kubernetes
8 minKubernetes Requests, Limits, and Autoscaling: A Practical Capacity Model
Connect pod resource requests and limits to scheduling, throttling, eviction risk, and Horizontal Pod Autoscaler behavior.
Search the library
40 matching resultsArticles and interview answers
http
5 minReliable API Clients: Pagination, Conditional Requests, and Retry Budgets
Keep list traversal stable, validate cached representations, and bound retry work when networks fail at ambiguous points.
http
8 minHTTP range requests: resume transfers without stitching different files
Use validators, Content-Range, and 416 handling to make partial downloads coherent.
Q&A
Q&AA logged-in customer requests another customer’s invoice ID. What must the server do?
Authentication alone does not authorize every object. Scope resource access to verified identity and tenant, not client-supplied identity fields.
Read the concise answer
Authentication alone does not authorize every object. Scope resource access to verified identity and tenant, not client-supplied identity fields.
Q&A
Q&AWhy does CORS not replace CSRF protection?
A browser can send some authenticated cross-site requests even when the attacker cannot read the response.
Read the concise answer
CORS governs response readability for scripts; CSRF defenses prevent unwanted state changes using ambient credentials. Validate tokens and trusted origins independently for state-changing routes.
Q&A
Q&AWhy is one global SQLAlchemy Session unsafe in an async FastAPI service?
A Session carries mutable identity-map and transaction state and is not safe for concurrent requests.
Read the concise answer
Concurrent coroutines can interleave operations on the same Session, mixing transaction state and identity-map contents. Create a session per request or task, scope its transaction clearly, and size the connection pool across all worker processes and replicas. A global Engine/pool is different from a shared mutable Session.
Q&A
Q&AWhat can ThreadLocal break when used with a thread pool?
Pooled threads outlive requests, so forgotten thread-local values can leak data and memory across tasks.
Read the concise answer
Thread pools reuse worker threads. A ThreadLocal value can remain attached after a request ends, retaining large objects or exposing one request’s context to a later task if it is not overwritten. Clear it in a finally block or use a scoped context mechanism with well-defined propagation and cleanup.
python
8 minFastAPI Backpressure: Protecting Your Service from Unbounded Fan-Out
A practical guide to request concurrency, connection pools, timeouts, and overload behavior in async Python APIs.