7 — Linux Kernel Isolation

Kubernetes

A book-shaped table of contents for Kubernetes: cloud-native foundations, the CKAD/CKA/CKS certification tracks, control-plane internals, platform tooling, multi-cluster architecture, and MAANG-level system design and interview prep — cross-linking the existing Prometheus, Observability, and Platform Engineering chapters instead of duplicating them.

Operating Systems for MAANG Interviews

A book-shaped table of contents for operating systems at MAANG interview depth: foundations through processes, threads, concurrency, CPU scheduling, memory management, file systems, I/O, security & isolation, Linux internals, cloud/Kubernetes/observability, advanced kernel topics, and interview preparation — cross-linking existing sre/linux-networking, kubernetes-security, and patterns/concurrency notes instead of duplicating them.

4 — AppArmor

AppArmor confines a process with path-based file, network, and capability rules rather than syscall filtering, and since Kubernetes 1.30 it is configured as a first-class securityContext field instead of only through legacy annotations.

6 — Capabilities

Linux capabilities split root's monolithic power into roughly forty discrete privileges, so dropping ALL and adding back only what's needed, like NET_BIND_SERVICE, is a far narrower grant than running the container as root.

1 — Pod Security Standards

Pod Security Standards replaced the removed PodSecurityPolicy admission controller with three built-in profiles (Privileged, Baseline, Restricted) enforced declaratively via namespace labels.

10 — Protecting the Control Plane

Because etcd stores every cluster secret unencrypted by default, encryption at rest, mutual TLS between control plane components, and tightly scoped RBAC on kube-system are the highest-leverage hardening steps, not just API server firewalling.