Containers and Orchestration Fundamentals
What to know
Containers package an application with its dependencies, sharing the host kernel via namespaces (isolation) and cgroups (resource limits). Know images vs. containers (class vs. instance), layers and caching, Dockerfiles (multi-stage builds, minimal base images, non-root users), and registries. In orchestration (Kubernetes), understand Pods, Deployments (declarative replica management, rolling updates), Services (stable virtual IP and load balancing), Ingress, ConfigMaps/Secrets, liveness vs. readiness vs. startup probes, and resource requests vs. limits (requests affect scheduling; limits cap usage). Know horizontal pod autoscaling and PersistentVolumes.
Traps
Mixing up readiness and liveness is the classic error: readiness controls traffic routing; liveness restarts unhealthy containers. A liveness probe that depends on a downstream service causes cascading restarts-use readiness for dependency checks. Another trap: setting limits without requests leads to poor scheduling. Also, containers are not VMs-they share the kernel, so kernel-level isolation differs. Pods are ephemeral; local filesystem writes vanish on restart, so state belongs in volumes or external services.
Rule of thumb
Requests for scheduling, limits for protection; readiness for traffic, liveness for restarts. Keep images small and run as non-root.
Worked example
An app starts slowly and gets killed repeatedly. The cause is a liveness probe firing before startup completes. Fix: add a startup probe (or increase initial delay) and keep liveness simple, while readiness gates traffic until the app is warm.