More in Docker & Kubernetes — page 7
CRDs and the Operator pattern
WHAT IT TESTS: extending Kubernetes declaratively. OUTLINE: CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.
Scheduler filtering and scoring phases
WHAT IT TESTS: how Pods get placed on Nodes. OUTLINE: filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.
Deployment versus StatefulSet
WHAT IT TESTS: choosing the right workload controller. OUTLINE: Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.
The Kubernetes reconciliation loop
WHAT IT TESTS: the declarative control loop pattern. OUTLINE: a controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.
etcd as the cluster source of truth
WHAT IT TESTS: understanding the cluster state store. OUTLINE: etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.
What happens after kubectl apply
WHAT IT TESTS: the request-to-running flow across components. OUTLINE: apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.
Minimal objects to expose a stateless app
WHAT IT TESTS: mapping requirements to core objects. OUTLINE: a Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.
Core control plane components
WHAT IT TESTS: knowledge of cluster brain components. OUTLINE: api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.
Node, Pod, and Container relationship
WHAT IT TESTS: the core scheduling unit hierarchy. OUTLINE: a Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.
Reducing cross-region image pull costs
WHAT IT TESTS: registry topology for multi-region pulls. OUTLINE: a per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.
Vulnerability scanning as a deploy gate
WHAT IT TESTS: shift-left image security in CI/CD. OUTLINE: scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.
Manifest lists and multi-arch images
WHAT IT TESTS: how one tag serves multiple architectures. OUTLINE: a manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.
Three techniques to shrink a Docker image
WHAT IT TESTS: practical image-size reduction with trade-offs. OUTLINE: multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.
Debugging ImagePullBackOff on a private registry
WHAT IT TESTS: registry auth and systematic debugging. OUTLINE: imagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors.
Why :latest is a production anti-pattern
WHAT IT TESTS: deployment determinism and reproducibility. OUTLINE: latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.
Tag and push an image to a private registry
WHAT IT TESTS: tag-and-push workflow plus registry auth. OUTLINE: authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.
Docker Compose profiles for optional services
WHAT IT TESTS: gating optional services in one Compose file. OUTLINE: profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
Optimizing Dockerfile layer caching
WHAT IT TESTS: how layer caching invalidation works. OUTLINE: order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Structuring Compose files across environments
WHAT IT TESTS: Compose override and merge mechanics. OUTLINE: a base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
Explain layered filesystems like OverlayFS and their efficiency vs monolithic models
This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.