Production Engineering, Linux & Observability
Take runtime ownership in POSIX and container environments. Master Linux diagnostics (lsof, ss, OOM signals), hardened multi-stage container builds, structured JSON logging, and microservice correlation IDs.
Senior Systems Studio: Production Engineering, Linux & Observability
Select any senior topic below to inspect Linux file descriptors, socket queues, and kernel OOM signals, build hardened multi-stage Docker containers with non-root appuser privileges and PID 1 signal handlers, and implement structured JSON logging with contextvar correlation ID propagation.
Linux Diagnostics, Containers & Microservice Observability
- Linux POSIX Diagnostics: Monitor file descriptors (`lsof -p
| wc -l`), socket backlogs (`ss -tlpn`), and kernel memory pressure (`journalctl -k | grep -i oom`). - Hardened Container Builds: Multi-stage Dockerfiles isolate build dependencies, drop root privileges (`USER appuser`), and run process exec forms for clean `SIGTERM` signal handling.
- Observability & Correlation: Contextvar-propagated request correlation IDs injected into JSON logs trace asynchronous user journeys across microservices.
1. POSIX Linux Runtime Diagnostics
Senior engineers inspect production runtime state directly using essential Linux CLI utilities:
# 1. Inspect File Descriptor leaks against process limits
lsof -p <PID> | wc -l
ulimit -n
# 2. Monitor socket backlogs and listening TCP queues
ss -tlpn
# 3. Audit Linux kernel OOM Killer signals
journalctl -k | grep -i oom
2. Production Multi-Stage Dockerfile Specification
Hardened containers isolate build tooling, drop root privileges, and handle signals properly:
# Stage 1: Build
FROM python:3.12-slim-bookworm AS builder
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
WORKDIR /app
COPY pyproject.toml uv.lock ./
RUN uv sync --frozen --no-install-project --no-dev
# Stage 2: Runtime
FROM python:3.12-slim-bookworm AS runtime
WORKDIR /app
RUN groupadd -r appuser && useradd -r -g appuser -d /app appuser
COPY --from=builder /app/.venv /app/.venv
ENV PATH="/app/.venv/bin:$PATH"
COPY --chown=appuser:appuser src/ /app/src/
USER appuser
EXPOSE 8000
# Exec form ensures process runs as PID 1 to receive SIGTERM cleanly
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8000"]