Everything in Docker & Kubernetes, page 8
Why :latest is a production anti-pattern
Latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.
Tag and push an image to a private registry
Authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.
Docker Compose profiles for optional services
Profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
Optimizing Dockerfile layer caching
Order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Structuring Compose files across environments
A base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
Explain layered filesystems like OverlayFS and their efficiency vs monolithic models
This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.
Describe the relationship between containerd and runc in starting a container.
Tests the OCI runtime split and lifecycle ownership. A great answer states containerd handles image pull, storage, and API lifecycle, then invokes runC to spawn the isolated process.
How do containers enforce CPU and memory limits via cgroups?
Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config.
Name three Linux namespaces and explain what each one isolates.
Name three of PID, Network, Mount, UTS, IPC, User, Cgroup, Time; say what each hides; cite CLONE_NEW* or /proc/pid/ns.
How do Docker images and containers differ and relate?
This tests your grasp of the immutable template versus mutable runtime boundary. A good answer: an image is a read-only layered template with code and dependencies; a container is a runnable instance with a writable layer on top.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
Container Images Are Stacked Deltas
Images stack read-only layers like transparent sheets, one per Dockerfile step, topped by a thin writable layer. This enables cache reuse and fast pulls. The footgun: removing a file in a later layer hides but does not delete it; those bytes still ship.
OLM: Kubernetes' App Store for Operators
OLM is the app store for Kubernetes Operators: it installs, updates, and resolves dependencies declaratively. Use it when managing third-party or custom Operators across clusters.
ResourceQuota: Namespace Resource Budgets
ResourceQuota is a namespace budget: it rejects pods once total requests hit the cap. Use it to keep multi-tenant clusters fair. The footgun: it counts requested resources, not real usage, and pods missing requests may be rejected without LimitRange defaults.
ConfigMap decouples config from container images
A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.
EndpointSlice: Splitting the Monolithic Endpoints List
EndpointSlice shards a service's pod backends into smaller chunks instead of one massive list. This keeps kube-proxy and DNS fast when services scale to thousands of pods. Do not edit them by hand; the controller owns them and will overwrite your changes.
Pod QoS Classes: Guaranteed, Burstable, BestEffort
Kubernetes QoS classes are eviction priorities, not performance guarantees. Under node pressure, the kubelet kills BestEffort pods first, then Burstable, then Guaranteed. Omitting limits does not grant infinite headroom; it makes your pod die first.
OCI: The USB-C of Containers
OCI is the USB-C of containers: open standards that let any compliant runtime execute any image. It prevents vendor lock-in by decoupling image format from runtime. The footgun is treating "Docker image" as proprietary rather than an OCI-compliant bundle.
Kubebuilder: Build Kubernetes APIs the Canonical Way
Kubebuilder is a framework for scaffolding custom Kubernetes APIs, letting you define your own resources like MyWebApp. Use it to extend Kubernetes with declarative APIs, making your app a first-class citizen.
OPA Gatekeeper: Enforce Kubernetes Policies as Code
OPA Gatekeeper is a Kubernetes admission controller using OPA to enforce policies on resources. Use it to mandate labels or block insecure images. The footgun is thinking it's just OPA; Gatekeeper adds K8s-native CRDs, auditing, and mutation capabilities.
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles