Interview Q&A / Docker & Kubernetes

1. What is the difference between CMD and ENTRYPOINT in a Dockerfile?

   ENTRYPOINT sets the program the container always runs, and CMD sets default arguments or a default command that is easy to override. Arguments passed to docker run replace CMD but are appended to ENTRYPOINT; changing ENTRYPOINT needs the --entrypoint flag.

   IntermediateIn-depth3 min read
2. How can you see what is making up the size of a Docker image?

   docker history lists every layer with its command and size. For file-level detail, the open-source tool dive shows what each layer adds or wastes, which helps you spot big leftovers.

   IntermediateQuick answer1 min read
3. How do you publish a container port only on localhost, not to the whole network?

   Bind the host side to the loopback address: docker run -p 127.0.0.1:8080:80. By default -p 8080:80 listens on all interfaces, so anyone on your network can reach it.

   IntermediateQuick answer1 min read
4. How do you scan Docker images for known vulnerabilities?

   Use a scanner such as Trivy, Grype or Docker Scout to compare packages in the image against CVE databases. Run it in CI, fail builds on high severity issues, and rebuild regularly on updated base images.

   IntermediateQuick answer1 min read
5. What does docker run --read-only do and how do you handle apps that need to write?

   --read-only makes the container's root filesystem unwritable, so malware cannot modify binaries or drop files. Give the app writable tmpfs or volume mounts only for the paths it truly needs, such as /tmp.

   IntermediateQuick answer1 min read
6. What does the --privileged flag do and why avoid it?

   --privileged gives the container nearly all Linux capabilities and access to all host devices, removing most isolation. A compromised privileged container can often take over the host, so use it rarely, if at all.

   IntermediateQuick answer1 min read
7. What is a tmpfs mount in Docker and when would you use it?

   A tmpfs mount stores data in the host's memory only, never on disk, and it vanishes when the container stops. It suits temporary or sensitive scratch data and fast temporary files.

   IntermediateQuick answer1 min read
8. What is the difference between alpine, slim and distroless base images?

   alpine is a tiny distro using musl libc and apk. slim variants are trimmed Debian images using glibc. distroless images contain only your app and its runtime, with no shell or package manager, giving the smallest attack surface.

   IntermediateQuick answer1 min read
9. What is the difference between an image tag and an image digest?

   A tag like 1.27 is a movable label that can be re-pointed to a different image. A digest (sha256:...) is a hash of the image contents, so it always identifies exactly one image.

   IntermediateQuick answer1 min read
10. What is the difference between the -v and --mount flags in Docker?

    Both attach storage. -v is a compact colon-separated string, while --mount uses explicit key=value pairs. --mount is clearer and errors if a bind path is missing, while -v silently creates the host folder.

    IntermediateQuick answer1 min read
11. Why does localhost inside a container not reach a database running on your laptop?

    Inside a container, localhost means the container itself, not the host. To reach a host service use host.docker.internal (Docker Desktop, or with --add-host on Linux), or put both on a Docker network and use the service name.

    IntermediateQuick answer1 min read
12. Why is running a container as root dangerous even though it is isolated?

    Root inside a container is still UID 0 on the shared host kernel. A kernel bug, a bad mount or extra capabilities can let an attacker turn that into host access. Running as non-root removes much of that risk.

    IntermediateQuick answer1 min read
13. Why should you create a user-defined bridge network instead of using the default one?

    On a user-defined bridge, containers resolve each other by name through Docker's built-in DNS, and you get better isolation. On the default bridge you must use IP addresses or legacy links.

    IntermediateQuick answer1 min read
14. Your Docker image is 1.5 GB. How would you reduce its size?

    Use a smaller base image, a multi-stage build, a .dockerignore, install only production dependencies, chain and clean package installs in one RUN, and inspect layers with docker history or dive to find the heavy ones.

    IntermediateQuick answer1 min read