Interview Q&A / Docker & Kubernetes

1. What is the difference between CMD and ENTRYPOINT in a Dockerfile?

   ENTRYPOINT sets the program the container always runs, and CMD sets default arguments or a default command that is easy to override. Arguments passed to docker run replace CMD but are appended to ENTRYPOINT; changing ENTRYPOINT needs the --entrypoint flag.

   IntermediateIn-depth3 min read
2. How do you run a container as a non-root user using the Dockerfile USER instruction?

   Create an unprivileged user with RUN, then switch with USER before CMD. All later instructions and the running process then use that user, which limits the damage if the app is compromised.

   IntermediateQuick answer1 min read
3. What does the HEALTHCHECK instruction do in a Dockerfile?

   HEALTHCHECK tells Docker how to test that the app inside is actually working. Docker runs the command at intervals and marks the container healthy or unhealthy, visible in docker ps. It does not restart it by itself.

   IntermediateQuick answer1 min read
4. What is a multi-stage build in Docker and why use it?

   A multi-stage build uses several FROM lines in one Dockerfile. You compile in a heavy build stage, then COPY --from only the finished output into a small final stage, so compilers and source never ship.

   IntermediateQuick answer1 min read
5. What is the difference between shell form and exec form for CMD and ENTRYPOINT?

   Exec form is a JSON array and runs the program directly as PID 1. Shell form is a plain string run through /bin/sh -c, so the shell is PID 1 and signals like SIGTERM often never reach your app.

   IntermediateQuick answer1 min read
6. Why do Node.js Dockerfiles use npm ci and copy package.json before the source code?

   Copying package.json first lets Docker cache the dependency layer, so npm only reinstalls when dependencies change. npm ci installs exactly what package-lock.json lists, giving reproducible builds.

   IntermediateQuick answer1 min read