Interview Q&A / Docker & Kubernetes

31. What is the difference between docker stop and docker kill?

    docker stop sends SIGTERM so the app can shut down cleanly, then SIGKILL after a 10 second grace period. docker kill sends SIGKILL (or a signal you choose) straight away, with no chance to clean up.

    BeginnerQuick answer1 min read
32. Why do Dockerfiles chain commands with && in one RUN instruction?

    Each RUN creates a layer, and deleting files in a later layer does not shrink the image. Chaining install and cleanup in one RUN means the temporary files never get stored in any layer.

    BeginnerQuick answer1 min read
33. Why is using the latest tag in production considered a bad practice?

    latest is a moving target, so deployments are not reproducible. You cannot tell which version runs, rollbacks are unclear, and nodes may pull different images at different times. Use explicit version or digest tags.

    BeginnerQuick answer1 min read
34. Why should you never put passwords or API keys in a Dockerfile or image?

    Anything baked into a layer, through ENV, ARG, COPY or RUN, can be read by anyone who can pull the image, using docker history or by unpacking layers. Inject secrets at runtime instead.

    BeginnerQuick answer1 min read
35. Why should you pin the base image version in a Dockerfile?

    FROM python without a version or with latest can change between builds, so a rebuild may break or introduce new vulnerabilities. Pinning a specific tag or digest gives repeatable builds you update on purpose.

    BeginnerQuick answer1 min read
36. Why use WORKDIR instead of RUN cd in a Dockerfile?

    WORKDIR sets the working directory for all later instructions and the running container, and creates it if missing. RUN cd only affects that single RUN line, because each RUN starts a fresh shell.

    BeginnerQuick answer1 min read
37. A Kubernetes Service is not routing traffic to your Pods. How do you debug it?

    Check kubectl get endpoints for the Service. If it is empty, the Service selector does not match the Pod labels, or the Pods are not ready. Also verify targetPort matches the container port.

    IntermediateQuick answer1 min read
38. Does depends_on in Docker Compose wait until the database is ready?

    By default no. depends_on only controls start order, not readiness. To wait for a healthy service, add a healthcheck and use depends_on with condition: service_healthy.

    IntermediateQuick answer1 min read
39. How can you see what is making up the size of a Docker image?

    docker history lists every layer with its command and size. For file-level detail, the open-source tool dive shows what each layer adds or wastes, which helps you spot big leftovers.

    IntermediateQuick answer1 min read
40. How do you enable HTTPS for an Ingress in Kubernetes?

    Store the certificate and key in a TLS Secret, and reference it under spec.tls in the Ingress for your host. With cert-manager, certificates from Let's Encrypt can be issued and renewed automatically.

    IntermediateQuick answer1 min read
41. How do you pass environment variables and secrets into services in Docker Compose?

    Use environment: for inline values, env_file: to load a file, and ${VAR} substitution from the shell or a .env file. Keep real secrets out of Git and prefer Compose secrets or an external secret store.

    IntermediateQuick answer1 min read
42. How do you publish a container port only on localhost, not to the whole network?

    Bind the host side to the loopback address: docker run -p 127.0.0.1:8080:80. By default -p 8080:80 listens on all interfaces, so anyone on your network can reach it.

    IntermediateQuick answer1 min read
43. How do you run a container as a non-root user using the Dockerfile USER instruction?

    Create an unprivileged user with RUN, then switch with USER before CMD. All later instructions and the running process then use that user, which limits the damage if the app is compromised.

    IntermediateQuick answer1 min read
44. How do you scan Docker images for known vulnerabilities?

    Use a scanner such as Trivy, Grype or Docker Scout to compare packages in the image against CVE databases. Run it in CI, fail builds on high severity issues, and rebuild regularly on updated base images.

    IntermediateQuick answer1 min read
45. What are init containers in Kubernetes and when would you use them?

    Init containers run one after another, to completion, before the app containers start. Use them for setup such as waiting for a database, running migrations or fetching config. If one fails, the Pod restarts it.

    IntermediateQuick answer1 min read
46. What does docker run --read-only do and how do you handle apps that need to write?

    --read-only makes the container's root filesystem unwritable, so malware cannot modify binaries or drop files. Give the app writable tmpfs or volume mounts only for the paths it truly needs, such as /tmp.

    IntermediateQuick answer1 min read
47. What does the --privileged flag do and why avoid it?

    --privileged gives the container nearly all Linux capabilities and access to all host devices, removing most isolation. A compromised privileged container can often take over the host, so use it rarely, if at all.

    IntermediateQuick answer1 min read
48. What does the HEALTHCHECK instruction do in a Dockerfile?

    HEALTHCHECK tells Docker how to test that the app inside is actually working. Docker runs the command at intervals and marks the container healthy or unhealthy, visible in docker ps. It does not restart it by itself.

    IntermediateQuick answer1 min read
49. What is a multi-stage build in Docker and why use it?

    A multi-stage build uses several FROM lines in one Dockerfile. You compile in a heavy build stage, then COPY --from only the finished output into a small final stage, so compilers and source never ship.

    IntermediateQuick answer1 min read
50. What is a sidecar container in a Kubernetes Pod?

    A sidecar is a helper container running in the same Pod as the main app, sharing its network and volumes. Common uses are log shippers, proxies such as Envoy, and config reloaders.

    IntermediateQuick answer1 min read
51. What is a tmpfs mount in Docker and when would you use it?

    A tmpfs mount stores data in the host's memory only, never on disk, and it vanishes when the container stops. It suits temporary or sensitive scratch data and fast temporary files.

    IntermediateQuick answer1 min read
52. What is docker-compose.override.yml and how is it used?

    Compose automatically merges docker-compose.override.yml on top of docker-compose.yml. Teams keep shared settings in the base file and development extras like bind mounts or debug ports in the override.

    IntermediateQuick answer1 min read
53. What is the difference between alpine, slim and distroless base images?

    alpine is a tiny distro using musl libc and apk. slim variants are trimmed Debian images using glibc. distroless images contain only your app and its runtime, with no shell or package manager, giving the smallest attack surface.

    IntermediateQuick answer1 min read
54. What is the difference between an image tag and an image digest?

    A tag like 1.27 is a movable label that can be re-pointed to a different image. A digest (sha256:...) is a hash of the image contents, so it always identifies exactly one image.

    IntermediateQuick answer1 min read
55. What is the difference between docker compose up and docker compose run?

    up creates and starts all services (or those named) as defined, with ports and dependencies. run starts a one-off container for a single service with a command you give, then exits, and does not publish ports by default.

    IntermediateQuick answer1 min read
56. What is the difference between port, targetPort and nodePort in a Service?

    port is where the Service listens inside the cluster, targetPort is the container port traffic is forwarded to, and nodePort is the port opened on each node for NodePort or LoadBalancer Services.

    IntermediateQuick answer1 min read
57. What is the difference between RollingUpdate and Recreate deployment strategies?

    RollingUpdate replaces Pods gradually so the app stays available. Recreate kills all old Pods first and then starts new ones, causing downtime but guaranteeing two versions never run together.

    IntermediateQuick answer1 min read
58. What is the difference between shell form and exec form for CMD and ENTRYPOINT?

    Exec form is a JSON array and runs the program directly as PID 1. Shell form is a plain string run through /bin/sh -c, so the shell is PID 1 and signals like SIGTERM often never reach your app.

    IntermediateQuick answer1 min read
59. What is the difference between the -v and --mount flags in Docker?

    Both attach storage. -v is a compact colon-separated string, while --mount uses explicit key=value pairs. --mount is clearer and errors if a bind path is missing, while -v silently creates the host folder.

    IntermediateQuick answer1 min read
60. Why do Node.js Dockerfiles use npm ci and copy package.json before the source code?

    Copying package.json first lets Docker cache the dependency layer, so npm only reinstalls when dependencies change. npm ci installs exactly what package-lock.json lists, giving reproducible builds.

    IntermediateQuick answer1 min read