Docker &amp; Kubernetes

CRDs and the Operator pattern

CRDs add new API object types, an Operator pairs a CRD with a controller that runs a reconciliation loop encoding domain operational knowledge.

Scheduler filtering and scoring phases

Filtering eliminates infeasible Nodes via resources, taints, and affinity, then scoring ranks the survivors to pick the best, after which the Pod is bound.

Deployment versus StatefulSet

Deployments suit interchangeable stateless replicas, StatefulSets give stable identities, ordered rollout, and per-Pod persistent storage for stateful systems.

The Kubernetes reconciliation loop

A controller continuously observes actual state, compares to desired state in the spec, and acts to close the gap, level-triggered not edge-triggered.

etcd as the cluster source of truth

Etcd is the consistent key-value store holding all cluster state, accessed only via the apiserver, and uses Raft needing a quorum.

What happens after kubectl apply

Apiserver validates and persists to etcd, scheduler binds the Pod to a Node, kubelet pulls the image and starts the container via the runtime, status flows back.

Minimal objects to expose a stateless app

A Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.

Core control plane components

Api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.

Node, Pod, and Container relationship

A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.

Reducing cross-region image pull costs

A per-region pull-through cache or geo-replicated registry serves pulls locally, cutting latency and egress, traded against consistency lag, storage cost, and cache management.

Vulnerability scanning as a deploy gate

Scan with Trivy or Clair, fail the build on high or critical severity above threshold, and enforce again at admission with signing and registry policies.

Manifest lists and multi-arch images

A manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.

Three techniques to shrink a Docker image

Multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.

Debugging ImagePullBackOff on a private registry

ImagePullSecrets reference a dockerconfigjson Secret on the pod or service account, kubelet uses it to authenticate, and you inspect events to isolate auth versus name versus network errors.

Why :latest is a production anti-pattern

Latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.

Tag and push an image to a private registry

Authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.

Docker Compose profiles for optional services

Profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.

Optimizing Dockerfile layer caching

Order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.