面试题库

30 天从前端工程师到 Agent 工程师

D14 部署运维：compose 多 worker、心跳、健康检查、优雅停机、dev/prod 隔离；W2 复盘

• 怎么设计 dev 与 prod 的隔离，防止本地开发影响线上数据？How do you isolate dev from prod so local development cannot touch production data?

  国内高频海外高频基础#operations#security#configuration

  分析过程 · 先想清楚再作答

  1. 这题看着基础，但它筛的是「有没有踩过」。踩过的人第一句会说事故形态，没踩过的人第一句说「用不同的配置文件」。
  2. 先说事故形态：同一套代码、经常还是同一个 Redis，你在本机起一个 Worker 调试，它连的却是线上那条流，把真实用户的消息捞走执行了。**这类事故没有任何报错，两边日志都显示一切正常**——从代码角度看它确实老老实实处理了一条消息。正因为没有报错，它可能持续很久才被发现。
  3. 然后按成本分层给方案：命名空间（同一套基础设施，键名带前缀）、独立实例（各自的 Redis 与数据库）、独立环境（网络、凭证、账号全分开）。生产系统最终要走到第三层，但第一层成本最低也最容易漏，所以是重点。
  4. 第一层的关键实现细节是拿分点：前缀只能在一个函数里拼。散落到各处去拼字符串，二十个键名里漏掉一个就等于没隔离，而漏掉的那个通常是最新加、最没被测过的功能。这一点比「要加前缀」本身更能体现工程经验。
  5. 再补三件必须一起做的事：凭证分开（本机那把 key 只能连开发库，配置写错也波及不到线上）；破坏性操作要认环境（清库、重放死信、重算索引这类脚本第一行先读环境变量，生产上要求显式确认）；生产禁止降级实现（离线用的内存实现在生产上一旦因配置疏漏被走到，进程会安静起来、各自在自己内存里干活，健康检查还全是绿的，这类故障能藏好几个小时——启动时直接报错退出比事后排查便宜得多）。
  6. 可以预期的追问：为什么不干脆只用独立实例，省掉前缀这一层？答：独立实例解决的是「连错了地址」，前缀解决的是「连对了地址但走错了命名空间」——两者失效的方式不同。而且前缀几乎零成本，在共享测试环境、多人并行开发时还能顺带隔离每个人的数据。防御要分层，最便宜那层没理由不做。

  How to reason about it · think before answering

  1. This looks basic, but it screens for whether you have been burned. People who have start with the failure shape; people who have not start with use different config files.
  2. Describe the failure: same codebase, often the same Redis, and you start a worker locally to debug — except it is connected to the production stream and it claims and executes a real user's message. There is no error anywhere and both sides log business as usual, because from the code's point of view it did dutifully process one message. Precisely because nothing errors, this can run for a long time before anyone notices.
  3. Then give layered options by cost: namespacing (shared infrastructure, prefixed keys), separate instances (its own Redis and database), and separate environments (network, credentials, accounts all split). Production eventually wants the third layer, but the first is the cheapest and the easiest to get wrong, so that is where the focus belongs.
  4. The implementation detail in layer one is where the points are: the prefix may only be assembled in one function. Scatter string concatenation around the codebase, miss one key out of twenty, and you have no isolation at all — and the one you missed is usually the newest, least tested feature. This point signals real experience more than add a prefix does.
  5. Add three companions. Split credentials, so the local key can only reach the dev database and a misconfiguration cannot reach production. Make destructive operations environment-aware: scripts that truncate tables, replay dead letters or rebuild indexes read the environment variable on their first line and demand explicit confirmation in production. And forbid fallback implementations in production: if a config slip makes production take the in-memory path, processes come up quietly, each working in its own memory, with every health check green — that kind of fault hides for hours, so failing fast at startup is far cheaper than diagnosing it later.
  6. Expect: why not just use separate instances and skip prefixes? Because separate instances solve connected to the wrong address while prefixes solve connected to the right address but the wrong namespace — the two fail differently. Prefixes are also nearly free, and they incidentally isolate each developer's data in a shared test environment. Defence should be layered, and there is no reason to skip the cheapest layer.

  答题要点

  • 先说事故形态：本机 Worker 连上线上流，把真实用户消息捞走执行，且两边日志都显示正常、没有任何报错，所以能藏很久
  • 按成本分三层：命名空间（键名前缀）、独立实例（各自 Redis 与库）、独立环境（网络凭证账号全分开）
  • 前缀只能在一个函数里拼——散落各处漏掉一个键就等于没隔离，而漏掉的通常是最新加、最没测过的功能
  • 凭证分开，本机 key 只能连开发库；破坏性脚本第一行读环境变量并在生产要求显式确认
  • 生产禁止降级到内存实现：配置疏漏时进程会安静起来、健康检查全绿，故障能藏几小时，应在启动时直接报错退出
  • 独立实例防「连错地址」、前缀防「地址对了但命名空间错了」，失效方式不同，最便宜那层没理由不做

  Key points

  • Lead with the failure shape: a local worker attached to the production stream claims and runs a real user's message, with normal logs on both sides and no error, so it hides for a long time
  • Three layers by cost: namespacing (key prefixes), separate instances (own Redis and DB), separate environments (network, credentials, accounts)
  • The prefix must be assembled in exactly one function — scattered concatenation misses one key and voids the isolation, usually the newest and least tested feature
  • Split credentials so the local key only reaches dev; destructive scripts read the environment first and require explicit confirmation in production
  • Forbid the in-memory fallback in production: on a config slip processes come up quietly with green health checks and the fault hides for hours — fail fast at startup instead
  • Separate instances prevent wrong address, prefixes prevent right address wrong namespace — different failure modes, and the cheapest layer is free