DevOps & cloud
30 important interview questions.

Answer

DevOps is a culture and set of practices that bring development and operations teams together to deliver software faster and more reliably. It relies on automation (CI/CD, infrastructure as code), shared responsibility, small frequent releases, and monitoring and feedback from production.

Answer

• Continuous integration: developers merge code often, and each change is automatically built and tested.
• Continuous delivery: every change that passes the pipeline is ready to release; going to production is a manual approval.
• Continuous deployment: every passing change goes to production automatically, with no manual step.

Answer

• top / htop: CPU and memory usage by process
• df -h / du -sh: disk space
• free -m: memory
• ps aux | grep name: find a process
• tail -f and journalctl -u service: follow logs
• ss -tulpn / netstat: open ports
• curl, ping, dig: network checks
• systemctl status|restart name: manage services

Answer

Each file has read (r=4), write (w=2) and execute (x=1) permissions for the owner, the group and others. chmod 754 deploy.sh gives the owner rwx (7), the group r-x (5) and others r-- (4). chown user:group file changes ownership. Give only the permissions that are needed.

Answer

1. Check load and CPU with top; find the busiest process.
2. Check memory and swap with free -m.
3. Check disk space (df -h) and disk I/O (iostat).
4. Read application and system logs for errors.
5. Check network connections and latency to dependencies such as the database.
6. Compare with monitoring graphs to see when it started and what changed (a deployment, a traffic spike).

Answer

A virtual machine includes a full guest operating system on top of a hypervisor, so it's heavy and slow to start. A container shares the host's OS kernel and packages only the app and its dependencies, so it's lightweight, starts in seconds and runs the same everywhere.

Answer

An image is a read-only template built from a Dockerfile — the app, runtime and dependencies. A container is a running instance of an image. You can run many containers from one image.

Answer

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]

Copying the package files before the rest of the code lets Docker reuse the cached dependency layer when only code changes.

Answer

Use small base images (alpine or distroless), multi-stage builds so build tools don't end up in the final image, a .dockerignore file, fewer layers, and run as a non-root user. Scan images for vulnerabilities and pin versions.

Answer

A tool for running multi-container apps from one YAML file — for example the app, a database and a cache together, with their networks, volumes and environment variables. docker compose up starts everything. It's mainly used for local development and testing.

Answer

Data written inside a container is lost when it's removed. Use volumes (managed by Docker) or bind mounts (a host folder) for data that must persist, such as database files. In Kubernetes the equivalent is persistent volumes.

Answer

• IaaS: you rent servers, storage and networks and manage the OS and above (AWS EC2).
• PaaS: the platform runs your code and you manage only the app (Elastic Beanstalk, Google App Engine).
• SaaS: ready-to-use software over the internet (Gmail, Salesforce).

Answer

• Vertical scaling (scale up): give one server more CPU or memory. Simple, but there's an upper limit and often downtime.
• Horizontal scaling (scale out): add more servers behind a load balancer. It has no hard limit and survives single-server failures, but the app should be stateless.

Answer

A reverse proxy (such as Nginx) sits in front of servers and receives client requests on their behalf. It can terminate HTTPS, cache content, compress responses and route paths to different services. A load balancer spreads traffic across several servers and removes unhealthy ones. Many tools, including Nginx and cloud load balancers, do both.

Answer

• EC2: virtual servers
• S3: object storage
• RDS: managed relational databases
• VPC: private networking — subnets, route tables, security groups
• IAM: users, roles and permissions
• ELB and Auto Scaling: load balancing and scaling
• Lambda: serverless functions
• CloudWatch: logs, metrics and alarms

Azure and Google Cloud offer equivalent services under different names.

Answer

• A security group is a stateful firewall attached to instances: if inbound traffic is allowed, the reply is allowed automatically. It has only allow rules.
• A network ACL is a stateless firewall at the subnet level: inbound and outbound rules are checked separately, and it can have both allow and deny rules.

Answer

Infrastructure as code defines servers, networks and databases in code files instead of clicking in a console. The code is version-controlled, reviewed and repeatable, so environments are consistent. Terraform works across many cloud providers: you write the desired state, terraform plan shows the changes and terraform apply makes them. Its state file must be stored securely and shared, for example in remote storage with locking.

Answer

Monitoring tracks known metrics and alerts when they cross thresholds (CPU above 90%, error rate up). Observability is being able to understand why a system behaves the way it does from its outputs — metrics, logs and traces. Common tools are Prometheus and Grafana, the ELK stack, CloudWatch and Datadog.

Answer

Never commit secrets to Git. Store them in a secrets manager (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) or the CI tool's encrypted secrets, inject them at runtime, give each service only the access it needs, rotate them regularly and scan repositories for leaked keys.