Interview Q&A / Docker & Kubernetes
Docker & Kubernetes interview questions
Images, containers, Dockerfiles, pods and deployments, from first principles.
Prefer rapid revision? Practise Docker & Kubernetes short interview answers →
- A Kubernetes Service is not routing traffic to your Pods. How do you debug it?
Check kubectl get endpoints for the Service. If it is empty, the Service selector does not match the Pod labels, or the Pods are not ready. Also verify targetPort matches the container port.
IntermediateQuick answer1 min read - Does depends_on in Docker Compose wait until the database is ready?
By default no. depends_on only controls start order, not readiness. To wait for a healthy service, add a healthcheck and use depends_on with condition: service_healthy.
IntermediateQuick answer1 min read - How can you see what is making up the size of a Docker image?
docker history lists every layer with its command and size. For file-level detail, the open-source tool dive shows what each layer adds or wastes, which helps you spot big leftovers.
IntermediateQuick answer1 min read - How do you enable HTTPS for an Ingress in Kubernetes?
Store the certificate and key in a TLS Secret, and reference it under spec.tls in the Ingress for your host. With cert-manager, certificates from Let's Encrypt can be issued and renewed automatically.
IntermediateQuick answer1 min read - How do you pass environment variables and secrets into services in Docker Compose?
Use environment: for inline values, env_file: to load a file, and ${VAR} substitution from the shell or a .env file. Keep real secrets out of Git and prefer Compose secrets or an external secret store.
IntermediateQuick answer1 min read - How do you publish a container port only on localhost, not to the whole network?
Bind the host side to the loopback address: docker run -p 127.0.0.1:8080:80. By default -p 8080:80 listens on all interfaces, so anyone on your network can reach it.
IntermediateQuick answer1 min read - How do you run a container as a non-root user using the Dockerfile USER instruction?
Create an unprivileged user with RUN, then switch with USER before CMD. All later instructions and the running process then use that user, which limits the damage if the app is compromised.
IntermediateQuick answer1 min read - How do you scan Docker images for known vulnerabilities?
Use a scanner such as Trivy, Grype or Docker Scout to compare packages in the image against CVE databases. Run it in CI, fail builds on high severity issues, and rebuild regularly on updated base images.
IntermediateQuick answer1 min read - What are init containers in Kubernetes and when would you use them?
Init containers run one after another, to completion, before the app containers start. Use them for setup such as waiting for a database, running migrations or fetching config. If one fails, the Pod restarts it.
IntermediateQuick answer1 min read - What does docker run --read-only do and how do you handle apps that need to write?
--read-only makes the container's root filesystem unwritable, so malware cannot modify binaries or drop files. Give the app writable tmpfs or volume mounts only for the paths it truly needs, such as /tmp.
IntermediateQuick answer1 min read - What does the --privileged flag do and why avoid it?
--privileged gives the container nearly all Linux capabilities and access to all host devices, removing most isolation. A compromised privileged container can often take over the host, so use it rarely, if at all.
IntermediateQuick answer1 min read - What does the HEALTHCHECK instruction do in a Dockerfile?
HEALTHCHECK tells Docker how to test that the app inside is actually working. Docker runs the command at intervals and marks the container healthy or unhealthy, visible in docker ps. It does not restart it by itself.
IntermediateQuick answer1 min read - What is a multi-stage build in Docker and why use it?
A multi-stage build uses several FROM lines in one Dockerfile. You compile in a heavy build stage, then COPY --from only the finished output into a small final stage, so compilers and source never ship.
IntermediateQuick answer1 min read - What is a sidecar container in a Kubernetes Pod?
A sidecar is a helper container running in the same Pod as the main app, sharing its network and volumes. Common uses are log shippers, proxies such as Envoy, and config reloaders.
IntermediateQuick answer1 min read - What is a tmpfs mount in Docker and when would you use it?
A tmpfs mount stores data in the host's memory only, never on disk, and it vanishes when the container stops. It suits temporary or sensitive scratch data and fast temporary files.
IntermediateQuick answer1 min read - What is docker-compose.override.yml and how is it used?
Compose automatically merges docker-compose.override.yml on top of docker-compose.yml. Teams keep shared settings in the base file and development extras like bind mounts or debug ports in the override.
IntermediateQuick answer1 min read - What is the difference between alpine, slim and distroless base images?
alpine is a tiny distro using musl libc and apk. slim variants are trimmed Debian images using glibc. distroless images contain only your app and its runtime, with no shell or package manager, giving the smallest attack surface.
IntermediateQuick answer1 min read - What is the difference between an image tag and an image digest?
A tag like 1.27 is a movable label that can be re-pointed to a different image. A digest (sha256:...) is a hash of the image contents, so it always identifies exactly one image.
IntermediateQuick answer1 min read - What is the difference between docker compose up and docker compose run?
up creates and starts all services (or those named) as defined, with ports and dependencies. run starts a one-off container for a single service with a command you give, then exits, and does not publish ports by default.
IntermediateQuick answer1 min read - What is the difference between port, targetPort and nodePort in a Service?
port is where the Service listens inside the cluster, targetPort is the container port traffic is forwarded to, and nodePort is the port opened on each node for NodePort or LoadBalancer Services.
IntermediateQuick answer1 min read - What is the difference between RollingUpdate and Recreate deployment strategies?
RollingUpdate replaces Pods gradually so the app stays available. Recreate kills all old Pods first and then starts new ones, causing downtime but guaranteeing two versions never run together.
IntermediateQuick answer1 min read - What is the difference between shell form and exec form for CMD and ENTRYPOINT?
Exec form is a JSON array and runs the program directly as PID 1. Shell form is a plain string run through /bin/sh -c, so the shell is PID 1 and signals like SIGTERM often never reach your app.
IntermediateQuick answer1 min read - What is the difference between the -v and --mount flags in Docker?
Both attach storage. -v is a compact colon-separated string, while --mount uses explicit key=value pairs. --mount is clearer and errors if a bind path is missing, while -v silently creates the host folder.
IntermediateQuick answer1 min read - Why do Node.js Dockerfiles use npm ci and copy package.json before the source code?
Copying package.json first lets Docker cache the dependency layer, so npm only reinstalls when dependencies change. npm ci installs exactly what package-lock.json lists, giving reproducible builds.
IntermediateQuick answer1 min read - Why does localhost inside a container not reach a database running on your laptop?
Inside a container, localhost means the container itself, not the host. To reach a host service use host.docker.internal (Docker Desktop, or with --add-host on Linux), or put both on a Docker network and use the service name.
IntermediateQuick answer1 min read - Why is running a container as root dangerous even though it is isolated?
Root inside a container is still UID 0 on the shared host kernel. A kernel bug, a bad mount or extra capabilities can let an attacker turn that into host access. Running as non-root removes much of that risk.
IntermediateQuick answer1 min read - Why should you create a user-defined bridge network instead of using the default one?
On a user-defined bridge, containers resolve each other by name through Docker's built-in DNS, and you get better isolation. On the default bridge you must use IP addresses or legacy links.
IntermediateQuick answer1 min read - You created an Ingress but nothing works. What could be missing?
Usually no Ingress controller is installed, so no one reads the rules. Also check ingressClassName, that the backend Service and port exist, DNS pointing to the controller's address, and that Pods are ready.
IntermediateQuick answer1 min read - Your Docker image is 1.5 GB. How would you reduce its size?
Use a smaller base image, a multi-stage build, a .dockerignore, install only production dependencies, chain and clean package installs in one RUN, and inspect layers with docker history or dive to find the heavy ones.
IntermediateQuick answer1 min read