About This Role
We’re looking for a motivated Platform Engineer (Intern) to join our Z1Sandbox team. This is a great opportunity to learn on workload orchestration, secure execution, deployment automation, and fleet management across large-scale Kubernetes clusters, leveraging MicroVMs and gVisor for workload isolation and security.
What is Z1 Sandbox?
Z1Sandbox is a high-security, multi-tenant Sandbox execution platform. This is a great opportunity to learn on workload orchestration, secure execution, deployment automation, and fleet management across large-scale Kubernetes clusters, leveraging MicroVMs and gVisor for workload isolation and security.
What You Will Work On (Responsibilities)
As a Platform Engineering Intern, you will work hands-on with real distributed systems and live Kubernetes clusters. You will:
- Kubernetes Multi-Cluster Automation:
- Assist in modernizing platform scripts into 100% declarative Kubernetes controllers, Custom Resources, and Helm templates.
- Maintain and test Open Cluster Management (OCM) hub-to-spoke workload distribution (ManifestWork, ManagedCluster lifecycle, taints, and placement rules).
- Database Replication & Split-Brain Safe Failback:
- Monitor and validate CloudNativePG (CNPG) physical streaming replication, WAL timeline progression, and schema consistency.
- Implement declarative Kubernetes Job resources for delta synchronization across divergent cluster states.
- Gateway & Ingress Routing:
- Configure, test, and optimize our Envoy Active-Passive Proxy running on WireGuard overlay meshes (ports 80 and 6443).
- Write automated end-to-end chaos tests (killing primary control planes, simulating network partitions, and verifying sub-second failover).
- Sandboxed Workload Execution:
- Test and optimize security sandbox execution on worker spoke nodes using gVisor (runsc), Kata Container and Kubernetes Resource Pools.
- Observability & Operational Tooling:
- Build Grafana dashboards and Prometheus metrics for replication lag, proxy latency, and cluster failover triggers.
- Maintain clear architectural runbooks and automated validation scripts.
Technology Stack You Will Use
- Orchestration: Kubernetes, KinD, Open Cluster Management (OCM), Helm 3
- Networking & Ingress: Envoy Proxy, Gateway API, WireGuard mesh, MetalLB
- Data & Caching: PostgreSQL (CloudNativePG Operator), Valkey / Redis, RabbitMQ
- Workload Security: gVisor runtime (runsc), Containerd, kata container
- OS & Virtualization: Linux, Docker
- Automation & Scripting: Bash, Python, YAML, GitOps
Minimum Qualifications
- Enrolled in or recently graduated with a degree in Computer Science, Software Engineering, Information Technology, or equivalent practical experience.
- Solid foundational understanding of Linux operating systems (systemd, process management, file permissions, basic networking like IP, DNS, routing).
- Familiarity with Docker and container fundamentals (building images, volume mounts, container networking).
- Basic working knowledge of Kubernetes core concepts (Pods, Deployments, Services, ConfigMaps, Namespaces).
- Proficiency in Bash scripting and at least one programming language (Python, Go, or JavaScript/TypeScript).
- Strong debugging mindset, curiosity to understand why distributed systems fail, and a methodical approach to documentation.
Nice-to-Have (Bonus Points)
- Prior experience deploying applications with Helm.
- Hands-on exposure to database replication concepts (master-replica, WAL, failover).
- Familiarity with reverse proxies (Envoy, NGINX, or HAProxy).
- Experience working with multi-cluster Kubernetes or KVM virtual machines.
What You Will Learn & Career Growth
- True Production Distributed Systems: Move beyond toy single-node projects to production-grade multi-cluster topologies.
- Disaster Recovery & High Availability: Master how enterprise platforms survive catastrophic outages with zero data loss.
- Cloud-Native Networking: Deeply understand Layer 4/Layer 7 traffic routing, mTLS, and overlay networks.
- Mentorship & Portfolio Building: Direct mentorship with senior engineers, working on an architecture that serves as an impressive portfolio piece for top-tier DevOps/SRE roles.