DevOps Interview Questions

Packages app + dependencies into immutable images running as isolated containers — consistent dev/staging/prod, faster onboarding, denser utilization than VMs.

Image is read-only template (layers). Container is running instance with writable layer. Many containers from one image.

Smallest deployable unit — one or more containers sharing network namespace and volumes. Scheduled onto nodes by control plane.

CI: integrate code frequently with automated build/test. CD: deliver artifacts to environments automatically — continuous delivery (manual prod) or deployment (auto prod with gates).

Declarative or imperative definitions of infrastructure in version control — reproducible environments, reviewable changes, drift detection (Terraform, CloudFormation, Pulumi).

Owner rwx (7), group rx (5), others rx (5). Common for directories and executables — owner full control, others read/execute only.

Declaratively create/update resources from YAML. API server reconciles desired state. Prefer apply over imperative create for GitOps workflows.

Rolling gradually replaces instances — minimal extra capacity. Blue-green runs two full stacks, switches traffic — fast rollback, double capacity cost during cutover.

Server scrapes /metrics endpoints — discovers targets via service discovery, central config. Con: must reach targets through firewalls; pro: no agent push auth sprawl.

Maps config to real resource IDs for updates/destroys. Must be remote + locked (S3+DynamoDB) for teams. Losing state risks duplicate resources on next apply.

Terraform provisions infrastructure (cloud APIs). Ansible configures OS/packages/apps (SSH). Often used together: Terraform creates VM, Ansible configures it.

kubectl logs pod --previous, describe pod events, check probes, image pull, config mounts, and resource limits. Fix root cause then rollout restart.

Merge preserves history with merge commit. Rebase replays commits on updated base — linear history but rewrites SHAs; avoid rebasing shared branches.

Allowed unreliability derived from SLO. When budget exhausted, freeze features and focus on reliability work — balances velocity vs stability.

Terminate TLS, route by path/host to upstream app servers, add headers, rate limit, serve static files — single public entry point.

Store in vault/GitHub Secrets/Vault; inject at runtime; never log; rotate regularly; least privilege per pipeline job.

Provider secures cloud (hypervisor, physical). Customer secures in-cloud (IAM, patching apps, data classification). Serverless shifts more to provider but not all.

#!/usr/bin/env bash
set -euo pipefail
for f in "$@"; do
  [[ -f "$f" ]] || continue
  process "$f"
done

Use quotes, set -euo pipefail, validate inputs.

Acknowledge page, assign incident commander, mitigate user impact (rollback/scale/feature flag), preserve evidence, communicate status, document timeline for postmortem.

Multi-master etcd cluster (odd nodes), stacked or external etcd, LB for API server, spread across AZs, backup etcd, test disaster recovery quarterly.

Compile in builder stage; copy only artifacts to slim runtime image — smaller attack surface, faster pulls, no compiler in prod image.

Helm templatizes K8s manifests with values.yaml for env differences, release history, and rollback. Raw YAML fine for small static deployments.

Alert rules on panel queries → notification policies → contact points (Slack/PagerDuty). Unified alerting replaced legacy dashboard-only alerts in Grafana 8+.

Users are long-lived identities with keys — avoid on servers. Roles are assumed temporarily (EC2 instance profile, Lambda execution role) — preferred for workloads.

Route small traffic % to new version via service mesh (Istio/Linkerd) or duplicate Deployment with weighted Service. Watch golden signals before full promotion.

MTTR: mean time to repair/recover. MTBF: mean time between failures. SRE focuses on reducing MTTR with runbooks, observability, and safe rollbacks.

Declarative: structured Jenkinsfile with stages/steps — easier validation. Scripted: Groovy freedom — powerful but harder to maintain. Prefer declarative for most teams.

top/htop → identify PID → ps -p PID -o %cpu,cmd → strace -p PID or perf top for syscalls/hot functions.

Expand-contract: add new column/table, dual-write, backfill, switch reads, stop old writes, remove old schema. Never rename/drop in one deploy without compatibility window.