Junior DevOps Engineer Interview Questions &amp; Answers

Show answer

A virtual machine runs a full guest operating system on a hypervisor, so it is heavier, takes minutes to boot and uses gigabytes. A container shares the host kernel and isolates only the application and its dependencies using namespaces and cgroups, so it starts in seconds and uses far less memory. VMs give stronger isolation; containers give density and portability.

Which Docker commands do you use to debug a running container?

Show answer

docker ps # running containers docker logs -f --tail 100 api # follow logs docker exec -it api sh # shell inside docker inspect api # config, IP, mounts, env docker stats # live CPU and memory docker top api # processes inside docker cp api:/app/log.txt . # copy a file out docker events # daemon events Use sh for alpine images, where bash may not exist.

How do you create a release tag and push it?

Show answer

git tag -a v1.2.0 -m "Release 1.2.0" git push origin v1.2.0 # push all tags git push origin --tags # list and inspect git tag -l "v1.*" git show v1.2.0 Annotated tags (-a) store author, date and message and are preferred for releases. Many CI pipelines trigger production builds on tags matching v*.

Write a script that alerts when any disk partition is above 80 percent used.

Show answer

#!/bin/bash THRESHOLD=80 df -hP | awk 'NR>1 {gsub("%","",$5); print $5, $6}' | while read -r used mount; do if [ "$used" -ge "$THRESHOLD" ]; then echo "WARNING: $mount is ${used}% full on $(hostname)" fi done df -P keeps each entry on one line, awk strips the percent sign, and the loop compares each value with the threshold.

What is Git and how is it different from GitHub?

Show answer

Git is a distributed version control system that tracks changes to files; every clone has the full history and works offline. GitHub is a hosting service built around Git that adds remote repositories, pull requests, code review, issues and Actions for CI. Alternatives such as GitLab and Bitbucket offer similar features. You can use Git without GitHub, but not the other way round.

A container exits immediately after it starts. How do you debug it?

Show answer

Run docker ps -a to see the exit code and docker logs <id> for output. Exit code 0 usually means the main process finished, for example a script that ran once or a service started in background mode, so the container has nothing to keep it alive. Non-zero codes point to errors such as missing config. Start an interactive shell with docker run -it --entrypoint sh to inspect.

What are the typical stages of a CI/CD pipeline?

Show answer

A common pipeline is checkout, build or compile, unit tests, static analysis and security scans, packaging into an artefact or container image, pushing to a registry, deploying to a test or staging environment, running integration or smoke tests, an approval gate, and production deployment with monitoring. Fast checks run first so developers get feedback within minutes and slow tests run later.

Write a bash script that checks whether a service is running and restarts it if not.

Show answer

#!/bin/bash set -u SERVICE="nginx" if ! systemctl is-active --quiet "$SERVICE"; then echo "$(date) $SERVICE down, restarting" >> /var/log/svc-check.log systemctl restart "$SERVICE" if ! systemctl is-active --quiet "$SERVICE"; then echo "$SERVICE failed to start" | mail -s "ALERT" ops@example.com fi fi Run it from cron every few minutes; a real setup would rely on systemd Restart= plus monitoring.

What is the difference between sudo and su?

Show answer

su switches to another user, usually root, and needs that user's password, giving a full shell as them. sudo runs a single command with elevated rights using your own password, and is controlled by rules in /etc/sudoers. sudo is preferred in teams because each action is logged against the real user and access can be limited to specific commands.

What is the difference between continuous integration, continuous delivery and continuous deployment?

Show answer

Continuous integration means developers merge small changes often and every merge is automatically built and tested. Continuous delivery goes further: every passing build is packaged and ready to release, but a human approves the production push. Continuous deployment removes that manual step, so every change that passes all checks goes to production automatically. Each stage needs more test confidence than the last.

What is the difference between a process and a thread in Linux?

Show answer

A process is a running program with its own address space, file descriptors and PID. A thread is a unit of execution inside a process that shares the same memory and open files with other threads. Creating threads is cheaper and they communicate easily, but a bug in one thread can crash the whole process, while separate processes are isolated from each other.

What is the difference between kill, kill -15 and kill -9?

Show answer

kill sends SIGTERM (15) by default, which asks the process to stop so it can close files, finish requests and clean up. kill -9 sends SIGKILL, which the kernel enforces immediately; the process cannot catch it, so data may be lost and temp files left behind. Always try SIGTERM first and use SIGKILL only when the process does not respond.

What is the difference between git fetch and git pull?

Show answer

git fetch downloads new commits and branches from the remote into remote-tracking branches like origin/main without touching your working files. git pull is fetch followed by merge (or rebase if configured) into your current branch. Fetch is safer when you want to inspect incoming changes first with git log main..origin/main before integrating them.

Write a GitHub Actions workflow that runs tests on every pull request.

CI/CD PipelinesMedium

Show answer

name: CI on: pull_request: branches: [main] jobs: test: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: node-version: 20 cache: npm - run: npm ci - run: npm test Add this as .github/workflows/ci.yml and make the job a required status check in branch protection.

What is the difference between a Docker image and a container?

Show answer

An image is a read-only template made of layers, containing the application, libraries and configuration, built from a Dockerfile. A container is a running instance of an image with a thin writable layer on top. You can start many containers from one image. Changes made inside a container are lost when it is removed unless they are stored in volumes.

What is Docker Compose?

Show answer

Docker Compose defines and runs multi-container applications from a YAML file, usually compose.yaml. You describe services, networks, volumes, environment variables and dependencies, then start everything with docker compose up. It is ideal for local development and testing, for example an API, database and cache together. For production orchestration across many hosts, teams use Kubernetes instead.

Explain Docker network types.

Show answer

bridge is the default: containers get private IPs on a virtual bridge and reach outside through NAT; user-defined bridges also provide DNS by container name. host shares the host's network stack directly, with no port mapping. none disables networking. overlay connects containers across multiple hosts in Swarm. macvlan gives a container its own MAC address on the physical network.

Explain the Linux boot process briefly.

Linux and Shell ScriptingHard

Show answer

The firmware (BIOS or UEFI) runs hardware checks and loads the bootloader, usually GRUB. GRUB loads the kernel and the initramfs, which contains drivers needed to mount the real root file system. The kernel then starts PID 1, which is systemd on most modern distributions. systemd mounts file systems and starts services in parallel according to unit dependencies and the default target.

How do you find files larger than 100 MB and older than 7 days under /var/log?

Show answer

find /var/log -type f -size +100M -mtime +7 -exec ls -lh {} + # compress them instead of just listing find /var/log -type f -size +100M -mtime +7 -exec gzip {} + -size +100M matches files above 100 MB, -mtime +7 means modified more than 7 days ago, and -exec with + passes many files to one command call, which is faster than running it once per file.

Why do you want to build a career in DevOps?

Show answer

I enjoy both writing code and understanding how systems run in production, and DevOps sits between the two. In my projects I set up a CI pipeline and Docker deployment and liked seeing a change go from commit to live in minutes. I want to keep learning cloud, Kubernetes and automation, and help teams release faster with fewer failures.

Tell me about a time you automated a repetitive manual task.

Show answer

Situation: our team manually cleaned old build artefacts on shared servers every week, which took two hours and sometimes deleted the wrong files. Task: I offered to automate it. Action: I wrote a bash script with dry-run mode, logging and a retention rule, tested it on staging and scheduled it with cron. Result: zero manual effort and no more full-disk alerts for six months.

How do you view the commit history in a compact graph form?

Show answer

git log --oneline --graph --decorate --all # last 10 commits by one author git log --oneline -10 --author="Ravi" # commits touching one file, with diffs git log -p -- src/app.py # who changed each line git blame src/app.py --graph draws branch and merge lines, and --decorate shows branch and tag names next to commits.

How do you limit CPU and memory for a container?

Show answer

docker run -d --name api \ --memory=512m --memory-swap=512m \ --cpus=1.5 \ --restart=unless-stopped \ myapp:1.0 # change limits on a running container docker update --memory=1g --memory-swap=1g api If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.

What are the S3 storage classes and lifecycle policies?

AWS Cloud for DevOpsEasy

Show answer

S3 Standard is for frequently accessed data. Standard-IA and One Zone-IA are cheaper for infrequent access but charge retrieval fees. Intelligent-Tiering moves objects automatically based on access. Glacier Instant, Flexible Retrieval and Deep Archive are for archives with slower, cheaper access. Lifecycle rules move objects between classes after a set age and delete old versions or logs automatically.

What is the difference between git revert and git reset?

Git and Version ControlMedium

Show answer

git revert creates a new commit that undoes the changes of an earlier commit, leaving history intact, so it is safe on shared branches like main. git reset moves the branch pointer backwards and removes commits from the branch history, which is fine locally but forces others to deal with rewritten history if already pushed. Use revert for anything already public.

What is the difference between COPY and ADD in a Dockerfile?

Show answer

COPY copies local files and directories into the image and does nothing else. ADD can also download from a URL and automatically extracts local tar archives. Because that extra behaviour can be surprising, best practice is to use COPY by default and ADD only when you specifically want tar extraction. For downloads, use curl in a RUN step so you can verify checksums.

What are zombie and orphan processes?

Show answer

A zombie is a process that has exited but whose parent has not yet read its exit status with wait(), so it still holds a PID entry and shows state Z. An orphan is a running process whose parent died; it is adopted by PID 1, which reaps it later. Many zombies indicate a buggy parent; fixing or restarting the parent clears them.

Your app fails to start with 'address already in use' on port 8080. What do you do?

Show answer

Find what is holding the port with ss -ltnp | grep 8080 or lsof -i :8080. If it is an old instance of the same app that did not shut down, stop it gracefully or fix the service manager so only one runs. If it is another service, change one app's port through configuration rather than hard coding. Then restart and confirm with curl localhost:8080.

How do you use git bisect to find the commit that introduced a bug?

Git and Version ControlHard

Show answer

git bisect start git bisect bad # current commit has the bug git bisect good v1.4.0 # last known good tag # Git checks out a middle commit; test it, then mark it git bisect good # or: git bisect bad # repeat until Git prints the first bad commit git bisect reset # automate with a test script git bisect run ./run-tests.sh Bisect is a binary search, so 1000 commits need about 10 tests.

How do you use stored credentials inside a Jenkins pipeline?

CI/CD PipelinesMedium

Show answer

pipeline { agent any environment { SONAR_TOKEN = credentials('sonar-token') } stages { stage('Push') { steps { withCredentials([usernamePassword(credentialsId: 'docker-hub', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $PASS | docker login -u $USER --password-stdin' } } } } } Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.

The build works on your laptop but fails on the CI server. How do you debug it?

Show answer

The environments differ. Compare tool versions such as JDK, Node or Python, environment variables, and dependency versions, especially if there is no lock file. Check for files present locally but not committed, and for hard-coded paths. Reproduce by running the build inside the same Docker image the CI agent uses. Long term, build inside containers so local and CI match.

How do you prioritise when several teams ask you for infrastructure work at the same time?

AWS Cloud for DevOpsMedium

Show answer

I list the requests with their business impact and deadline, and check which are blocking production or a release. Production issues and security fixes come first. For the rest I agree priority with my lead and the requesting teams openly, give realistic timelines and share progress. Where requests repeat, I build self-service templates so teams are not waiting on me.

What is the difference between volumes and bind mounts?

Show answer

A volume is storage managed by Docker under its own directory, created with docker volume create and referenced by name; it is portable and is the recommended way to persist data such as databases. A bind mount maps a specific host path into the container, which is handy for local development hot reload but depends on host directory layout and permissions.

Write a production-ready Dockerfile for a Node.js application.

Show answer

FROM node:20-alpine WORKDIR /app ENV NODE_ENV=production COPY package.json package-lock.json ./ RUN npm ci --omit=dev COPY . . USER node EXPOSE 3000 CMD ["node", "server.js"] Dependencies are copied and installed before source code so the layer is cached. npm ci gives reproducible installs, USER node avoids running as root, and exec form CMD lets the app receive signals.

What is an artefact repository and why is it used?

Show answer

An artefact repository such as Nexus, JFrog Artifactory or a container registry stores versioned build outputs like JAR files, npm packages and Docker images. The pipeline builds once and promotes the same artefact through dev, staging and production, so what you tested is exactly what you deploy. It also caches public dependencies, speeds up builds and keeps release history for rollbacks.

How do you handle the stress of on-call duty?

Monitoring, Logging and SREEasy

Show answer

I prepare before my shift by reading recent incidents and making sure runbooks and access work. During an incident I follow the runbook, stay calm and escalate early instead of struggling alone, because quick recovery matters more than solving it myself. Afterwards I note what was confusing and improve the docs or alerts, so each rotation gets easier for everyone.

An EC2 instance in a private subnet cannot download packages from the internet. Why?

AWS Cloud for DevOpsMedium

Show answer

A private subnet has no direct route to the Internet Gateway. Check that its route table sends 0.0.0.0/0 to a NAT Gateway placed in a public subnet, that the NAT Gateway has an Elastic IP, and that the security group and NACL allow outbound traffic and return ports. For AWS services like S3, a VPC endpoint avoids NAT data charges.

How do you create a new branch, push it and set the upstream?

Show answer

git switch -c feature/payment-retry # make changes git add . git commit -m "Add retry for failed payments" git push -u origin feature/payment-retry After -u (set upstream), plain git push and git pull work on this branch without naming the remote. Then open a pull request against main.

Write a Docker Compose file for a web app with a PostgreSQL database.