4 ms·

While I'm glad this is finally addressed, this limits the usefulness of one of my favorite interview questions. Asking about Alpine in a production environment

While I'm glad this is finally addressed, this limits the usefulness of one of my favorite interview questions. Asking about Alpine in a production environment was always good way finding who has container experiences of watching C-Beams glitter in the dark to those who only just read a "10 Docker Container Tricks; #8 will blow your mind!" blog post from 2017.

InvaderFizz 3y ago
It's still going to be pretty common for at least a few years, and the now incorrect assumption that it is still broken I'm sure will persist for a decade or more among those who have been burned and thus moved on from Alpine and do not follow it. DNS is a fun rabbit hole for interviews, for sure. My favorite one to see on a resume is NIS. If you are listing NIS and don't have horror stories or other things to say about NIS, that's a really good indicator of the value of your resume. I intentionally list NIS on my resume because it is such a fun conversation topic to go on about how security models changed over time, all the ways NIS is terrible, but also how simple and useful it was.
- meroje 3y ago
  > It's still going to be pretty common for at least a few years, and the now incorrect assumption that it is still broken I'm sure will persist for a decade or more among those who have been burned and thus moved on from Alpine and do not follow it. I'm still not going back until I can configure for TCP to be the default.
- geocar 3y ago
  I still use NIS because hosts files are faster than DNS.
- ecliptik 3y ago
  NIS is a good one. I have UUCP as a skill on my resume as an easter egg but no one ever asks about it. For DNS, my favorite interview question goes like this, How would you verify DNS is resolving from within a pod on Kubernetes? After listening to the answer, add some constraints: 1. Common networking utilities like ping, nslookup, dig, etc are not available 2. Container user is unpriviledged 3. su/sudo do not work This can lead to some elaborate k8s troubleshooting or the simple, and correct, answer of getent hosts.
  - skarnet 3y ago
    Except it's... not quite correct. getent performs NSS resolution, not DNS resolution, so its output depends on the value of the hosts field in your /etc/nsswitch.conf, which could be set to something fun like LDAP or something else. I don't know Kubernetes, so it's very possible that Kubernetes enforces that name resolution is always DNS and only DNS (a "hosts: dns" line in /etc/nsswitch.conf, without any additional stuff like files which would mean resolution via /etc/hosts), in which case getent is indeed correct, but in the general case, there is no system-intrinsic tool that tests DNS only, and you have to use something like dig.
  - cmeacham98 3y ago
    After constraint 1, this devolves to a weird game of "does the interviewee realize I don't consider `getent hosts` to be a 'common networking utility' so it's still available?"
- boringuser2 3y ago
  Do you really do arbitrary trivia in interviews? Lol. This must be an IT thing because a developer would go, "ah, what is this shit? Hang on, I did this once back in 08', let me being up the documentation' and proceed to bootstrap a production-fix by EOD.
  - InvaderFizz 3y ago
    DevOps/SRE. Our technical interview is pretty regimented and cookie cutter. Over the course of one hour we cover a wide base of practical knowledge to validate the candidates existing knowledge or their ability to quickly acquire the needed knowledge (use of google/stack overflow is encouraged). As an icebreaker, I pick out items from their resume that stand out and look like strengths. My goal is to play to those strengths and get them comfortable talking about their past battles.
    - boringuser2 3y ago
      I think talking to people is more effective. 1. Most people can do the job. Even programming isn't that bad, I've met very few complete incompetents. 2. Their personality and interest in the topic are better correlates for their success in the team and generally.
vbezhenar 3y ago
I'm using alpine containers for two years on a moderately sized cluster and I've yet to encounter any issues caused by it.
- baq 3y ago
  Famous last words right here. It's usually the case that everything works until it doesn't. When it's DNS that doesn't work, good luck debugging it unless you've got war stories to tell.
yjftsjthsd-h 3y ago
> Asking about Alpine in a production environment was always good way finding who has container experiences of watching C-Beams glitter in the dark to those who only just read a "10 Docker Container Tricks; #8 will blow your mind!" blog post from 2017. I dunno, I've been running containers in prod for a while now and I don't recall Alpine being a problem. Maybe it varies by your workload?
stefan_ 3y ago
glibc also has some fun behavior that few people know about because (1) distributions have been patching it and nobody ever actually ran the upstream version and or (2) downstream software is papering it over: https://github.com/golang/go/issues/21083 https://github.com/golang/go/issues/21083

InvaderFizz 3y ago

It's still going to be pretty common for at least a few years, and the now incorrect assumption that it is still broken I'm sure will persist for a decade or more among those who have been burned and thus moved on from Alpine and do not follow it. DNS is a fun rabbit hole for interviews, for sure. My favorite one to see on a resume is NIS. If you are listing NIS and don't have horror stories or other things to say about NIS, that's a really good indicator of the value of your resume. I intentionally list NIS on my resume because it is such a fun conversation topic to go on about how security models changed over time, all the ways NIS is terrible, but also how simple and useful it was.

meroje 3y ago
> It's still going to be pretty common for at least a few years, and the now incorrect assumption that it is still broken I'm sure will persist for a decade or more among those who have been burned and thus moved on from Alpine and do not follow it. I'm still not going back until I can configure for TCP to be the default.
geocar 3y ago
I still use NIS because hosts files are faster than DNS.
ecliptik 3y ago
NIS is a good one. I have UUCP as a skill on my resume as an easter egg but no one ever asks about it. For DNS, my favorite interview question goes like this, How would you verify DNS is resolving from within a pod on Kubernetes? After listening to the answer, add some constraints: 1. Common networking utilities like ping, nslookup, dig, etc are not available 2. Container user is unpriviledged 3. su/sudo do not work This can lead to some elaborate k8s troubleshooting or the simple, and correct, answer of getent hosts.
- skarnet 3y ago
  Except it's... not quite correct. getent performs NSS resolution, not DNS resolution, so its output depends on the value of the hosts field in your /etc/nsswitch.conf, which could be set to something fun like LDAP or something else. I don't know Kubernetes, so it's very possible that Kubernetes enforces that name resolution is always DNS and only DNS (a "hosts: dns" line in /etc/nsswitch.conf, without any additional stuff like files which would mean resolution via /etc/hosts), in which case getent is indeed correct, but in the general case, there is no system-intrinsic tool that tests DNS only, and you have to use something like dig.
- cmeacham98 3y ago
  After constraint 1, this devolves to a weird game of "does the interviewee realize I don't consider `getent hosts` to be a 'common networking utility' so it's still available?"
boringuser2 3y ago
Do you really do arbitrary trivia in interviews? Lol. This must be an IT thing because a developer would go, "ah, what is this shit? Hang on, I did this once back in 08', let me being up the documentation' and proceed to bootstrap a production-fix by EOD.
- InvaderFizz 3y ago
  DevOps/SRE. Our technical interview is pretty regimented and cookie cutter. Over the course of one hour we cover a wide base of practical knowledge to validate the candidates existing knowledge or their ability to quickly acquire the needed knowledge (use of google/stack overflow is encouraged). As an icebreaker, I pick out items from their resume that stand out and look like strengths. My goal is to play to those strengths and get them comfortable talking about their past battles.
  - boringuser2 3y ago
    I think talking to people is more effective. 1. Most people can do the job. Even programming isn't that bad, I've met very few complete incompetents. 2. Their personality and interest in the topic are better correlates for their success in the team and generally.

vbezhenar 3y ago

I'm using alpine containers for two years on a moderately sized cluster and I've yet to encounter any issues caused by it.

baq 3y ago
Famous last words right here. It's usually the case that everything works until it doesn't. When it's DNS that doesn't work, good luck debugging it unless you've got war stories to tell.

yjftsjthsd-h 3y ago

> Asking about Alpine in a production environment was always good way finding who has container experiences of watching C-Beams glitter in the dark to those who only just read a "10 Docker Container Tricks; #8 will blow your mind!" blog post from 2017. I dunno, I've been running containers in prod for a while now and I don't recall Alpine being a problem. Maybe it varies by your workload?

stefan_ 3y ago

glibc also has some fun behavior that few people know about because (1) distributions have been patching it and nobody ever actually ran the upstream version and or (2) downstream software is papering it over: https://github.com/golang/go/issues/21083 https://github.com/golang/go/issues/21083