A service gets OOM killed every 6 hours. Restarting fixes it. How do you find the cause?
What they are really testing: Whether you treat the restart as a workaround or a solution. They also want to know you can distinguish a genuine leak from an undersized limit or a legitimate spike.
A real interview question
A service gets OOM killed every 6 hours. Restarting fixes it. How do you find the cause?
What most people say
drag me
“I would add a cron job to restart the service every 4 hours so it never hits the limit.”
It converts a visible failure into a hidden one and stops the clock on the investigation. The leak keeps growing, and the same code in a larger deployment will eventually leak faster than the restart schedule.
The follow-ups they ask next
Memory grows even at zero traffic. What does that narrow it to?
Background work: a timer, a subscription, a metrics buffer, a connection pool churning, or a cache populated by a scheduled job. Traffic-independent growth eliminates per-request retention entirely.
How does a runtime being cgroup-unaware cause this?
It reads host memory and sizes its heap for that, so a 32 GB host with a 2 GB container limit means the runtime believes it can use far more than it is allowed, and the kernel kills it before it ever runs a full collection.
What the interviewer is listening for
- Rules out undersized limits and cgroup-unaware runtimes first
- Correlates growth with traffic
- Labels the restart as a stopgap with a deadline
What sinks the answer
- Scheduled restart presented as the fix
- No heap profiling
- Assumes a leak without checking the curve
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“First rule out [a limit set too low, and a runtime sizing its heap off host memory rather than the cgroup]. Then [check the growth curve: tracking traffic means per-request retention, growing while idle means a background task or cache]. Get [heap profiles at intervals and diff them]. A restart cron is [a stopgap I would name as such, with an owner and a date].”
Keep going with troubleshooting
Junior
A developer says the build passes locally but fails in CI. How do you debug that?
Junior
A production server is failing writes. Disk is 100% full. Walk me through what you do.
Junior
At midnight everything started failing with TLS errors. What happened and what do you do?
Mid
A pod is in CrashLoopBackOff after a deploy. Walk me through your debugging, command by command.
Mid
The deploy reports success, pods are Running, but users get 502s. Where do you look?
Mid
A Kubernetes node goes NotReady and pods are stuck Terminating. What is happening and what do you do?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free