DevOps
Containers vs virtual machines, Docker, container orchestration, and deployment for C++ services.
7 questions
JuniorTheoryVery commonWhat does Docker do, and what is the difference between an image and a container?
What does Docker do, and what is the difference between an image and a container?
Docker packages an application with its dependencies, libraries, and entrypoint into an immutable image (built from a Dockerfile). A running instance of an image is a container — an isolated process group sharing the host kernel.
Common mistakes
- ✗Modifying files inside a running container expecting persistence — changes are lost on restart unless backed by a volume
- ✗Bundling secrets or DB credentials into an image — image layers are inspectable; never put secrets in the image
- ✗Treating the
latesttag as stable — it is a moving pointer; pin to an immutable digest in production
Follow-up questions
- →What is the difference between a Docker volume and a bind mount?
- →Why are multi-stage Dockerfiles preferred for compiled languages like C++?
JuniorTheoryCommonWhat is a package manager? Examples for Linux.
What is a package manager? Examples for Linux.
Automates install/update/remove of software with dependencies. Linux: apt (Debian/Ubuntu) — .deb; yum/dnf (RHEL/Fedora) — .rpm; pacman (Arch) — .pkg.tar.zst; snap/flatpak — sandboxed cross-distro. Dev: vcpkg, Conan (C++), pip, npm. Tracks versions, resolves transitive deps automatically.
Common mistakes
- ✗Running
apt upgradeon a production server without testing — a new library version may break ABI compatibility with already-installed binaries - ✗Mixing package managers (e.g., apt and snap) for the same tool — parallel installs with different versions cause PATH confusion
- ✗Installing dev libraries system-wide instead of per-project — conflicting versions for different projects; use virtual environments or containers
Follow-up questions
- →What is the difference between
apt installandapt-get install? - →How does
dpkgrelate toapt?
MiddleTheoryCommonWhat is containerization, and how does Docker compare to a virtual machine?
What is containerization, and how does Docker compare to a virtual machine?
Containerization packages an app with its dependencies into an isolated unit using kernel namespaces and cgroups. A container shares the host kernel — fast startup, small images — while a VM emulates full hardware and runs its own kernel. Docker is the dominant tooling.
Common mistakes
- ✗Running containers as root — a kernel escape gives the attacker root on the host; set a non-root
USERin the Dockerfile - ✗Using the
latesttag in production — it changes silently with every push; pin a digest or version tag for reproducibility - ✗Baking secrets into the image via
ENV— they appear indocker inspectand image layers; inject via runtime secrets instead
Follow-up questions
- →Which Linux kernel features (namespaces, cgroups, seccomp) make container isolation possible?
- →How do multi-stage Dockerfile builds shrink the final image size for C++ services?
MiddleTheoryCommonWhat is systemd and how does it differ from SysV init?
What is systemd and how does it differ from SysV init?
systemd is the init system on most modern Linux distros (PID 1). Unlike SysV's serial shell scripts, it starts services in parallel via a dependency graph, supports socket activation (lazy start on first connection), tracks services via cgroups, uses unified unit files. Also bundles journald, networkd, timesyncd — comprehensive but controversial.
Common mistakes
- ✗Editing files in
/lib/systemd/system/instead of/etc/systemd/system/— overwritten on update - ✗Forgetting to
systemctl daemon-reloadafter changing a unit file - ✗Mixing
service,init.d, andsystemctlcommands without understanding what each does
Follow-up questions
- →How does
systemctl list-dependencieshelp debug startup ordering? - →What is socket activation and when does it help?
JuniorTheoryOccasionalWhat Linux distributions exist and how do they differ?
What Linux distributions exist and how do they differ?
Major families: Debian/Ubuntu — .deb + apt, LTS, servers/desktops; RHEL/CentOS/Fedora — .rpm + dnf, RHEL for enterprise (paid support), Fedora upstream; Arch — rolling release, pacman, minimal base, AUR; SUSE/openSUSE — YaST tool, rpm, enterprise focus; Alpine — musl libc, busybox, tiny images (< 5 MB), popular for Docker.
Common mistakes
- ✗Assuming all distros use the same libc — Debian uses glibc, Alpine uses musl; a binary compiled on Debian may crash on Alpine due to ABI differences
- ✗Treating CentOS 8 as a long-term stable option — CentOS Stream replaced it as a rolling preview for RHEL; use RHEL, Rocky, or AlmaLinux for stability
- ✗Installing the same tools on every distro the same way — package names differ (e.g.,
libboost-devon Debian vsboost-develon Fedora)
Follow-up questions
- →What is the difference between a rolling release and a fixed release distribution?
- →Why do C++ binaries compiled on Ubuntu 20.04 not always run on Ubuntu 18.04?
JuniorTheoryOccasionalWhat is a system call, and how does the tracing tool strace show the ones a C++ process makes?
What is a system call, and how does the tracing tool strace show the ones a C++ process makes?
A system call is the controlled boundary a user-space program crosses to ask the kernel for a privileged operation — file I/O, mmap, fork, sockets — switching the CPU into kernel mode and back. strace attaches via ptrace and logs every syscall a process makes with its arguments and return value, so you see exactly where a C++ program touches the OS.
Common mistakes
- ✗Confusing a system call with an ordinary libc function — many libc functions (
printf) wrap a syscall (write) but are not themselves the syscall - ✗Assuming
straceis free to run —ptracestops the process on every syscall, so it can slow an I/O-heavy program by an order of magnitude - ✗Forgetting
strace -fto followforked children — without it you miss the syscalls of every child process
Follow-up questions
- →How does
strace -csummarize syscall counts and time, and when is that more useful than the full trace? - →Why can
ptrace-based tracing not attach to a process you don't own without elevated privileges?
SeniorTheoryRareHow do gdb, valgrind --leak-check=full and nm -C split the work of localizing a leak in a stripped C++ binary?
How do gdb, valgrind --leak-check=full and nm -C split the work of localizing a leak in a stripped C++ binary?
valgrind --leak-check=full runs the binary instrumented and prints per-allocation leak stacks, separating definitely lost from still reachable, but slows code ~10–30× and can't attach to a live prod process. gdb opens a core dump to inspect the crash frame, locals and heap. nm -C demangles symbols so the tools' addresses map back to C++ names — on a stripped binary, use the unstripped build or its debug-symbols package.
Common mistakes
- ✗Running
valgrindagainst a production service and assuming its ~10–30× slowdown is harmless — it changes timing and can mask or relocate the bug - ✗Trusting the bare addresses in
gdb/valgrindoutput on a stripped binary withoutnm -Cor a debug-symbol package to demangle them - ✗Treating
still reachablefrom--leak-check=fullas the leak — usually it is not;definitely lostis the class that actually leaks
Follow-up questions
- →How do compiler optimizations (
-O2, inlining) degrade the accuracy of agdbbacktrace? - →What does the runtime sanitizer
AddressSanitizergive you thatvalgrind --leak-check=fulldoesn't, and at what cost?
