When a pod without memory limits experiences a memory leak, it consumes all unallocated RAM on the physical worker node. The Linux kernel OOM killer activates and begins killing other innocent pods on the node. The kubelet enters MemoryPressure state, evicting pods and redistributing the load to adjacent nodes, triggering a cascading crash across the entire cluster.

A liveness probe tells Kubernetes when a container process is deadlocked and needs a hard SIGKILL restart. If your liveness probe checks downstream database connectivity, an unexpected database blip causes Kubernetes to SIGKILL all application pods at once. When hundreds of pods restart simultaneously, their database connection pools fire all at once, creating a catastrophic thundering herd.

Deploying with image: myapp:latest breaks GitOps immutability and makes rollbacks impossible. Different worker nodes pull different layer hashes depending on when they cached the image, leading to a split-brain deployment where some pods run build A and others run build B. Always pin immutable semantic versions or Git commit SHA digests (e.g. myapp:v2.4.1@sha256:...).

By default, Docker and Kubernetes containers execute as root (UID 0). If an application vulnerability allows Remote Code Execution (RCE), an attacker has root privileges inside the container, can write executable binaries to /bin or /tmp, and can attempt container breakout exploits against the host Linux kernel. Setting runAsNonRoot: true and readOnlyRootFilesystem: true completely eliminates this threat.

When cloud providers perform automated Kubernetes control plane or node pool upgrades, the kubectl drain command evicts pods from the target node. If a deployment has 3 replicas and all 3 reside on that node without a PDB, the node drain terminates all 3 pods simultaneously before new ones can initialize, causing customer-facing 502/503 errors. A PDB with minAvailable: 2 guarantees zero downtime.