AWS, Docker, CI/CD

AWS services on the CV

Service	One line	Your use
EKS	Managed Kubernetes control plane; you run pods on node groups or Fargate	Platform services; the blue/green migration
ECS	AWS's own container orchestrator (tasks, services), on EC2 or Fargate; simpler than Kubernetes	Fill in
EMR	Managed Spark/Hadoop/Hive clusters for big-data jobs; on EC2, EKS or serverless	Batch jobs; migrated with zero downtime
Lambda	Functions run on events; pay per invocation; 15-minute limit; cold starts	AI League agents' action groups
Bedrock	Managed foundation models via API, plus Agents, Knowledge Bases, Guardrails	AI League
DynamoDB, S3, IAM, CloudWatch, Route 53, ALB	Data, storage, permissions, logs/metrics, DNS, load balancing	Around everything

ECS vs. EKS vs. Lambda: how do you choose?

Lambda for event-driven, short, spiky work with little ops (watch cold starts, 15-min limit, per-request cost at high volume). ECS for containers on AWS with the least operational overhead. EKS when you want Kubernetes: portability, its ecosystem (Helm, operators), many teams on one platform; costs more expertise.

Kubernetes basics: pod, deployment, service, ingress?

Pod: one or more containers scheduled together. Deployment: desired number of pod replicas, rolling updates and rollback. Service: a stable virtual IP/DNS name load-balancing to matching pods. Ingress: HTTP routing from outside to services (on AWS via the ALB controller). Also: ConfigMap/Secret for config, HPA for autoscaling on CPU/custom metrics, liveness (restart if dead) vs. readiness (remove from load balancing until ready) probes, resource requests/limits.

A pod keeps restarting. How do you debug it?

kubectl describe pod (events: OOMKilled, failing probes, image pull errors), kubectl logs --previous (logs of the crashed container), check resource limits vs. JVM heap settings, readiness/liveness timings (a JVM that starts slowly killed by a liveness probe is a classic), config and secrets mounted correctly.

How does IAM work? Roles for pods?

Policies (JSON allow/deny on actions and resources) attached to users, groups or roles. Services assume roles to get temporary credentials. On EKS, IRSA or EKS Pod Identity gives each service account its own role, so pods get least-privilege access without static keys.

What is Terraform? State?

Infrastructure as code: declare resources in HCL; terraform plan shows the diff, apply makes it so. State records what exists; keep it remote (S3 + DynamoDB lock table, or Terraform Cloud) so teams don't overwrite each other. Modules for reuse. Never edit infrastructure by hand once it's managed. Be honest about depth here.

Docker

Container vs. VM?

A VM virtualises hardware and runs a full guest OS. A container shares the host kernel and isolates processes with namespaces and cgroups: lighter, faster to start, less isolation.

How do you write a good Dockerfile for a Java app?

Multi-stage build (build with JDK + Maven, run on a slim JRE image), copy the dependency layer before the code so builds cache, run as non-root, set heap with -XX:MaxRAMPercentage instead of fixed -Xmx, add a health check, pin image versions, and consider Spring Boot layered jars or Jib/buildpacks.

Prayog link: multi-arch images (ADR 0021) and an 11-container Compose stack with health checks and depends_on conditions (the exchange waits for Kafka topics to exist).

What is Docker Compose for?

Defining and running a multi-container app locally: services, networks, volumes, health checks, dependencies. Prayog runs everything with make up: exchange, post-trade, Kafka (KRaft), Postgres, Redis, Keycloak, Traefik, Prometheus, Grafana, simulated traders, web.

CI/CD and practice

Describe a good CI/CD pipeline.

On every PR: build, unit tests, static analysis (Sonar: bugs, code smells, coverage, security hotspots), dependency vulnerability scan, integration tests, build the image. On merge: publish the image, deploy to a test environment, smoke/E2E tests, then promote to production with blue/green or canary and automatic rollback on failed health checks. Keep it fast; flaky tests get fixed or removed.

Your tools: Jenkins and Sonar at work; GitHub Actions in Prayog and Galois (tests, docs site and Pages deploy on every push).

What is a quality gate in Sonar?

A set of conditions (e.g. no new bugs or vulnerabilities, coverage on new code ≥ 80%, duplication < 3%) that a build must pass; the pipeline fails otherwise. "Clean as you code": focus on new code.

Git: merge vs. rebase? How do you handle a bad commit in main?

Merge keeps history and adds a merge commit; rebase replays your commits on top for a linear history (never rebase shared branches). For a bad commit on main: git revert <sha> (a new commit undoing it), never rewrite shared history. git bisect to find which commit broke something.

Observability

Logs vs. metrics vs. traces?

Metrics: numbers over time (rate, errors, duration: RED; utilisation, saturation, errors: USE), cheap, for dashboards and alerts. Logs: detailed events, structured (JSON) with a correlation id. Traces: one request across services as spans (OpenTelemetry), to find where time goes. Alert on symptoms users feel (error rate, latency SLO), not on every cause.

Why percentiles and not averages?

Averages hide the tail. If p99 is 2 s, 1 in 100 requests is slow, and a page making 20 calls hits it often. Use histograms (Prometheus histogram_quantile) and watch p50, p99, p99.9.

Prayog link: a Prometheus query over the incident window showed GC pause time lining up with the p99 spikes.