DevOps concepts, explained
Find the topic you need. Learn how it works through diagrams and worked examples, then practise the questions that use it.
Begin the curriculum →Browse by topic below, or search the library.
Jump to a topic
Systems Foundations
19 conceptsNamespaces & Cgroups
Separate what a container can see from what it can consume.
Queues & Latency
Find where waiting work accumulates as a service approaches capacity.
DNS Resolution
Trace recursive lookups, cached answers and negative responses.
Linux Processes & Syscalls
Follow application work across the user-space and kernel boundary.
Kernel Patching
Check the running kernel and plan safe updates and reboots.
TCP Connections
Interpret handshakes, retransmissions, FINs and resets.
TCP Flow & Congestion Control
Separate receiver limits from network congestion and throughput.
TLS & Certificate Chains
Verify trust, hostnames and the evidence behind handshake failures.
HTTP Versions & Connections
Compare HTTP/1.1, HTTP/2 and HTTP/3 across each network hop.
Linux Load Average
Separate runnable demand from blocked tasks and CPU pressure.
Virtual Memory & Page Cache
Read memory usage, reclaim evidence and container limits correctly.
File Descriptor Exhaustion
Trace open files and sockets before raising a process limit.
systemd Services
Separate process startup, service readiness and recovery policy.
Disk Space & Inodes
Explain ENOSPC when free bytes and visible file sizes disagree.
Shell Exit Status
Catch hidden command failures without misusing set -e.
PowerShell Automation
Handle cmdlet failures, native exit codes, and remote objects deliberately.
JVM & Application Servers
Find where requests wait before increasing threads, heap or connection limits.
Firewalls & Conntrack
Follow a packet through ordered rules and explain why old sessions still work.
Processes & Threads
Explain shared state, reproduce a lost update and choose what a lock must protect.
Cloud Architecture
21 conceptsFailure Domains
Compare the protection offered by regions, zones and cells.
Cloud Control Planes
Design recovery that survives an unavailable management API.
Serverless Lifecycle
Understand cold starts, execution reuse and concurrency.
Serverless Retries
Trace failed events, duplicate effects and recovery destinations.
Cloud IAM Policies
Work out effective permissions across allows, boundaries and denies.
VPC Subnets & Routes
Follow public, private and NAT traffic through its return path.
Security Groups vs ACLs
Compare stateful filtering with ordered subnet rules.
Load Balancer Draining
Stop new requests while existing connections finish safely.
Autoscaling Control Loops
Choose scaling signals and headroom that survive slow startup.
Object Storage & Versioning
Separate read consistency, retained versions and replica recovery.
Block, File & Object Storage
Choose storage by update semantics, sharing and recovery needs.
RTO, RPO & Recovery Tests
Measure a restored business operation, not a completed backup job.
Cloud Landing Zones
Design account boundaries, centralized evidence and controlled exceptions.
CDN Caching & Invalidation
Choose cache identity before tuning hit rate or purging objects.
Managed Database Failover
Trace recovery from a new writer through DNS, pools and uncertain transactions.
Database Engine Upgrades
Rehearse compatibility and recovery before an engine upgrade accepts new writes.
GCP Hierarchy & Shared VPC
Trace permissions and network ownership across Google Cloud projects.
Azure Governance
Separate inherited access, deployment restrictions and remediation in Azure.
CloudTrail Investigations
Check collection scope before treating a missing audit event as proof.
OpenStack Service Boundaries
Diagnose instance failures across Nova, Neutron, Placement and storage.
Redshift Performance
Separate queueing from execution before changing SQL, distribution or warehouse capacity.
Containers & Kubernetes
25 conceptsKubernetes Control Loops
Follow a controller from observed state to corrective action.
CPU Quotas & Throttling
Explain why a CPU-limited container stalls on an idle node.
Resource Requests & Limits
Separate scheduling reservations from runtime enforcement.
Kubernetes Architecture
Map the control plane, worker nodes and their failure boundaries.
Pods, ReplicaSets & Deployments
Trace ownership, replacement and rolling updates.
Services & EndpointSlices
Connect a stable Service address to ready backends.
Ingress & Gateway API
Separate routing configuration from the proxy that serves traffic.
Helm Charts & Releases
Understand values, rendering, hooks and rollback boundaries.
Kubernetes Probes
Choose startup, readiness and liveness checks for different failures.
Kubernetes RBAC
Connect service accounts to scoped permissions and escalation paths.
Image Layers & Build Cache
Predict cache reuse and prevent secrets entering image layers.
OCI Images & Runtimes
Distinguish image manifests, runtime bundles and Kubernetes CRI.
Multi-Stage Builds
Keep compilers and build dependencies out of the runtime image.
Container Shutdown
Handle signals, child processes and the termination deadline.
Kubernetes Scheduling
Combine affinity, taints and topology to explain Pending pods.
Kubernetes QoS & Eviction
Explain why a pod was evicted, OOM-killed or throttled.
Kubernetes Node Autoscaling
Explain why pending pods do or do not trigger new nodes.
StatefulSets
Separate a stable pod name from data replication and write ownership.
Kubernetes NetworkPolicy
Trace both sides of a connection and catch selector mistakes.
Kubernetes Backup & Restore
Recover cluster objects and application data as separate dependencies.
KEDA Event-Driven Scaling
Follow a queue signal through activation, the HPA and usable worker capacity.
Pod Disruption Budgets
Calculate safe evictions and diagnose a node drain that cannot finish.
Operators & CRDs
Separate a custom API from the controller that operates its resources.
OpenShift Architecture
Follow a workload through platform ownership, security admission and routing.
Service Mesh & Identity
Separate encrypted transport, workload identity and HTTP authorization in Istio.
Declarative Infrastructure
17 conceptsInfrastructure State & Drift
Track the relationship between configuration and real resources.
Immutable Infrastructure
Plan replacements around data, identity and availability.
Terraform Architecture
Follow configuration through providers, plans, state and apply.
Terraform State Locking
Prevent concurrent writes and recover without trusting a stale plan.
Ansible Architecture
Connect inventory, tasks, modules and handlers to repeatable change.
Ansible Rolling Patches
Drain and patch hosts in batches with explicit failure controls.
Terraform Modules
Design inputs, outputs and provider ownership for reuse.
Terraform Refactoring
Rename resources and change instance keys without recreation.
Terraform Import
Adopt existing infrastructure without applying unwanted changes.
Terraform Lifecycle Rules
Control replacement order and decide who owns external changes.
Terraform Workspaces
Separate state while checking credentials and environment boundaries.
Terraform Provider Upgrades
Review versions, checksums and schema changes before upgrading.
Terraform Drift Remediation
Decide who owns a drifted setting before applying a repair.
Terraform Secrets & State
Trace secrets beyond terminal masking into state, plans and artifacts.
Terraform Tests & Policy
Separate configuration assertions from live provider and policy evidence.
Ansible Roles & Collections
Package automation, define role inputs and avoid hidden overrides.
CloudFormation Recovery
Review replacements, detect drift, and recover a stack with failed rollback.
Delivery & GitOps
26 conceptsGitOps Reconciliation
Follow how a controller corrects the gap between desired and live state.
Deployment vs Release
Separate shipping code from exposing a feature to users.
Build Once, Promote
Move the same tested artifact through environments.
DORA Delivery Metrics
Read delivery speed alongside instability and rework.
Git Branching Strategies
Choose trunk or release branches around how your team ships.
Git Merge vs Rebase
Compare commit ancestry and the risks of rewriting shared history.
Semantic Versioning
Reason about compatibility, prereleases and dependency ranges.
CI/CD Pipeline Architecture
Trace jobs, artifacts and trust boundaries from commit to production.
Canary Deployments
Choose traffic cohorts and evidence for promotion or rollback.
Safe Rollbacks
Check whether older code can still read new data and messages.
Argo CD Architecture
Connect rendering, reconciliation and application health.
Azure Pipelines
Understand stages, agents, approvals and protected resources.
Code Review
Review infrastructure changes with clear ownership and useful evidence.
Push vs Pull GitOps
Compare deployment credentials and reconciliation ownership.
Git Reset, Revert & Reflog
Recover lost work without damaging shared branch history.
Git Objects & References
See how commits, trees, blobs and HEAD fit together.
Cherry-Picks & Backports
Move a fix between release lines with its dependencies intact.
Git Bisect
Find the first bad commit with a repeatable failure test.
Git Merge Queues
Test the combined revision that will actually enter the branch.
CI Test Selection & Flakes
Choose affected tests without letting retries hide regressions.
Build Caches & Reproducibility
Keep cache hits from hiding dependency drift or untrusted build output.
Jenkins Controllers & Agents
Separate scheduling capacity from build execution and trust.
Azure Templates & Checks
Share pipeline logic while resource owners control production access.
Maven & Gradle Dependencies
Trace version conflicts and distinguish locked versions from reproducible artifacts.
Mobile CI/CD
Ship signed Android and iOS builds with a recovery plan for installed versions.
Argo CD Waves & Hooks
Order release dependencies without assuming wave numbers override phases or health.
Observability & Reliability
18 conceptsError Budgets
Calculate tolerated failure and use burn rate to guide action.
Metric Cardinality
Estimate series growth before choosing metric labels.
Symptom-Based Alerts
Page on user impact and use cause metrics to investigate.
Metrics, Logs & Traces
Choose the evidence needed to answer a production question.
Prometheus Metric Types
Use counters, gauges and histograms with appropriate queries.
SLIs & SLOs
Define valid events, good outcomes and the measurement boundary.
Alertmanager
Route and group notifications without hiding independent failures.
Burn-Rate Alerts
Combine time windows to detect sustained budget consumption.
Alert Fatigue
Give every page an owner, an action and a retirement decision.
Prometheus Scraping
Distinguish failed scrapes, stale series and genuine zero values.
PromQL Vector Matching
Join series with explicit labels and predictable cardinality.
Prometheus Recording Rules
Precompute useful queries without losing labels or hiding failures.
Native Histograms
Migrate histogram queries while preserving counts and alert meaning.
OpenTelemetry Collector
Trace telemetry through processors, exporters and bounded queues.
Head & Tail Sampling
Keep useful traces without hiding errors or overloading collectors.
Grafana Dashboards
Build incident-ready views and keep dashboard changes under version control.
JMeter Performance Testing
Match the load model to real demand and verify what successful samples mean.
Tracing Across Queues
Follow asynchronous work with message context, span links and distinct retry attempts.
Debugging Production
13 conceptsDiagnostic Method
Test competing explanations using evidence from an unfamiliar system.
Cascading Failures
Trace how slow dependencies exhaust otherwise healthy services.
Incident Mitigation
Reduce customer impact while preserving evidence for diagnosis.
Incident Command
Assign severity, decision authority and handoff responsibilities.
Postmortems
Turn contributing conditions into verifiable corrective actions.
Incident Communication
Report confirmed impact, uncertainty and the next update time.
Change Correlation
Compare timelines and cohorts before blaming a recent deployment.
CrashLoopBackOff
Find why the process exits before changing restart settings.
Connection Pool Exhaustion
Find why connections stay occupied before raising the pool limit.
Memory Leaks vs Caches
Compare retained objects, workload and memory pressure before calling a leak.
ITSM & Change Enablement
Connect incidents, changes and service ownership to operational evidence.
Slow Database Queries
Read query plans and wait evidence before adding database capacity.
Redis Memory & Latency
Separate cache eviction, rejected writes and slow requests before changing limits.
Security in the Pipeline
19 conceptsZero Trust Identity
Authorize requests using identity rather than network location.
Software Supply Chains
Trace dependencies, build tools and artifact trust.
Secrets Management
Plan issuance, delivery, rotation and revocation together.
Vault Dynamic Secrets
Follow leased credentials through renewal and revocation.
Active Directory Architecture
Connect forests, domains, controllers and DNS dependencies.
Entra ID vs Active Directory
Compare identity protocols and the boundaries of a migration.
Kerberos Tickets
Trace TGTs, service principals and clock-related failures.
Intune Enrollment
Separate device registration from MDM and extension management.
Intune & Conditional Access
Distinguish device compliance evaluation from access enforcement.
Windows Update Rings
Stage patches with restart controls and rollout evidence.
Workload Identity & OIDC
Match the issuer, audience and subject before granting cloud access.
LDAP Queries
Understand bind identity, search scope and protected transport.
Group Policy
Resolve policy scope, precedence and effective Windows settings.
OAuth Tokens & Scopes
Authorize a client for the intended resource and operation.
RBAC vs ABAC
Compare roles and attributes through concrete permission decisions.
SAST, DAST & Dependency Scans
Match security checks to the failures they can actually detect.
Certificate Issuance & Renewal
Connect domain validation, key protection and the live TLS endpoint.
Checkmarx Release Gates
Distinguish a completed scan from a release that satisfies security policy.
Qualys Remediation Evidence
Confirm that a disappearing finding reflects a fix rather than lost scan visibility.
Infrastructure at Scale
16 conceptsCapacity Estimation
Estimate traffic, storage and bandwidth before drawing a design.
Saturation & Utilization
Explain why queues and latency grow before capacity reaches 100%.
Idempotency
Make repeated requests safe at the business-effect boundary.
Reliable Webhooks
Authenticate events, accept durably and handle duplicate delivery.
Timeouts & Deadlines
Bound downstream work by the time the caller still has available.
Retries, Backoff & Jitter
Limit repeated work and avoid synchronized retry bursts.
Circuit Breakers & Bulkheads
Isolate dependency failures with bounded probes and concurrency.
Rate Limiting
Compare token buckets, fixed windows and shared quotas.
Queue Delivery Guarantees
Trace acknowledgments, redelivery and duplicate business effects.
Transactional Outbox & Inbox
Coordinate database changes with publication and duplicate handling.
Locks & Fencing Tokens
Prevent an expired lease holder from overwriting a newer owner.
NoSQL Data Modeling
Choose keys from actual queries and specify which reads may be stale.
Kafka Partitions & Offsets
Connect partition ownership, committed offsets and safe replay after a crash.
REST API Contracts
Design predictable updates, errors and pagination for clients that retry.
Data Pipeline Backfills
Replay a defined data interval without publishing partial or duplicate results.
Normalization & Read Models
Prevent update anomalies while keeping historical prices and read models consistent.
Platform & Cloud Economics
14 conceptsPlatform as a Product
Judge a platform by developer adoption and useful outcomes.
Cloud Unit Economics
Connect infrastructure spend to the unit of work it delivers.
Golden Paths & IDPs
Define supported delivery paths and who maintains them.
Service Catalogs
Keep service ownership and dependency metadata trustworthy.
Developer Self-Service
Automate approved actions with clear policy and recovery boundaries.
Cloud Cost Allocation
Connect billing rows to owners without hiding shared or unknown costs.
Showback & Chargeback
Allocate shared services without confusing budget transfers with savings.
Cloud Rightsizing
Test smaller capacity against peak demand, failure scenarios and actual billing.
Cloud Foundry & PCF
Separate staging, runtime health and recovery across a Cloud Foundry release.
Cognitive Load as a Design Constraint
A platform earns its place by removing things a team must hold in its head.
Abstraction Leakage
Every abstraction leaks under failure. Decide what the developer sees when it does.
Internal SLOs and What Breach Costs
An internal objective needs a stated consequence, because no money moves between teams.
Migration Cost Asymmetry
Migration costs land on the team now; benefits land later and elsewhere.
The Contribution Contract
A merged contribution with no named maintainer is cost transferred, not help received.
AI Infrastructure
15 conceptsGPU Scheduling
Place workloads around GPU memory, topology and sharing limits.
KV Cache
Work out how cached tokens limit concurrent requests.
Prefill & Decode
Understand the two phases that compete for GPU capacity.
Model Quality Monitoring
Detect output failures that healthy infrastructure metrics miss.
Token Economics
Connect token counts to serving cost, latency and capacity.
Agents & the Confused Deputy
Keep untrusted instructions from borrowing an agent's authority.
AI Code Review
Evaluate findings and control what a review agent can change.
AI-Assisted Development
Set evidence and approval requirements from specification to release.
AI-Generated Infrastructure
Check generated plans against intended resources and permissions.
Repository Prompt Injection
Protect CI tools from instructions hidden in repository content.
Inference Batching
Balance batch throughput against waiting time and latency targets.
GPU Memory Fragmentation
Diagnose allocation failures beyond a single free-memory number.
Model Release Provenance
Bind weights, tokenizer, runtime and evaluation to one release identity.
Agent Lifecycle (ADLC)
Build, evaluate and operate agents with bounded authority.
MLOps Data Contracts
Test that training and serving use compatible features available at prediction time.
The Engineering Craft
8 conceptsIncident Narratives
Explain your decisions, evidence and recovery during an outage.
Project Narratives
Make your contribution and technical reasoning clear in an interview.
Operational Tradeoffs
Explain a time-limited decision and who owns the remaining risk.
Cross-Team Ownership
Resolve who operates, approves and supports a shared service.
Leading Migrations
Sequence a production move with evidence and recovery checkpoints.
Toil Reduction
Choose recurring work worth automating and prove the benefit.
Operational Mentoring
Coach diagnosis and hand over responsibility with observable evidence.
Runbooks That Work
Write procedures another responder can verify, stop and safely hand over.