Containers & Kubernetes
guides.

Containers & Kubernetes articles

62 guides

• Kubernetes CrashLoopBackOff: Find the First Failure ↗

  Diagnose a restarting Kubernetes container using previous logs, exit reason, probes and dependency readiness before changing restart settings.

• Kubernetes Pod Pending: Read Scheduler Events ↗

  Investigate a Pending Kubernetes Pod using scheduler events, resource requests, node conditions, placement and volume constraints.

• Admission Webhook Failures: Keep Policy Enforcement Recoverable ↗

  Diagnose admission webhook denials, timeouts and certificate failures. Review matching scope, failure policy and an independently recoverable policy path.

• VPA Recommendation Mode: Turn Observations into Reviewed Resource Requests ↗

  Use VPA recommendation-only mode to review resource history, policy bounds and platform constraints before validating a controlled sizing change.

• Kubernetes CPU Throttling: Investigate Latency Below Average CPU Limits ↗

  Correlate Kubernetes CPU quota enforcement with tail latency, workload bursts and node capacity. Review requests, limits and autoscaling together.

• Kubernetes Image Garbage Collection: Recover Disk Without Breaking containerd ↗

  Recover Kubernetes image storage through supported kubelet and runtime behavior. Diagnose reclaimable images, inodes and rollout pull headroom.

• cert-manager DNS01 Pending: Trace Public DNS and the Self-Check Resolver ↗

  Trace cert-manager DNS01 challenges through solver permissions, public authority, split DNS and self-check resolution. Verify the served certificate.

• Kubernetes Multi-Attach Errors: Fence the Old Writer Before Recovery ↗

  Investigate Kubernetes Multi-Attach errors with CSI and backend evidence. Fence the old writer and validate exclusive ownership before replacement.

• Kubernetes Termination: Coordinate EndpointSlice State and Connection Drain ↗

  Coordinate Kubernetes EndpointSlice conditions, process signals and shutdown deadlines. Validate active requests and connection draining during rollouts.

• Kubernetes Ephemeral Storage Evictions: Account for Logs and emptyDir ↗

  Diagnose Kubernetes ephemeral-storage evictions by measuring logs, writable layers and emptyDir. Separate Pod limits from node-wide DiskPressure.

• Linux OOM Kills: Distinguish a Container Memory Limit From Host-Wide Pressure ↗

  Investigate Linux out-of-memory events using kernel evidence, cgroup limits, memory counters, runtime budgets, and a controlled reproduction of peak concurrency.

• Helm and CRDs: Plan Schema Upgrades Separately From an Application Rollback ↗

  Coordinate Helm charts, CRD schemas, controllers, custom resources, and data backups so an operator upgrade has a tested compatibility and recovery sequence.

• Docker Build Secrets: Keep Credentials Out of Layers, Logs, and Exported Build Artifacts ↗

  Use Docker BuildKit secret mounts with narrow commands, output inspection, cache-aware workflows, and credential rotation when a build has already exposed a token.

• Kubernetes NetworkPolicy: Test the Allowed Union and the DNS Path Before Declaring Isolation ↗

  Validate Kubernetes NetworkPolicy with effective selectors, additive allow rules, source and destination checks, DNS paths, and explicit negative connectivity tests.

• Kubernetes CronJobs: Reconcile Missed Business Work Without Assuming Every Tick Becomes a Job ↗

  Design CronJobs around time zones, concurrency policy, start deadlines, business-period identities, and an application ledger that detects missing results.

• Kubernetes Health Probes: Stop Liveness Checks From Restarting a Recoverable Application ↗

  Separate startup, readiness, and liveness checks to protect slow initialization, avoid dependency-driven restart storms, and verify customer-visible recovery.

• PodDisruptionBudget Blocking a Drain: Restore Healthy Capacity Before Forcing Eviction ↗

  Diagnose Kubernetes drain blockers through PDB selectors, healthy replicas, scheduling capacity, unhealthy-pod policy, and an application-aware maintenance plan.

• Kubernetes PVC Expansion: Verify the Volume and Filesystem Both Grew ↗

  Trace PVC expansion through storage-class support, CSI events, backing volume capacity, filesystem resize, and application checks before declaring success.

• Kubernetes DNS Latency: Inspect Search Domains and Resolver Behaviour Inside the Pod ↗

  Investigate Pod DNS delays through resolv.conf, search expansion, CoreDNS, network policy, runtime caching, and targeted tests of internal and external names.

• Kubernetes HPA Not Scaling: Verify Metrics and Resource Requests Before Changing Targets ↗

  Diagnose HPA behaviour through metric availability, CPU request math, readiness, stabilization, replica limits, and downstream capacity under a controlled load.

• Kubernetes Topology Spread: Explain a Pending Pod Before Relaxing Availability Rules ↗

  Investigate topology spread scheduling with eligible zones, label selectors, rollout surge, node capacity, and a deliberate availability tradeoff.

• Kubernetes VolumeSnapshots: Prove Restore Readiness Before Calling Them Backups ↗

  Review CSI VolumeSnapshot readiness, driver dependencies, retention, and application consistency, then restore into a controlled namespace for verification.

• Kubernetes Audit Policies: Keep Useful Evidence Without Recording Secret Bodies ↗

  Design Kubernetes audit policy rules around useful metadata, sensitive resources, retention, and tested delivery rather than recording every request body.

• Kubernetes Taints and Tolerations: Avoid Turning a Placement Change Into an Eviction ↗

  Compare NoSchedule, PreferNoSchedule, and NoExecute taints, review toleration scope, and rehearse node-pool changes without accidental workload eviction.

• Kubernetes EndpointSlice Conditions: Coordinate Pod Termination With Traffic Draining ↗

  Interpret Kubernetes EndpointSlice ready, serving, and terminating conditions, then test application shutdown and routing during a rolling deployment.

• Debugging Distroless Pods With Ephemeral Containers: Know What the Tools Can See ↗

  Use Kubernetes ephemeral containers for distroless debugging while checking namespace visibility, permissions, resource impact, and incident evidence.

• ConfigMap Changes Not Reaching a Pod: Check Mount Style and Application Reload ↗

  Diagnose ConfigMap updates across environment variables, projected volumes, subPath mounts, and application reload behaviour with explicit rollout tests.

• Kubernetes Finalizers: Investigate Stuck Deletion Before Removing the Safety Check ↗

  Investigate Kubernetes objects stuck terminating by identifying finalizer ownership, controller failures, and external cleanup before removing protection.

• Helm CRDs: assign upgrade and deletion ownership ↗

  Plan custom-resource definitions as a cluster-level API lifecycle with explicit owners, conversion compatibility and a tested controller rollout.

• Helm rollback: verify persistent state compatibility ↗

  Plan Helm rollback around release history, workload readiness and persistent data compatibility so a restored chart revision can operate safely.

• Helm rendering: validate against the target Kubernetes API ↗

  Separate Helm rendering from Kubernetes API acceptance, then validate API versions, schemas, installed CRDs and target-cluster capabilities before release.

• Helm values: review the effective configuration ↗

  Trace Helm values through chart defaults, override files and release reuse so the reviewed deployment configuration matches what the templates render.

• Docker DNS: Check the Network Behind a Container Name ↗

  Investigate container-name lookup failures by comparing network attachments, aliases and resolver configuration. Test the container port rather than its published host port.

• Docker Disk Growth: Separate Layers, Logs and Volumes ↗

  Explain container-related disk growth by separating writable layers, logging-driver files and volumes. Use read-only inventory before selecting a scoped correction.

• Docker ENTRYPOINT Signals: Check the PID 1 Boundary ↗

  Investigate slow container shutdown by inspecting ENTRYPOINT, wrapper scripts and PID 1. Verify signal delivery with a disposable workload and application logs.

• Docker Digests: Pin the Intended Platform Artifact ↗

  Identify whether an image digest names a multi-platform index or one platform manifest. Record release identity and verify what each runtime actually uses.

• BuildKit Secrets: Keep Credentials Out of Image Layers ↗

  Pass build credentials through BuildKit secret mounts and verify their consumption path. Review logs, copied output and cache behavior after credential rotation.

• BuildKit Cache Misses: Inspect Inputs and Layer Order ↗

  Find why BuildKit rebuilds dependency layers by comparing context, Dockerfile order and cache scope. Validate repeatability before exporting a shared cache.

• PV Reclaim Policy: Plan a Safe Retention Handoff ↗

  Review Retain and Delete before retiring a Kubernetes claim. Record the live PV, storage owner and recovery acceptance checks without destructive trial commands.

• CronJob Concurrency and Job TTL: Explain Missing Runs ↗

  Separate skipped CronJob schedules from finished Jobs removed by TTL. Follow active Jobs, concurrency policy and retained evidence before changing settings.

• CSI Volume Expansion: Follow PVC and Filesystem Status ↗

  Investigate a larger PVC request that has not become usable application space. Follow StorageClass capability, CSI events and filesystem expansion status.

• Kubelet Certificate Rotation: Inspect the CSR Handoff ↗

  Trace kubelet client-certificate rotation through request, approval, signing and retrieval. Review each CSR identity before considering an approval action.

• ServiceAccount Access: Separate Tokens from RBAC ↗

  Investigate ServiceAccount 401 and 403 responses by checking token audience, rotation and scoped RBAC. Verify identity without printing bearer tokens.

• Quota or LimitRange: Find Why Kubernetes Rejects a Pod ↗

  Separate namespace quota exhaustion from per-container LimitRange rejection. Inspect admitted resource defaults and rollout headroom before changing policy.

• Topology Spread and Anti-Affinity: Explain Pending Pods ↗

  Investigate a Pending Pod by combining topology labels, spread selectors and anti-affinity rules. Check all placement constraints before relaxing policy.

• StatefulSet Updates: Read Partitions and Pod Order ↗

  Explain why a StatefulSet updates only some Pods or stops at one ordinal. Compare partition settings, revisions and ordered readiness before intervening.

• Deployment ProgressDeadlineExceeded: Find the Stalled Step ↗

  Read Deployment progress conditions, ReplicaSets and Pod events to locate a stalled rollout. Set a justified deadline after correcting the actual cause.

• ImagePullBackOff: Check Secret and ServiceAccount Scope ↗

  Diagnose private-image pulls by following the live Pod, namespace Secret and ServiceAccount. Check registry matching without exposing credentials.

• Kubernetes Ingress Paths: Trace a 404 to Its Rule ↗

  Trace an Ingress 404 through hostname, path type and backend routing. Distinguish rule matching from controller-specific rewrites and application redirects.

• Kubernetes DNS: Explain Search Paths and ndots ↗

  Investigate Kubernetes DNS names that work in one namespace but fail in another. Compare resolver search paths before changing CoreDNS configuration.

• Kubernetes Service: Diagnose an Empty EndpointSlice ↗

  Follow a Kubernetes Service from selector to EndpointSlice and target port. Use scoped checks to explain why healthy-looking Pods receive no traffic.

• Docker bind-mount permission errors: trace the writer identity ↗

  Diagnose Docker bind-mount write failures through the mounted host path, container UID/GID and security context without broad permission changes.

• Docker Compose startup races: separate running from ready ↗

  Design Docker Compose dependency startup around meaningful health checks and application retries, then test cold starts and dependency restarts deliberately.

• HPA unknown metrics: verify the signal before changing replica limits ↗

  Troubleshoot Kubernetes HPA metric failures through resource requests, metrics APIs and controller conditions before raising replica limits or guessing thresholds.

• Node drain blocked by a PDB: inspect availability before changing the budget ↗

  Explain a blocked Kubernetes drain using PodDisruptionBudget status, healthy replicas and workload readiness, then plan maintenance without forced disruption.

• Kubernetes PVC Pending: follow the storage and scheduling handshake ↗

  Diagnose a Pending Kubernetes PVC by tracing StorageClass binding mode, consumer scheduling and CSI evidence before changing or recreating persistent storage.

• Java container memory: budget beyond the heap ↗

  Investigate JVM container memory pressure by separating heap, native allocations and process limits, then validate a measured budget under realistic concurrency.

• Docker Image Attestations: Connect the Artifact to Its Build ↗

  Review Docker build attestations with image digests, trusted builders and release evidence. Distinguish artifact metadata from proof that application code is safe.

• Kubernetes NetworkPolicy: Map Dependencies Before Isolation ↗

  Plan Kubernetes NetworkPolicy using namespace dependencies, DNS requirements and controlled allowed/denied tests. Confirm enforcement with the cluster networking implementation.

• Kubernetes Probes: Separate Readiness from Recovery ↗

  Design Kubernetes startup, readiness and liveness probes around different failure modes. Test traffic removal and recovery before a rollout.

• Docker Memory Limits: Plan Capacity Before Production ↗

  Plan Docker memory limits using workload tests, host headroom and failure checks. Diagnose container exits without weakening host protection.

• Choose a container platform your team can operate. ↗

  Match orchestration choices to your workload and operational capacity.