Parse Bash script options with getopts and reject ambiguous input
Getopts consumes short options according to an optstring, sets OPTARG and OPTIND, and leaves remaining positional arguments for explicit validation.
Distinguish unset, empty, default, and required Bash variables
Colon forms of parameter expansion test both unset and null values, while non-colon forms test only unset; assignment and error operators have additional effects.
Preserve the first meaningful pipeline failure with Bash pipefail
Without pipefail a pipeline normally returns the last command status; with pipefail it returns the rightmost nonzero status and PIPESTATUS retains each component.
Read file lines in Bash without losing backslashes or the last record
IFS= read -r preserves leading whitespace and backslashes, while an additional condition handles a final line without newline.
Bound remote command runtime while distinguishing timeout from remote failure
GNU timeout sends a signal after a duration and returns a timeout-specific status; SSH and the remote child have separate connection and execution lifetimes.
Build a Bash cleanup trap that preserves the original exit status
A trap runs shell code when specified signals or EXIT occur; cleanup must capture status, avoid recursion, and handle partially initialized resources.
Debug Bash with xtrace without printing credentials
Xtrace prints expanded commands after substitutions, so secrets in variables, arguments, URLs, and generated headers can reach logs even when source code looks safe.
Check disk health with SMART and NVMe evidence, not one green label
Device health combines self-assessment, error logs, media counters, temperature, and workload symptoms; a passed summary does not erase growing errors.
Use CREATE INDEX CONCURRENTLY with a failure and cleanup plan
Concurrent index creation performs multiple table scans and waits for transactions so writes can continue, but it takes longer and can leave an invalid index after failure.
Use curl --resolve and --connect-to to test DNS and proxy boundaries
--resolve supplies an address for a host and port while retaining the URL host for TLS and HTTP; --connect-to changes the network destination without rewriting application authority.
Use dig to separate resolver, authority, and cache failures
Dig can ask the configured resolver, a chosen recursive resolver, or an authoritative server; comparing those paths identifies where answers diverge.
Docker bind mount vs volume: choose by ownership and lifecycle
Bind mounts expose a chosen host path, while named volumes are managed through Docker's storage boundary; both can hide image paths and persist data beyond one container.
Use Docker build cache in CI without sharing secrets or stale scope
BuildKit cache stores build results by graph and input digest; CI must import and export an explicit cache scope because runners are often ephemeral.
Use Docker BuildKit secrets without baking credentials into layers
BuildKit secret and SSH mounts expose credentials only to a selected build instruction, unlike ARG, ENV, or copied files that can persist in image metadata or layers.
Write a Docker Compose healthcheck that tests the real local dependency
A container healthcheck runs inside the container namespace on an interval; it should test a meaningful local contract with bounded cost and no external dependency fan-out.
Use Docker Compose profiles without creating environment drift
Profiles conditionally enable selected services while unprofiled services remain active; explicitly targeting a profiled service can also activate it.
Set Docker CPU and memory limits from measured workload behavior
Container limits map to cgroup controls; memory ceilings can invoke OOM handling while CPU quota throttles work without showing 100 percent host CPU.
Pin Docker image digests while retaining an intentional update path
A tag is a mutable name while a digest identifies immutable image content; pinning separates deployment review from later registry tag movement.
Choose a Docker logging driver with a disk and outage plan
The logging driver receives container stdout and stderr; delivery mode, rotation, metadata, and remote availability determine whether logs block, disappear, or fill disk.
Design Docker multi-stage builds with a small, inspectable runtime
Each FROM begins a stage; COPY --from moves selected artifacts into a later stage so compilers, caches, and source need not enter the runtime image.
Use docker network inspect to trace container-to-container traffic
A Docker network connects container namespaces through assigned addresses, DNS names, routes, and host-side bridge or overlay policy.
Explain a du vs df mismatch before deleting more files
Df reports filesystem block allocation while du walks visible names, so deleted-open files, mount overlays, snapshots, and reserved space can separate their totals.
Read ethtool link speed and counters without assuming cable failure
Ethtool reports negotiated link properties and driver counters, but counter names and reset behavior depend on the device and driver.
Extend an LVM logical volume only after proving every storage layer
An LVM extension adds extents to a logical volume; the filesystem is a separate layer and may require its own online or offline growth step.