DevOps Interview Questions 2026: Freshers to 10 Years, Answers, CI/CD, Docker and Kubernetes

How to use this guide

This guide covers DevOps from Linux and Git to production operations. Each question has an expected answer and the reasoning behind it. Practise the answers aloud. Scenario questions are the most common in this role, so spend time on the section about them.

The guide does not quote any particular candidate. The answers follow standard tool behaviour and widely used practice. Tool versions change, so check the current docs for exact flags.

What the interview pattern usually looks like

Service companies test tools and commands in depth. Product companies ask about reliability, on-call, and how you would design a deployment process for a team.

Level 1: Linux and Git

Q1. How do you find which process is using port 8080?

sudo lsof -i :8080 or sudo ss -tlnp | grep 8080. Mention ss as the modern replacement for netstat.

Q2. How do you check disk usage, and what do you do when a disk is full?

df -h shows filesystem usage. du -sh /var/* | sort -h finds large directories. Check for large log files and old Docker images. Rotate or delete logs safely, and never delete a file that is held open by a running process without checking, because the space is only freed when the process closes it.

Q3. What is the difference between a hard link and a soft link?

A soft (symbolic) link points to a path. It breaks if the target moves. A hard link points to the same inode as the original file. Both names refer to the same data, and it is freed only when every hard link is removed.

Q4. What do file permissions 755 and 644 mean?

Read, write and execute are set for owner, group and others. 755 gives the owner full rights and everyone read and execute. 644 gives the owner read and write, and everyone else read only.

Q5. How do you rebase and how is it different from merge?

A merge creates a commit that joins two histories. A rebase replays your commits on top of another branch, which gives a linear history. Do not rebase commits that others have already pulled from a shared branch.

Q6. How do you undo the last commit?

If it is not pushed: git reset --soft HEAD~1 keeps the changes staged. For a pushed commit, use git revert <hash>, which adds a new commit that undoes it, so history is kept.

Q7. What does a kill -9 do, and why is kill without flags preferred first?

kill sends SIGTERM, which lets the process clean up. kill -9 sends SIGKILL, which the process cannot catch, so it stops without cleanup. Use SIGTERM first and SIGKILL only when the process does not stop.

Level 2: CI/CD pipelines

Q8. What is CI and what is CD?

Continuous integration merges code often and runs automated builds and tests on each change. Continuous delivery keeps the code always ready to deploy, with a manual approval to release. Continuous deployment releases every passing change automatically.

Q9. Walk me through a typical pipeline.

1. Trigger on a push or a pull request.
2. Install dependencies with a cache.
3. Run lint, unit tests and a security scan.
4. Build an artifact, such as a Docker image, tagged with the commit SHA.
5. Push the image to a registry.
6. Deploy to a test environment and run integration or smoke tests.
7. Promote to production with an approval gate.

name: ci
on:
  push:
    branches: [main]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm test
      - run: docker build -t app:${{ github.sha }} .

Q10. How do you make a pipeline faster?

Cache dependencies, run independent jobs in parallel, run the fastest checks first so failures appear early, and split tests into shards. Build the image once and promote the same artifact to each environment, instead of rebuilding for every stage.

Q11. A pipeline fails only on the CI server, not on a developer machine. What do you check?

Differences in the environment: tool versions, OS, environment variables, missing files that are ignored locally, timezone, and file path case on Linux versus macOS. Reproduce it with the same container image that CI uses.

Q12. Why tag images with the commit SHA instead of latest?

latest changes silently, so you cannot tell which code runs in production or roll back to a known version. A commit SHA or a version number is immutable in practice and makes rollback exact.

Level 3: Docker

Q13. What is the difference between an image and a container?

An image is a read-only template built from layers. A container is a running instance of an image with a writable layer on top. Many containers can run from one image.

Q14. How does Docker isolate processes?

It uses Linux namespaces for isolation of process IDs, network, mounts and users, and cgroups to limit CPU and memory. Containers share the host kernel, so they are not full virtual machines.

Q15. Write a sensible Dockerfile for a Node.js app.

FROM node:20-alpine AS build
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
CMD ["node", "dist/server.js"]

Points to make: copy the lockfile first so the dependency layer is cached, use a multi-stage build to keep the final image small, and run as a non-root user.

Q16. What is the difference between CMD and ENTRYPOINT?

ENTRYPOINT sets the executable that always runs. CMD gives default arguments that can be replaced at docker run. Use exec form, ["node", "server.js"], so the process receives signals directly.

Q17. How do you persist data in a container?

Use volumes or bind mounts. Data written to the container's writable layer is lost when the container is removed. Databases should use named volumes, and configuration should come from environment variables or mounted files.

Q18. What is the difference between EXPOSE and publishing a port?

EXPOSE is documentation in the Dockerfile. -p 8080:3000 at run time actually maps a host port to a container port.

Level 4: Kubernetes

Q19. Explain the main Kubernetes components.

The control plane has the API server, etcd for state, the scheduler that places pods, and controllers that keep the desired state. Each worker node runs the kubelet, which starts containers, and kube-proxy, which handles service networking.

kubectl -> API server -> etcd
               |
          scheduler, controllers
               |
   node: kubelet -> pods (containers)
         kube-proxy -> service routing

Q20. What is the difference between a Deployment, a ReplicaSet and a Pod?

A pod is the smallest unit and runs one or more containers. A ReplicaSet keeps a set number of identical pods running. A Deployment manages ReplicaSets and handles rolling updates and rollbacks. You rarely create pods or ReplicaSets directly.

Q21. What is a Service, and what types exist?

A Service gives a stable address and DNS name to a set of pods chosen by labels. Types: ClusterIP for internal access, NodePort to open a port on each node, and LoadBalancer to ask the cloud provider for an external load balancer. An Ingress routes HTTP by host and path to services.

Q22. A pod is in CrashLoopBackOff. What do you do?

kubectl describe pod <pod>
kubectl logs <pod> --previous

Check the events for image pull errors, failed probes, out-of-memory kills, or a missing config map or secret. Then check the application log from the previous container run. Fix the root cause, then redeploy.

Q23. What are liveness and readiness probes?

A liveness probe decides whether to restart a container. A readiness probe decides whether the pod gets traffic. A slow-starting app needs a startup probe, so the liveness probe does not restart it too early. A bad liveness probe causes restart loops, so keep it simple and cheap.

Q24. What are requests and limits?

Requests are what the scheduler reserves for a pod. Limits are the maximum the container can use. Exceeding a memory limit kills the container with an out-of-memory error. CPU over the limit is throttled, not killed.

Q25. How do you manage configuration and secrets in Kubernetes?

Use ConfigMaps for non-sensitive settings and Secrets for sensitive values. Secrets are only base64 encoded by default, so enable encryption at rest and restrict access with RBAC, or use an external secret manager.

Q26. What is a Horizontal Pod Autoscaler?

It changes the number of replicas based on a metric, such as CPU or a custom metric. Set resource requests first, because the autoscaler uses them to calculate utilisation.

Level 5: Infrastructure as code and cloud

Q27. What is infrastructure as code, and why use it?

Infrastructure is described in files, such as Terraform or CloudFormation, and applied by a tool. The benefits are repeatable environments, code review of changes, version history, and a clear record of what exists.

Q28. What is the Terraform plan and apply cycle?

terraform plan shows the changes it would make without changing anything. terraform apply makes them. Keep state in a remote backend with locking, so two people cannot change it at the same time. Review the plan output before applying in production.

Q29. What is the difference between a public and a private subnet?

A public subnet has a route to an internet gateway, so resources there can have public IPs. A private subnet has no direct route to the internet. It reaches out through a NAT gateway. Databases and internal services belong in private subnets.

Q30. What is an IAM role, and why use it instead of access keys?

A role gives temporary credentials to a service, such as an EC2 instance or a pod, without storing long-lived keys. Use the least privilege policy that works, and rotate any keys that must exist.

Q31. How do you reduce cloud cost?

Right-size instances using actual usage metrics. Turn off non-production resources at night. Use reserved or savings plans for steady load. Delete unattached volumes and old snapshots. Set budgets and alerts so cost spikes are seen early.

Level 6: Deployment strategies and reliability

Q32. Compare rolling, blue-green and canary deployments.

• Rolling: replace pods a few at a time. Cheap, but old and new versions run together.
• Blue-green: run two full environments and switch traffic. Fast rollback, but needs double capacity.
• Canary: send a small share of traffic to the new version, watch metrics, then increase. Lowest risk, needs good metrics.

Q33. How do you roll back a bad release?

With Kubernetes: kubectl rollout undo deployment/<name>. With blue-green, switch traffic back. Always keep the previous image tag available. Database migrations are the hard part, so design them to be backward compatible: add first, switch code, remove later.

Q34. What is a health check and how is it different from monitoring?

A health check is a simple endpoint that says whether the service can serve requests. Monitoring collects metrics over time, such as latency and error rates, and alerts on them. Use both: health checks for automatic actions, monitoring for trends and alerts.

Q35. What are SLI, SLO and SLA?

An SLI is a measured indicator, such as the share of requests that succeed in under 300 milliseconds. An SLO is the target for that indicator, such as 99.9 percent over 30 days. An SLA is the contract with customers, usually with a penalty. Error budgets are the allowed failure that follows from the SLO.

Q36. How do you do zero-downtime deployments with a database change?

Use the expand and contract pattern. First add the new column or table in a backward-compatible way. Deploy code that writes to both. Backfill data. Switch reads. Remove the old column in a later release.

Level 7: Monitoring, logging and incidents

Q37. What are the three pillars of observability?

Metrics, logs and traces. Metrics show trends and drive alerts. Logs record events with detail. Traces follow one request across services to find where time is spent.

Q38. What should an alert be based on?

On symptoms users feel, such as error rate and latency at the 95th or 99th percentile, not on every internal number. Every alert should have a clear action. An alert nobody acts on trains people to ignore alerts.

Q39. Walk me through handling a production outage.

1. Acknowledge the alert and open an incident channel.
2. Assess impact: which users, which features, how many.
3. Look for a recent change: a deployment, a config change, a traffic spike.
4. Mitigate first, such as rolling back, scaling out or disabling a feature flag.
5. Communicate status at regular intervals.
6. After recovery, write a blameless post-incident review with the timeline, root cause and actions.

Q40. How do you find the cause of high latency in a service?

Check whether it is all endpoints or one. Compare with a recent deployment. Look at the database query time, connection pool wait, downstream service latency and CPU or memory saturation. Traces show the slow span directly.

Level 8: Security and secrets

Q41. How do you keep secrets out of source code and images?

Never commit secrets. Inject them at runtime from a secret manager or the CI platform's secret store. Scan repositories for leaked keys with a secret scanner in the pipeline. Do not bake secrets into a Docker image, because anyone with the image can read them.

Q42. What is least privilege in a pipeline?

Give each job only the permissions it needs, use short-lived credentials through OIDC where the platform supports it, and separate the credentials for build and deploy.

Q43. How do you scan container images?

Run an image scanner such as Trivy in the pipeline and fail the build on critical vulnerabilities that have a fix. Keep base images updated and prefer minimal base images.

Scenario questions asked in DevOps rounds

S1. A deployment succeeded, but users see errors five minutes later. What do you do?

Roll back first to stop the impact, then investigate. Compare the error timing with the deployment time. Check logs of the new version, configuration differences, and a dependency that changed. Fix forward only after the service is stable.

S2. A disk on a production server is 100 percent full. What do you do?

Find the large files, stop the growth at its source, such as a log loop, and free space safely. Rotate logs. Add an alert at 80 percent so it is caught earlier. Check that the database and application did not corrupt data during the full-disk period.

S3. Your team wants to move a monolith to containers. What is your plan?

Start with one service and the pipeline. Containerise it, add health checks and metrics, then deploy it to a test environment. Move traffic gradually. Keep the old path until the new one has run safely for a period. Do not change the application and the platform at the same time.

S4. Build succeeds but tests in the next stage fail intermittently. What do you check?

Look for shared state between tests, timing dependencies, a test database that is not reset, and parallel jobs that use the same port or file. Mark the flaky test, fix the cause, and do not simply retry the build.

S5. A developer asks for production database access to debug an issue. What do you say?

Offer a read-only replica, a sanitised copy, or a temporary, audited access with approval and an expiry. Explain the risk and follow the company's access process.

How to answer 'explain a project'

Prepare a three-minute walk-through:

1. The system and its users.
2. Your part: the pipeline, the cluster, the monitoring, or the migration.
3. The tools and why you picked them over one alternative.
4. One incident you handled, with the cause, the fix and what changed afterwards.
5. A measurable result, such as deployment time or failure rate, only if it is true for your work.

Interviewers will ask follow-up questions about each tool. Only mention a tool you can explain in depth.

Common mistakes

• Using latest for production images. Use immutable tags.
• Running containers as root. Use a non-root user.
• Storing secrets in the repository or the image. Use a secret store.
• Ignoring resource requests and limits. The scheduler and autoscaler depend on them.
• Restarting instead of finding the cause. Restart stops the symptom only.
• Answering scenarios without asking questions. Ask for the scope, the impact and what changed recently, then reason step by step.

A four-week preparation plan

Frequently asked questions

Do I need a cloud certification? It helps for the first job, but hands-on projects and clear explanations count for more.

Which CI tool should I learn? The concepts transfer. Learn one hosted tool such as GitHub Actions or GitLab CI, and understand Jenkins if the target company uses it.

What if I have no production experience? Build a small project with a pipeline, a containerised app, a cluster and monitoring. Be honest about it in the interview and explain what you would check in production.