Docker Interview Questions

1. What is Docker and how does containerization differ from virtual machines?

2. What is a Docker image and how does it differ from a container?

3. What is a Dockerfile and what are its most important instructions?

4. How do Docker image layers and the build cache work?

5. What is the difference between the CMD and ENTRYPOINT instructions in a Dockerfile?

6. What is the difference between COPY and ADD in a Dockerfile?

7. What are Docker volumes and how do they differ from bind mounts?

8. How does Docker networking work and what are the built-in network drivers?

9. What is a multi-stage build and why does it matter for image size?

10. What is the difference between docker run, docker start, and docker exec?

11. How do you reduce Docker image size and why does it matter?

12. What is Docker Compose and when should you use it?

13. What is the difference between EXPOSE and publishing a port with -p?

14. How does the Docker layer cache get invalidated and how do you order instructions to exploit it?

15. What are Docker image tags and why is relying on latest a bad practice?

16. What is the difference between a container's writable layer and a persistent volume?

17. How do environment variables and ARG differ in a Dockerfile?

18. What is a Docker registry and how do push and pull work?

19. How do you run a container as a non-root user and why does it matter for security?

20. What is the difference between stopping and killing a container?

21. What are health checks in Docker and how do they work?

22. How does Docker handle logging and how do you view container logs?

23. What is the difference between docker system prune and removing images manually?

24. How do you pass secrets to a container securely?

25. What is the role of the .dockerignore file?

26. How do resource limits (memory and CPU) work for Docker containers?

27. What is the difference between an image digest and a tag?

28. How does container restart policy work in Docker?

29. What is the difference between Docker Compose and Docker Swarm?

30. How do you debug a container that exits immediately on start?

31. What Is a Docker Container?

32. What Is a Docker Network?

33. What Is a Docker Registry?

34. What Is a Docker Image Layer?

35. What Is a Docker ENTRYPOINT?

36. What Does Docker Exec Do?

37. What Is Port Mapping in Docker?

38. What Does Docker Prune Do?

39. How do BuildKit cache mounts change the way you write a Dockerfile for a large dependency tree?

40. Why does the process running as PID 1 inside a container behave differently, and how do you handle zombie reaping?

41. How does the overlay2 storage driver work, and what performance problems does copy-up cause?

42. How would you design a defensive image scanning and patching workflow for containers in production?

43. How do you build and publish a multi-architecture image, and what goes wrong when you do not?

44. A production container keeps dying with exit code 137. How do you diagnose and fix it?

45. Why is depends_on not enough for service startup ordering, and what do you do instead?

46. Two containers cannot talk to each other. How do you debug Docker DNS and network connectivity systematically?

47. What is rootless Docker, how does user-namespace remapping differ, and when would you use each?

48. How do you make container builds reproducible and verifiable enough to trust in a release pipeline?

49. How can a container's logging driver stall the application, and how do you configure logging for production?

50. How do you run Docker builds inside CI safely — docker-in-docker, socket mounting, or something else?

51. You switched a service to an Alpine base image to cut size and it now fails at runtime. What went wrong?

52. How do Linux capabilities work in Docker, and why is --privileged almost always the wrong fix?

53. A bind-mounted directory gives 'permission denied' inside the container but looks fine on the host. Why?

54. When would you use --network host, none, or container:<name> instead of the default bridge?

55. How do you use multi-stage build targets to produce dev, test and production images from one Dockerfile?

56. Your container is marked unhealthy but Docker never restarts it. Why, and how do health checks and restart policies actually interact?

57. Latency spikes but CPU usage looks low. How does cgroup CPU throttling cause this, and why do runtimes misread their limits?

58. How do you debug a distroless or scratch container that has no shell and no diagnostic tools?

59. You added `RUN rm -rf /var/cache/*` but the image is the same size. Why, and what actually reduces it?

60. How do you run a container with a read-only root filesystem, and what do you do about the paths it still needs to write?

61. What do Docker's default seccomp and AppArmor profiles do, and when would you change them?