DevOps — Docker · Kubernetes · CI/CD Cheat Sheet

cheat sheet · devops

The DevOps
Cheat Sheet

Docker, Kubernetes, and CI/CD — the toolchain for building, shipping, and running software continuously. Automate everything; ship small, ship often.

Docker Kubernetes CI/CD DevOps

⬡

Docker: Core Concepts

Docker

Dockerfile ─build─> Image ─run─> Container
                      │ push / pull
                  Registry (Docker Hub, ECR, GHCR)

Image = immutable template (layers). Container = a running instance of an image. Registry = where images are stored and shared.

Docker CLI Essentials

Docker

docker build -t app:1.0 .
docker run -d -p 8080:80 --name web app:1.0
docker ps          # -a for stopped too
docker logs -f web
docker exec -it web sh
docker stop web && docker rm web
docker images   docker rmi app:1.0
docker system prune -a   # reclaim space

-d detached, -p host:container publishes a port, -it gives an interactive shell.

▤

Dockerfile

Docker

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]

Order layers least → most changing to maximize cache hits. ENTRYPOINT = fixed command, CMD = default args. Add a .dockerignore.

⧉

Multi-stage Build

Docker

FROM golang:1.22 AS build
WORKDIR /src
COPY . .
RUN go build -o /app

FROM gcr.io/distroless/base
COPY --from=build /app /app
ENTRYPOINT ["/app"]

Build in a fat image, ship only the artifact in a tiny one → smaller, faster, fewer CVEs. Pin tags and prefer minimal/distroless bases.

⊞

Docker Compose

Docker

services:
  web:
    build: .
    ports: ["8080:80"]
    depends_on: [db]
    environment: { DB_URL: db:5432 }
  db:
    image: postgres:16
    volumes: ["pgdata:/var/lib/postgresql/data"]
volumes: { pgdata: {} }

Define a multi-container stack in one file. docker compose up -d / down / logs -f. Services reach each other by name.

⛁

Volumes & Networks

Docker

docker volume create data
docker run -v data:/var/lib/db ...   # named
docker run -v $PWD:/app ...          # bind mount

docker network create mynet
docker run --network mynet ...

Volumes persist data beyond a container's lifetime; bind mounts map host paths (great for dev). Containers on the same network resolve each other by name.

☸

K8s: Core Objects

K8s

Pod         smallest unit — 1+ containers
ReplicaSet  keeps N identical pods alive
Deployment  manages ReplicaSets + rollouts
Service     stable virtual IP / DNS name
Ingress     HTTP(S) routing into the cluster
ConfigMap   / Secret  config & credentials
Namespace   logical partition of a cluster

You declare desired state; the control plane continuously reconciles the cluster toward it.

kubectl Essentials

K8s

kubectl get pods -A           # all namespaces
kubectl get deploy,svc -o wide
kubectl describe pod web
kubectl logs -f web -c app
kubectl exec -it web -- sh
kubectl apply -f deploy.yaml
kubectl rollout status deploy/web
kubectl rollout undo deploy/web
kubectl scale deploy/web --replicas=5

apply is declarative (idempotent) — prefer it over imperative create. rollout undo is your fast rollback.

▦

Deployment YAML

K8s

apiVersion: apps/v1
kind: Deployment
metadata: { name: web }
spec:
  replicas: 3
  selector: { matchLabels: { app: web } }
  template:
    metadata: { labels: { app: web } }
    spec:
      containers:
      - name: web
        image: app:1.0
        ports: [{ containerPort: 80 }]

The selector labels must match the pod template labels — that's how a Deployment finds its pods.

⇄

Service & Ingress

K8s

ClusterIP     internal only (default)
NodePort      open a port on every node
LoadBalancer  provision a cloud LB
Ingress       host/path HTTP routing + TLS

kind: Service
spec:
  selector: { app: web }
  ports: [{ port: 80, targetPort: 8080 }]

A Service gives pods a stable address despite churn. Use one Ingress (+ controller) to expose many services over HTTP/S.

⚙

Config & Secrets

K8s

kubectl create configmap app-cfg \
  --from-literal=ENV=prod
kubectl create secret generic db \
  --from-literal=pass=s3cr3t

envFrom:
- configMapRef: { name: app-cfg }
- secretRef:    { name: db }

Secrets are only base64, not encrypted at rest by default — enable encryption or use an external store (Vault, Sealed Secrets, CSI).

♥

Probes & Resources

K8s

livenessProbe:  { httpGet: { path: /healthz, port: 8080 } }
readinessProbe: { httpGet: { path: /ready,   port: 8080 } }
resources:
  requests: { cpu: 100m, memory: 128Mi }
  limits:   { cpu: 500m, memory: 512Mi }

Liveness restarts a hung pod; readiness gates traffic until it's ready. Set requests/limits so the scheduler can place pods and noisy neighbors can't starve others.

↗

Autoscaling

K8s

kubectl autoscale deploy/web \
  --min=2 --max=10 --cpu-percent=70

HPA  scale pod count by metrics
VPA  right-size pod requests/limits
CA   add / remove cluster nodes

HPA needs the metrics-server and meaningful resources.requests to compute utilization. Combine HPA + Cluster Autoscaler for elastic capacity.

⎈

Helm

K8s

helm install web ./chart -f values.yaml
helm upgrade web ./chart --set image.tag=1.2
helm rollback web 1
helm list

# chart = templated manifests + values

Helm packages K8s manifests as versioned, parameterized charts — one template, many environments via values.yaml. Kustomize is the template-free alternative.

∞

CI · CD · CD

CI/CD

CI  Continuous Integration
    merge often ─> build ─> test on every push
CD  Continuous Delivery
    every green build is release-ready (manual go)
CD  Continuous Deployment
    every green build auto-ships to production

CI keeps main always healthy; Delivery keeps it always shippable; Deployment removes the manual gate. Adopt in that order.

▷

Pipeline Stages

CI/CD

commit ─> build ─> test ─> scan ─> package
       ─> deploy(stage) ─> e2e ─> deploy(prod)

Fail fast: cheap checks first. Build the artifact once and promote the same image across environments — never rebuild per stage. Add SAST/dependency scans before packaging.

⌥

GitHub Actions

CI/CD

name: ci
on: { push: { branches: [main] } }
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t app:${{ github.sha }} .
      - run: npm test

Workflows live in .github/workflows/*.yml, triggered by events. Same shape as GitLab CI, CircleCI, Jenkins — stages, steps, runners.

⇉

Deployment Strategies

CI/CD

Rolling     replace pods gradually (k8s default)
Blue-Green  two envs; flip traffic instantly
Canary     5% ─> watch metrics ─> ramp to 100%
Feature flag decouple deploy from release

Shipping code and exposing it to users are separate decisions. Flags + canaries let you release safely and roll back instantly.

⟲

GitOps

CI/CD

git push manifest ─> [ Git ] ─> [ ArgoCD/Flux ] ─> cluster

Git = single source of truth (desired state)
agent continuously reconciles actual → desired

Declarative, auditable, and self-healing — the cluster matches Git, and rollback is just git revert. No kubectl apply from laptops.

{}

Infrastructure as Code

DevOps

# Terraform — declarative, version-controlled
terraform init && terraform plan
terraform apply        terraform destroy

resource "aws_s3_bucket" "b" {
  bucket = "my-bucket"
}

Provision infra from code reviewed like any other. Keep state remote and locked (S3 + DynamoDB). Terraform/OpenTofu for provisioning, Ansible for config management.

◇

DevOps Culture — CALMS

DevOps

Culture      shared ownership · blameless postmortems
Automation   build, test, deploy, infra
Lean         small batches · fast feedback
Measurement  decisions driven by data
Sharing      knowledge & tooling across teams

DevOps is a culture, not a tool or a job title — break the wall between dev and ops so one team owns build → run.

📈

DORA Metrics

DevOps

Deployment Frequency   how often you ship
Lead Time for Changes  commit ─> production
Change Failure Rate    % of deploys causing issues
MTTR                   time to restore service

The four keys that separate elite from low performers. Speed (first two) and stability (last two) rise together — they're not a trade-off.

◎

Observability

DevOps

Logs     structured (JSON) + correlation IDs
Metrics  RED / USE · Prometheus + Grafana
Traces   spans across services · OpenTelemetry
Alerts   on SLO symptoms, not raw noise

Monitoring tells you that it broke; observability lets you ask why without shipping new code. Alert on user-facing symptoms tied to SLOs.

Satyam Kumar Das Founder & Solutions Architect · AppScale LLP

satyam@appscale.in
linkedin.com/in/satyamkumar