DevOps, Kubernetes & Docker Interview Questions (2026 Master Guide)

Q1. What is DevOps and how does it bridge development and operations?

Foundation • 0-2 Yrs

DevOps is a set of practices, cultural philosophies, and automated tools that integrates software development (Dev) with IT operations (Ops). It shortens the systems development lifecycle, increases deployment frequency, and provides continuous delivery of high-quality software through automation.

Q2. Explain the difference between Virtualization (VMs) and Containerization (Docker).

Foundation • 0-2 Yrs

Virtual Machines (VMs) virtualize physical hardware via a Hypervisor; each VM runs a full guest operating system (consuming gigabytes of storage and taking minutes to boot). Containers virtualize the host OS kernel using Linux namespaces and cgroups, sharing the host kernel with isolated user spaces, booting in milliseconds, and consuming megabytes.

Q3. What are Linux Namespaces and Control Groups (cgroups) in Docker?

Foundation • 0-2 Yrs

Namespaces provide isolation between processes: PID (process IDs), NET (network interfaces/routing), MNT (mount points), IPC, and UTS (hostname). Control Groups (cgroups) enforce resource allocation and metering: limiting CPU, memory, disk I/O, and network bandwidth per container.

Q4. What is the difference between a Docker Image and a Docker Container?

Foundation • 0-2 Yrs

A Docker Image is an immutable, read-only template built from layered filesystems defining the application environment, code, and dependencies. A Docker Container is a runnable, isolated runtime instance of a Docker image with a writable thin top layer (Container Layer).

Q5. Explain the difference between COPY and ADD instructions in a Dockerfile.

Foundation • 0-2 Yrs

COPY simply copies local files or directories from the build context into the container filesystem (recommended for security). ADD performs everything COPY does, but additionally extracts local tar archives automatically and downloads files from remote URLs.

Q6. What are Docker Multi-Stage Builds and why are they essential?

Foundation • 0-2 Yrs

Multi-stage builds allow using multiple FROM instructions in a single Dockerfile. Heavy build tools, compilers (e.g., Maven, Go compiler), and intermediate cache files are used in early build stages, and only the final compiled artifact (e.g., jar, binary) is copied to a minimal scratch/Alpine base image, reducing image sizes by 90%.

Q7. What is Kubernetes and what are its core control plane components?

Foundation • 0-2 Yrs

Kubernetes is an open-source container orchestration platform. Control plane components: kube-apiserver (central REST API gateway), etcd (distributed key-value store holding cluster state), kube-scheduler (assigns unscheduled pods to nodes), and kube-controller-manager (runs control loops).

Q8. What are the worker node components in a Kubernetes cluster?

Foundation • 0-2 Yrs

Worker node components: kubelet (agent running on each node ensuring containers described in PodSpecs are running and healthy), kube-proxy (maintains network rules on nodes for Pod and Service communication), and Container Runtime (containerd, CRI-O).

Q9. What is a Pod in Kubernetes and can it run multiple containers?

Foundation • 0-2 Yrs

A Pod is the smallest deployable compute unit in Kubernetes. It encapsulates one or more containers sharing the same network namespace (same IP address, localhost communication) and shared storage volumes (e.g., Sidecar pattern for logging or service mesh proxies).

Q10. Explain the difference between Deployment, StatefulSet, and DaemonSet.

Foundation • 0-2 Yrs

Deployment: Manages stateless pod replicas with rolling updates. StatefulSet: Manages stateful pods requiring unique persistent identities, stable network hostnames, and ordered deployment (e.g., databases). DaemonSet: Ensures exactly one copy of a Pod runs on every (or selected) node in the cluster (e.g., log collectors, monitoring agents).

Q11. What is a Kubernetes Service and what are its types?

Foundation • 0-2 Yrs

A Service provides a stable IP address and DNS name to abstract a dynamic set of pods identified by label selectors. Types: ClusterIP (internal cluster access, default), NodePort (exposes port on each node's IP), LoadBalancer (provisions cloud provider load balancer), and ExternalName.

Q12. What is an Ingress and Ingress Controller in Kubernetes?

Foundation • 0-2 Yrs

An Ingress is an API object that defines HTTP/HTTPS routing rules (host, path, SSL termination) to expose cluster services to the external world. An Ingress Controller (e.g., NGINX Ingress Controller, Traefik) evaluates these rules and directs traffic to backend services.

Q13. What is the difference between livenessProbe, readinessProbe, and startupProbe?

Foundation • 0-2 Yrs

livenessProbe: Checks if the container is running; if it fails, kubelet kills and restarts the container. readinessProbe: Checks if the container is ready to accept traffic; if it fails, the pod IP is removed from Service endpoints. startupProbe: Disables liveness/readiness checks until slow legacy containers finish initial startup.

Q14. What is Helm and why is it called the package manager for Kubernetes?

Foundation • 0-2 Yrs

Helm manages Kubernetes applications through Charts (packaged pre-configured K8s resource manifests). It supports parameterization via values.yaml, release versioning, rolling upgrades, and one-command rollbacks (helm rollback).

Q15. Explain Continuous Integration (CI) vs Continuous Delivery (CD) vs Continuous Deployment.

Foundation • 0-2 Yrs

CI: Developers merge code frequently to trunk; automated builds and tests validate changes. Continuous Delivery: Automated builds, tests, and staging deployments, with manual approval gate before production. Continuous Deployment: Every change passing automated pipeline tests deploys directly to production with zero manual intervention.

Q16. Explain Blue-Green vs Canary vs Rolling Update deployment strategies.

Experienced • 3-5+ Yrs

Rolling Update: Incrementally replaces old pods with new pods with zero downtime (default in K8s). Blue-Green: Runs two identical environments; router switches 100% traffic from Blue (old) to Green (new) instantly, allowing rapid rollback. Canary: Routes a small percentage of real production traffic (e.g., 5%) to the new version to monitor metrics before full rollout.

Q17. How does Horizontal Pod Autoscaler (HPA) work with Custom Metrics?

Experienced • 3-5+ Yrs

HPA scales the number of Pod replicas in a Deployment based on observed CPU/memory or Custom Metrics (e.g., HTTP requests/sec from Prometheus via Prometheus Adapter). It polls the Metrics API every 15s and applies the formula: desiredReplicas = ceil(currentReplicas * (currentMetricValue / desiredMetricValue)).

Q18. What is GitOps and how does ArgoCD implement it in Kubernetes?

Experienced • 3-5+ Yrs

GitOps uses Git repositories as the single source of truth for declarative infrastructure and applications. ArgoCD is a declarative GitOps continuous delivery tool running inside K8s that continuously monitors Git repos and cluster state, automatically reconciling drifts and applying manifest updates.

Q19. Explain the difference between Kubernetes ConfigMaps and Secrets.

Experienced • 3-5+ Yrs

ConfigMaps store non-confidential configuration data in key-value pairs (injected as environment variables or mounted files). Secrets store sensitive data (passwords, tokens, keys) base64-encoded. In production, Secrets should be encrypted at rest in etcd or managed via HashiCorp Vault / External Secrets Operator.

Q20. How do you design a zero-trust network in Kubernetes using Network Policies?

Experienced • 3-5+ Yrs

By default, all pods in a K8s cluster can communicate with all other pods. A default-deny NetworkPolicy blocks all ingress and egress traffic. Granular NetworkPolicies use podSelector, namespaceSelector, and ipBlock to explicitly allow only required inter-service communication on specific ports.

Q21. Explain the Sidecar Container Pattern and give real-world production examples.

Experienced • 3-5+ Yrs

A Sidecar is a secondary container running inside the same Pod alongside the main application container to extend its functionality without modifying code. Examples: Envoy proxy in Istio service mesh, Fluentd/Promtail for log forwarding, and Vault Agent for secret injection.

Q22. How do you troubleshoot a Kubernetes Pod stuck in CrashLoopBackOff?

Experienced • 3-5+ Yrs

1. Run kubectl describe pod to check exit codes and events (OOMKilled indicates memory limit reached); 2. Check logs: kubectl logs --previous to inspect stderr before crash; 3. Verify entrypoint, missing environment variables, or unavailable downstream DB dependencies.

Q23. Explain the difference between Docker bridge network, host network, and overlay network.

Experienced • 3-5+ Yrs

Bridge: Default private internal network created by Docker host; containers communicate via IP and expose ports via NAT. Host: Container shares the host network stack directly (no port mapping, highest performance, no isolation). Overlay: Multi-host networking connecting containers across different Docker Swarm/cluster nodes with encryption.

Q24. What is Infrastructure as Code (IaC) and how does Terraform manage state?

Experienced • 3-5+ Yrs

IaC manages computing infrastructure through machine-readable definition files. Terraform tracks resource IDs and metadata in a state file (terraform.tfstate). In production, state is stored remotely (S3 with DynamoDB locking) to prevent race conditions during concurrent team applies.

Q25. What is the difference between Terraform 'count' and 'for_each'?

Experienced • 3-5+ Yrs

'count' creates multiple resources based on an integer; deleting an item from the middle of a list causes Terraform to shift array indices and destroy/recreate unchanged resources. 'for_each' uses maps or sets with unique keys, ensuring individual resources are added/removed without affecting sibling resources.

Q26. Explain Prometheus Pull architecture vs Push architecture in monitoring.

Experienced • 3-5+ Yrs

Prometheus uses a Pull model: it periodically scrapes HTTP /metrics endpoints from monitored targets via service discovery. A Push model requires agents to push metrics to a central collector (which can overload the collector under high traffic). Prometheus uses Pushgateway only for short-lived batch jobs.

Q27. What are Service Level Indicators (SLI), Objectives (SLO), and Agreements (SLA) in SRE?

Experienced • 3-5+ Yrs

SLI: A quantifiable metric of service performance (e.g., % of HTTP requests returning 200 within 200ms). SLO: The target reliability agreed upon by the engineering team (e.g., 99.9% SLI over 30 days). SLA: The contractual agreement with customers with financial penalties if breached (e.g., 99.5%).

Q28. Explain Kubernetes Cluster Autoscaler vs Karpenter.

Experienced • 3-5+ Yrs

Cluster Autoscaler scales node groups in a cloud provider based on pending unscheduled pods (slow, bound by static ASG node types). Karpenter is an open-source, high-performance node auto-provisioner that bypasses ASGs and directly launches optimally sized EC2 instances in seconds based on pod requirements.

Q29. How do you secure a CI/CD pipeline against Supply Chain attacks?

Experienced • 3-5+ Yrs

1. Sign container images using Cosign/Sigstore; 2. Generate and verify Software Bill of Materials (SBOM); 3. Scan images for vulnerabilities (Trivy, Grype); 4. Pin dependencies with checksums; 5. Enforce branch protection and signed commits; 6. Run pipeline runners in isolated ephemeral containers.

Q30. What is eBPF and how is it transforming Kubernetes networking and security (Cilium)?

Experienced • 3-5+ Yrs

eBPF (Extended Berkeley Packet Filter) allows running sandboxed programs inside the Linux OS kernel without changing kernel code. Cilium uses eBPF to replace kube-proxy and iptables, delivering ultra-high-performance load balancing, transparent encryption, and deep runtime security observability.

Q31. Write a multi-stage Dockerfile for a Node.js application using Alpine Linux.

Live Coding Challenge

Build stage compiles dependencies; production stage copies only build artifacts.

# Build Stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Production Stage
FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY package*.json ./
RUN npm ci --only=production
COPY --from=builder /app/dist ./dist
USER node
EXPOSE 3000
CMD ["node", "dist/index.js"]

Q32. Write a Kubernetes Deployment manifest with readiness and liveness probes.

Live Coding Challenge

Define Deployment with resource limits, livenessProbe, and readinessProbe.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
  labels: { app: api-service }
spec:
  replicas: 3
  selector:
    matchLabels: { app: api-service }
  template:
    metadata:
      labels: { app: api-service }
    spec:
      containers:
      - name: api
        image: myrepo/api:v1.2.0
        ports: [{ containerPort: 8080 }]
        resources:
          requests: { memory: "256Mi", cpu: "200m" }
          limits: { memory: "512Mi", cpu: "500m" }
        livenessProbe:
          httpGet: { path: /healthz, port: 8080 }
          initialDelaySeconds: 15
        readinessProbe:
          httpGet: { path: /ready, port: 8080 }
          initialDelaySeconds: 5

Q33. Write a Kubernetes Ingress manifest routing /api traffic to a backend service.

Live Coding Challenge

Define Ingress with path-based routing rule.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port: { number: 8080 }

Q34. Write a GitHub Actions workflow to build and push a Docker image to Docker Hub.

Live Coding Challenge

Workflow triggers on push to main, builds image, and pushes with SHA tag.

name: Build and Push Docker
on:
  push:
    branches: [ main ]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: Log in to Docker Hub
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKER_USERNAME }}
        password: ${{ secrets.DOCKER_PASSWORD }}
    - name: Build and push
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ secrets.DOCKER_USERNAME }}/app:${{ github.sha }}

Q35. Write a Kubernetes NetworkPolicy to deny all ingress traffic by default.

Live Coding Challenge

Default deny ingress policy on a namespace.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Q36. Write a Terraform script configuring an S3 backend with DynamoDB state locking.

Live Coding Challenge

Configure terraform backend block.

terraform {
  backend "s3" {
    bucket         = "my-corp-tfstate"
    key            = "prod/infrastructure.tfstate"
    region         = "us-east-1"
    dynamodb_table = "tf-state-locks"
    encrypt        = true
  }
}

Q37. Write a Kubernetes command to restart all pods in a deployment gracefully.

Live Coding Challenge

Use rollout restart command.

kubectl rollout restart deployment/api-service -n production

Q38. Write a Docker Compose file running a Redis server with persistent volume and password.

Live Coding Challenge

Define redis service with volume mount and command.

version: '3.8'
services:
  redis:
    image: redis:7-alpine
    command: redis-server --requirepass "SuperSecret123"
    ports:
      - "6379:6379"
    volumes:
      - redis_data:/data
volumes:
  redis_data:

Q39. Write a Kubernetes HorizontalPodAutoscaler manifest targeting 70% CPU.

Live Coding Challenge

Define HPA targeting Deployment.

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: api-hpa
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: api-service
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 70

Q40. Write a Prometheus Alertmanager rule alerting when Pod restart count exceeds 5 in 15 mins.

Live Coding Challenge

Use increase(kube_pod_container_status_restarts_total[15m]).

groups:
- name: pod_alerts
  rules:
  - alert: HighPodRestartCount
    expr: increase(kube_pod_container_status_restarts_total[15m]) > 5
    for: 2m
    labels: { severity: warning }
    annotations:
      summary: "Pod {{ $labels.pod }} is restarting frequently"