DevOps Interview Questions 2026: 36 Real Questions With Answers

I have sat on both sides of the DevOps interview table for a long time, and the questions that separate candidates have barely changed: what happens when you type a URL, why is this pod restarting, who owns the state file. What changed in 2026 is the wrapper. Interviewers now assume you use an AI assistant, so they push harder on whether you can tell when its answer is wrong. This post collects 36 DevOps interview questions I would actually ask or expect to be asked, grouped by topic, each with a short answer that is correct against current docs (Kubernetes 1.37, Terraform 1.17, OpenTofu 1.13). The paired guide, Kubernetes troubleshooting interview scenarios, turns the hands-on part into ten scenarios you can break and fix on a laptop.

What do DevOps interviewers actually look for in 2026?

Three things, in this order. First, a debugging method: do you look at evidence before you guess? Second, depth in one area and honest boundaries elsewhere; "I have not run Kafka in production, here is how I would find out" scores better than a confident wrong answer. Third, judgement about risk: when to roll back, what you would never do on a Friday, why the state file is locked.

Tool trivia is weighted lower than it used to be, partly because any assistant can recite flags. The exception is Kubernetes, where hands-on fluency still gets tested directly. The Linux Foundation's CKA exam, which is based on Kubernetes v1.37, gives Troubleshooting 30 percent of the score, more than any other domain, and many interview loops copy that emphasis with a live "fix this cluster" exercise. If you are planning a broader learning path, my DevOps roadmap for 2026 covers what to learn in which order.

Linux and networking interview questions

1. What happens when you type a URL into a browser and press Enter? DNS resolution (cache, resolver, recursive lookup), a TCP handshake (or QUIC for HTTP/3), a TLS handshake with certificate validation, the HTTP request, then whatever sits behind the load balancer. Strong candidates say where each step fails and how they would see it. My DNS explainer covers the first hop in detail.

2. A server is slow. What do you run first? uptime for load, free -m for memory, vmstat 1 for CPU and swap, iostat -xz 1 for disk, ss -s for sockets, then dmesg for OOM kills or hardware errors. The 60-second Linux checklist is the version I teach.

3. What does load average mean? The average number of tasks running or waiting to run (on Linux, including uninterruptible disk waits) over 1, 5 and 15 minutes. A load of 8 on an 8-core box is busy, not broken.

4. What is the difference between a process being killed with SIGTERM and SIGKILL? SIGTERM (15) can be caught so the process can clean up; SIGKILL (9) cannot. A container that exits with code 137 was killed with signal 9 (128 + 9), which in Kubernetes usually means OOMKilled.

5. A port is "already in use". How do you find the owner? ss -ltnp 'sport = :8080' or lsof -i :8080. Then ask why two things want the same port.

6. What is the difference between a 502 and a 504? A 502 means the proxy got an invalid response or a refused connection from upstream; a 504 means the upstream did not answer in time. I wrote a full 502 and 504 guide.

7. How would you debug "SSH permission denied (publickey)"? ssh -vvv, check which key was offered, the remote user, ~/.ssh permissions and authorized_keys, and the server's auth log. See the SSH guide.

The kind of answer that scores well on question 2 is a sequence, not a list of tools. Something like this, said out loud while you type it:

# Linux triage, in the order I would narrate it in an interview.
uptime                       # load averages: 1, 5, 15 minutes
dmesg -T | tail -20          # OOM killer, disk or NIC errors
vmstat 1 5                   # r = run queue, si/so = swapping, wa = IO wait
iostat -xz 1 3               # per-disk utilisation and await (sysstat package)
free -m                      # available memory, not just free
ss -s                        # socket summary: lots of TIME_WAIT or SYN-RECV?
journalctl -u myapp --since "15 min ago" --no-pager | tail -50

CI/CD and Git interview questions

8. Walk me through a CI/CD pipeline you built. Name the trigger, build, test, artifact (with a digest), security scan, deploy and verification steps, and where a human approves. Interviewers listen for rollback and for how secrets reach the pipeline. My GitHub Actions pipeline guide is a reference shape.

9. How do you get cloud credentials into CI without long-lived keys? OIDC federation: the CI provider issues a signed token per job and the cloud exchanges it for short-lived credentials. GitHub documents this under OpenID Connect; I have a setup guide for AWS, GCP and Azure.

10. Merge vs rebase? Merge preserves history with a merge commit; rebase rewrites your commits onto a new base for a linear history. Never rebase a branch other people have pulled.

11. Trunk-based development or GitFlow? Trunk-based with short-lived branches and feature flags for most teams that deploy often; GitFlow fits versioned releases. See branching strategies.

12. Blue-green vs canary? Blue-green switches all traffic between two full environments; canary shifts a small percentage and watches metrics before continuing. Canary needs good metrics or it is just a slow deploy.

13. What are the DORA metrics? DORA now lists five: change lead time, deployment frequency and failed deployment recovery time for throughput, and change fail rate and deployment rework rate for instability. Answering "four" in 2026 dates you slightly. More in DORA metrics explained.

Docker and Kubernetes interview questions

14. Container vs virtual machine? A container shares the host kernel and is isolated with namespaces and cgroups; a VM has its own kernel on a hypervisor. That shared kernel is the security trade-off.

15. How do you make a Docker image smaller? Multi-stage builds, a slim or distroless base, fewer layers with cache-friendly ordering, and a .dockerignore.

16. Explain Pods, Deployments and Services. A Pod is one or more containers sharing a network namespace; a Deployment manages ReplicaSets for rolling updates; a Service gives a stable virtual IP and DNS name to a set of Pods chosen by label selector. The longer version is in Kubernetes explained.

17. A pod is in CrashLoopBackOff. What do you do? kubectl describe pod, then kubectl logs --previous, then check the exit code and probes. The kubelet's restart back-off starts at 10s and doubles to a cap of 300 seconds, resetting after 10 minutes of clean running, per the pod lifecycle docs. Full method in my CrashLoopBackOff guide.

18. A pod is stuck in Pending. Why? The scheduler cannot place it: insufficient CPU or memory requests, taints without tolerations, node affinity, or an unbound PVC. The events tell you which. See Pods stuck in Pending.

19. Requests vs limits? Requests drive scheduling; limits are enforced at runtime. Exceed a memory limit and the container is OOMKilled; exceed a CPU limit and it is throttled. See requests and limits and the OOMKilled guide.

20. Liveness vs readiness vs startup probes? Readiness removes a pod from Service endpoints; liveness restarts the container; startup holds the other two off until a slow app has booted. A liveness probe that checks a database is a classic outage generator. More in probes explained and the probe failure guide.

21. A Service returns "connection refused". Where do you look? EndpointSlices first (kubectl get endpointslices -l kubernetes.io/service-name=<svc>); an empty list means the selector matches no ready pods. Then targetPort versus the port the app actually listens on. The v1 Endpoints API has been deprecated since 1.33. See the Service connection refused guide.

22. DNS inside the cluster is failing. How do you prove it? Run a debug pod, nslookup kubernetes.default, check /etc/resolv.conf, then the CoreDNS pods and logs. My CoreDNS troubleshooting guide walks it end to end.

23. What does "User cannot list resource" mean? An RBAC denial. kubectl auth can-i list pods --as=system:serviceaccount:ns:sa confirms it, and a Role plus RoleBinding fixes it. See the RBAC forbidden guide and RBAC explained.

24. ImagePullBackOff? Wrong image name or tag, a private registry without imagePullSecrets, rate limits, or the wrong architecture. See ImagePullBackOff and ErrImagePull.

25. Ingress NGINX was retired. What now? SIG Network ended maintenance in March 2026, with no further security fixes. Gateway API is the direction; my Ingress NGINX retirement post compares the replacements.

Terraform and infrastructure as code questions

26. What is Terraform state and why does it matter? The mapping between your configuration and real resource IDs. Lose it and Terraform thinks nothing exists; share it without locking and two applies corrupt it. Remote backends with state locking are the baseline. Background in Terraform state in 2026.

27. Someone changed a resource in the console. What happens on the next plan? Terraform refreshes state, sees drift, and proposes to revert it. terraform plan -refresh-only shows drift without proposing changes, so you can decide which side is correct.

28. How do you bring an existing resource under Terraform? An import block, plan to verify zero diff, then apply. See importing existing resources.

29. How do you rename a resource without destroying it? A moved block from the old address to the new one.

30. Terraform or OpenTofu? Same language heritage, different governance. As of this week the latest releases are Terraform 1.17.1 and OpenTofu 1.13.9; OpenTofu offers native state encryption. A good answer names a reason, not a team allegiance. See IaC in 2026.

Cloud, security and observability questions

31. IAM role vs IAM user? Users have long-lived credentials; roles are assumed for short-lived ones. Workloads should use roles. See AWS IAM explained.

32. Public vs private subnet? A public subnet has a route to an internet gateway; a private one reaches out through NAT or VPC endpoints. NAT data charges are the follow-up question. See AWS VPC explained.

33. Monitoring vs observability? Monitoring answers known questions with predefined metrics; observability lets you ask new ones from high-cardinality events, traces and logs. Mention Google's four golden signals: latency, traffic, errors, saturation.

34. How do you secure the software supply chain? Pin dependencies and actions by digest, generate an SBOM, sign artifacts, scan images, and aim for SLSA build provenance. See GitHub Actions security.

AI-era DevOps interview questions

35. How do you use AI assistants in your infrastructure work, and where do you not trust them? A good answer names concrete uses (drafting manifests, summarising logs, writing tests) and concrete guardrails: read-only credentials, plan review, no agent with apply rights on production. My comparison of AI Kubernetes troubleshooting tools is useful background.

36. An agent proposes kubectl delete pvc data-postgres-0 to fix a stuck pod. What do you do? Stop it. Check the reclaim policy, whether a backup exists, and why the PVC is stuck; deleting it may destroy the data. Interviewers ask this to see whether you understand blast radius, which is the whole job. (I build PandaStack, a Firecracker microVM cloud for agents, so I think about this question more than most.)

Numbers worth memorising before the interview

Fact	Value	Source
CrashLoopBackOff restart delay	10s doubling, capped at 300s, resets after 10 min	Pod lifecycle
Default pod termination grace period	30 seconds	Pod lifecycle
Deployment progressDeadlineSeconds default	600	Deployments
Default toleration for not-ready or unreachable nodes	300 seconds	Taints and tolerations
Node monitor grace period before NotReady	50s	kube-controller-manager
OOMKilled exit code	137	Assign memory resources
DORA software delivery metrics	5	dora.dev
CKA fee and duration	$445, 2 hours	Linux Foundation

FAQ

How should I prepare for a DevOps interview in 2026?

Build a small cluster, break it on purpose and fix it while talking out loud. Rehearse one CI/CD pipeline and one incident you can describe end to end. The troubleshooting scenarios guide gives you ten to practise.

Are DevOps interviews mostly Kubernetes now?

Not mostly, but Kubernetes is the most common hands-on exercise because it is easy to break in interesting ways. Expect Linux, networking and CI/CD questions alongside it, and Terraform for any role touching cloud accounts.

Do I need a certification like CKA to get hired?

No, but it helps for early-career roles and for recruiters filtering CVs. The CKA is a practical exam, so preparing for it also prepares you for live troubleshooting rounds.

What questions should I ask the interviewer?

Ask how they deploy, how often deploys fail, who is on call and how big the rota is, and what the last postmortem changed. The answers tell you more about the job than the job description.

If I were interviewing this quarter, I would spend less time memorising flags and more time narrating a debugging session, because that is what the room is grading. I would set up a kind cluster, work through the ten scenarios until I could explain each one without notes, and have one honest story about an AI tool getting something wrong and how I caught it.

Related: DevOps Roadmap 2026: Skills, Certifications and What AI Changed, How to Fix Kubernetes CrashLoopBackOff: Causes and Commands (2026) and DORA Metrics Explained (2026): The Five Metrics, Benchmarks and AI.