DevOps and SRE interviews are less about naming tools and more about judgement under constraints: what you roll back first, what you alert on, and what you deliberately leave broken until morning. Below are the questions asked most often, each with a model answer. Junior: core theory, definitions, and simple practical cases.
Readiness controls whether traffic is sent to the pod; liveness controls whether the container is restarted. Point a liveness probe at a shared dependency and a slow database turns into a cluster-wide restart storm, because every replica fails the same check at the same moment. A readiness failure only removes one pod from rotation and the rest keep serving.
An image is the immutable filesystem and metadata; a container is a running instance of it with a writable layer on top. Images are built in layers and cached by layer, which is why the order of instructions in a Dockerfile decides how long a rebuild takes — putting the dependency install before the source copy means a code change does not reinvalidate it.
A Deployment treats pods as interchangeable and gives them random names; a StatefulSet gives stable identities and stable storage, and starts and stops them in order. You need a StatefulSet when identity matters — a database replica set, anything with a per-instance volume. Using one where a Deployment would do makes rollouts slower for no benefit.
The request is what the scheduler reserves when placing the pod; the limit is the ceiling enforced at runtime. Setting no request means the scheduler assumes nothing and can overcommit a node; setting a memory limit too low means the container gets OOM-killed under normal load. CPU throttling at the limit is the quieter failure, because the pod stays up and just gets slow.
Both inject configuration; a Secret is intended for sensitive values and is base64-encoded in etcd, which is encoding rather than encryption unless encryption at rest is switched on. The practical rule is that a Secret keeps values out of the manifest and out of logs, but it is not a vault — for real secret management you want an external store.
Checkout, install, build, test, then produce an artefact — an image or a package — and only then deploy. The order matters because each stage should fail as early and as cheaply as possible: linting before tests, unit tests before integration. A pipeline that deploys before it tests is not a pipeline, it is a deployment script with extra steps.
Start with what is running and what it is doing: ps or systemctl status, then journalctl or the log file, then df for disk and free for memory, because a full disk and an exhausted heap both look like an application bug. Then ss or netstat for whether the port is listening at all. Reading the log first is a habit worth having over guessing.
An inode is the actual file record — permissions, timestamps, pointers to the data — and the filename is just a directory entry pointing at it. A hard link is a second name for the same inode, so the data survives until the last name is removed. A symlink is a small file containing a path, so it breaks if the target moves and it can cross filesystems, which a hard link cannot.
A zombie has finished but its parent has not read the exit status, so the entry stays in the process table — harmless individually, a bug in the parent when they pile up. Load average is the number of processes running or waiting, including waiting on disk, which is why a machine with load 8 and idle CPUs is usually blocked on I/O rather than short of processor.
TCP establishes a connection, guarantees delivery and order, and slows down when the network is congested. UDP just sends packets — no handshake, no retransmission, no ordering — so it is faster and it is what you want when late data is worse than missing data: video, voice, DNS queries, telemetry. Choosing TCP for a stream of metrics costs you head-of-line blocking for no benefit.
In a real interview you speak under pressure. Cam asks these same questions, scores every answer, and shows exactly what to fix.
Practice a Junior DevOps / SRE interview →