pod, and Container relationship

A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.

Reducing cross-region image pull costs

A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.

Vulnerability scanning as a deploy gate

Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.

Manifest lists and multi-arch images

A manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.

Three techniques to shrink a Docker image

Multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.