Top 50 Most Asked DevOps Interview Questions

pipeline { agent any environment { SONAR_TOKEN = credentials('sonar-token') } stages { stage('Push') { steps { withCredentials([usernamePassword(credentialsId: 'docker-hub', usernameVariable: 'USER', passwordVariable: 'PASS')]) { sh 'echo $PASS | docker login -u $USER --password-stdin' } } } } } Jenkins masks these values in console output. Use single quotes in sh so Groovy does not interpolate the secret.

#!/bin/bash set -u SERVICE="nginx" if ! systemctl is-active --quiet "$SERVICE"; then echo "$(date) $SERVICE down, restarting" >> /var/log/svc-check.log systemctl restart "$SERVICE" if ! systemctl is-active --quiet "$SERVICE"; then echo "$SERVICE failed to start" | mail -s "ALERT" ops@example.com fi fi Run it from cron every few minutes; a real setup would rely on systemd Restart= plus monitoring.

jobs: test: runs-on: ${{ matrix.os }} strategy: fail-fast: false matrix: os: [ubuntu-latest, windows-latest] python: ['3.11', '3.12'] steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: python-version: ${{ matrix.python }} - run: pip install -r requirements.txt - run: pytest This creates four parallel jobs; fail-fast false lets all finish so you see every failure.

# shell steps in any CI tool IMAGE=registry.example.com/shop/api TAG=$(git rev-parse --short HEAD) echo "$REG_PASS" | docker login registry.example.com -u "$REG_USER" --password-stdin docker build -t $IMAGE:$TAG . docker push $IMAGE:$TAG Tag with the commit SHA so each image is traceable and immutable; avoid relying on latest. Credentials come from the CI secret store, and --password-stdin keeps them out of process lists.

docker run -d --name api \ --memory=512m --memory-swap=512m \ --cpus=1.5 \ --restart=unless-stopped \ myapp:1.0 # change limits on a running container docker update --memory=1g --memory-swap=1g api If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.

terraform { backend "s3" { bucket = "acme-terraform-state" key = "prod/network/terraform.tfstate" region = "ap-south-1" encrypt = true use_lockfile = true } } Then run terraform init (add -migrate-state if moving local state). Enable versioning on the bucket. Older setups use dynamodb_table = "tf-locks" instead of use_lockfile for locking.

eksctl create cluster \ --name shop-dev \ --region ap-south-1 \ --nodegroup-name workers \ --node-type t3.medium \ --nodes 2 --nodes-min 2 --nodes-max 5 \ --managed aws eks update-kubeconfig --name shop-dev --region ap-south-1 kubectl get nodes eksctl builds CloudFormation stacks for the VPC, control plane and node group. In production, teams usually manage EKS with Terraform modules instead.

awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -10 # total number of unique IPs awk '{print $1}' access.log | sort -u | wc -l The first field in the default log format is the client IP. uniq -c only collapses adjacent lines, so sort must run before it; the final sort -rn shows the busiest IPs first.

git bisect start git bisect bad # current commit has the bug git bisect good v1.4.0 # last known good tag # Git checks out a middle commit; test it, then mark it git bisect good # or: git bisect bad # repeat until Git prints the first bad commit git bisect reset # automate with a test script git bisect run ./run-tests.sh Bisect is a binary search, so 1000 commits need about 10 tests.

FROM maven:3.9-eclipse-temurin-21 AS build WORKDIR /src COPY pom.xml . RUN mvn -B dependency:go-offline COPY src ./src RUN mvn -B package -DskipTests FROM eclipse-temurin:21-jre-alpine WORKDIR /app COPY --from=build /src/target/*.jar app.jar RUN adduser -D appuser USER appuser EXPOSE 8080 ENTRYPOINT ["java", "-jar", "app.jar"] The final image has only the JRE and the JAR, not Maven or source.

docker ps # running containers docker logs -f --tail 100 api # follow logs docker exec -it api sh # shell inside docker inspect api # config, IP, mounts, env docker stats # live CPU and memory docker top api # processes inside docker cp api:/app/log.txt . # copy a file out docker events # daemon events Use sh for alpine images, where bash may not exist.

helm repo add bitnami https://charts.bitnami.com/bitnami helm repo update helm install my-redis bitnami/redis -n cache --create-namespace helm upgrade my-redis bitnami/redis -f values-prod.yaml helm list -A helm rollback my-redis 1 helm uninstall my-redis -n cache helm template ./mychart -f values.yaml # render locally Helm is the package manager for Kubernetes. A chart is a set of templated manifests, and values files customise it per environment.

# ~/.aws/config [profile prod-admin] role_arn = arn:aws:iam::123456789012:role/DevOpsAdmin source_profile = default region = ap-south-1 aws s3 ls --profile prod-admin # manual way aws sts assume-role \ --role-arn arn:aws:iam::123456789012:role/DevOpsAdmin \ --role-session-name ravi-session The role's trust policy must allow your account. Temporary credentials expire, usually after an hour.

git log --oneline --graph --decorate --all # last 10 commits by one author git log --oneline -10 --author="Ravi" # commits touching one file, with diffs git log -p -- src/app.py # who changed each line git blame src/app.py --graph draws branch and merge lines, and --decorate shows branch and tag names next to commits.

stage('Tests') { parallel { stage('Unit') { steps { sh 'mvn test' } } stage('Lint') { steps { sh 'mvn checkstyle:check' } } stage('Security') { agent { docker { image 'aquasec/trivy' } } steps { sh 'trivy fs --exit-code 1 --severity CRITICAL .' } } } } Add failFast true to abort the others when one fails. Each branch can use its own agent.