Understand
Two things you thought were one thing
A particular kind of confusion causes a disproportionate amount of lost time: not missing knowledge, but two separate concepts collapsed into one in your head. You know what EXPOSE does, you know what -p does, and somewhere along the way they became the same idea — so now the container is running, the port is right, and nothing answers.
A general article does not fix that, because the problem is not a gap. These pages name both things, say plainly how they differ, and then show the specific error the confusion produces — which is usually what you actually arrived with.
Read as much as you need. The first line of each page is the answer; everything after it is there if you want to understand why, see it happen, or explain it to somebody else.
HTTP
- 502 Bad Gateway vs 504 Gateway TimeoutA 502 means the attempt ended — refused, or the upstream closed the connection before its response header was complete. A 504 means the attempt never ended, and the proxy stopped waiting. One is a failure; the other is a decision, and they need opposite fixes.
- 401 Unauthorized vs 403 Forbidden401 means the server does not have valid credentials from you — none were sent, or the ones sent were not accepted — and it must say how to authenticate. 403 means the server understood who you are, or does not care, and is refusing anyway; sending the same credentials again will not change the answer. Despite its name, 401 is about authentication.
SRE
- Symptom-based vs cause-based alertsA symptom alert fires when users are affected. A cause alert fires when a thing you can measure looks unusual. The second set is far larger, because each symptom has many possible causes, and a cause can look unusual while users are fine. Paging on it is a fast route to alert fatigue.
- SLO vs SLAAn SLI is what you measure. An SLO is the target you hold yourself to. An SLA is a contract with consequences if you miss it — and Google's SRE book advises promising less in it than your SLO aims for.
Docker
- EXPOSE vs -p / --publishEXPOSE is documentation.
-pis what actually makes a port reachable through your machine's own addresses, such aslocalhost, and from other machines. Neither one changes what address your application binds to inside the container. - ENTRYPOINT vs CMDENTRYPOINT is the command that always runs. CMD is the default arguments, and anything you type after the image name replaces them.
- Image vs containerAn image is a read-only template. A container is a running instance of one, with a writable layer on top that disappears when the container is removed.
- Docker volume vs bind mountA volume is storage Docker creates and manages; a bind mount is a directory you already have on the host. The difference that breaks things: mounting an empty volume over a path copies the image's existing files into it, while a bind mount — or a volume that already has data — hides whatever the image had at that path.
- Docker image tag vs digestA tag is a name the publisher can move to a different image at any time; a digest is a hash of the image's content, so it can only ever mean that one image. Deploy by tag and two pulls of the same reference can give you different code. Pin by digest and you get the same image every time — including after a security fix has been published for it.
Kubernetes
- readinessProbe vs livenessProbeReadiness controls whether traffic is sent to a pod. Liveness controls whether the container is restarted. Getting them the wrong way round is how a slow-starting application ends up in a restart loop.
- Requests vs limitsRequests are what the scheduler reserves for you. Limits are the ceiling the kernel enforces. For memory, the limit is a hard ceiling: a container the kernel cannot reclaim back under it is killed. For CPU it only slows you down.
- Ingress vs Gateway APIIngress is not deprecated. The Kubernetes documentation calls it frozen, which means it stays generally available with no plans for removal but will never gain another feature. Gateway API is its successor, and because Gateway API has no Ingress kind, moving across is a one-time conversion rather than an upgrade.
- ConfigMap vs SecretA Secret is not encrypted by default. Kubernetes stores Secrets unencrypted in etcd unless encryption at rest is turned on, and base64 is only the format the data field has to be written in. What a Secret does give you is narrower handling — it is sent only to nodes that need it and, when mounted as a volume, kept off disk there — so treat it as a label for sensitive data, not as protection by itself.
- Deployment vs StatefulSetUse a Deployment when any replica can stand in for any other, and a StatefulSet when each replica needs to keep its own name, its own storage, and its place in a start-up order. The Kubernetes documentation says that if an application needs none of those, it should not be a StatefulSet.
AWS
Terraform
Git
- Git merge vs rebaseBoth bring your branch up to date with another one. Merge adds a commit with two parents and leaves every existing commit as it was. Rebase replays your commits on top of the other branch as new commits with new IDs. That is the whole trade: a straight history in exchange for rewriting commits — harmless on work only you have, and trouble on anything others have already pulled.
- Git reset vs revertReset moves your branch back to an earlier commit, so the commits after it stop being part of the branch. Revert keeps every commit and adds a new one that undoes the changes. On commits only you have, reset is fine; on anything already pushed, revert is the one that does not rewrite history — and
reset --hardalso throws away uncommitted work: changes you never staged are gone for good.
Linux
Something failing right now rather than unclear? Start from the error. Want to check a file rather than read about it? The analyzers read a manifest or Dockerfile and tell you what is wrong with it.