Interview Q&A / Docker & Kubernetes

1. What is Docker Compose and when would you use it?

   Docker Compose lets you define a multi-container app, such as a web server, database and cache, in one YAML file and start or stop all of it with one command. It sets up a shared network so services reach each other by name, and it is mainly used for local development, testing and small single-server deployments.

   BeginnerIn-depth3 min read
2. What is the difference between a container and a virtual machine?

   A virtual machine runs a full guest operating system on virtual hardware provided by a hypervisor. A container is just an isolated process that shares the host's kernel, so it starts in seconds or less, uses far less memory, and is lighter to ship, but gives weaker isolation than a VM.

   BeginnerIn-depth4 min read
3. What is the difference between a Docker image and a container?

   An image is a read-only template that holds your app, its dependencies and a startup command. A container is a running (or stopped) instance of that image, with its own thin writable layer on top. One image can start many containers.

   BeginnerIn-depth3 min read
4. Why is data in a container temporary, and what are Docker volumes and bind mounts?

   Files a container writes go into its own writable layer, which is deleted when the container is removed. To keep data, you mount storage from outside the container. A volume is storage managed by Docker; a bind mount maps a specific folder from the host into the container.

   BeginnerIn-depth3 min read
5. What is the difference between CMD and ENTRYPOINT in a Dockerfile?

   ENTRYPOINT sets the program the container always runs, and CMD sets default arguments or a default command that is easy to override. Arguments passed to docker run replace CMD but are appended to ENTRYPOINT; changing ENTRYPOINT needs the --entrypoint flag.

   IntermediateIn-depth3 min read
6. Does data in a Docker volume survive docker rm?

   Yes. Removing a container does not remove its named volume. Anonymous volumes are also kept unless you use docker rm -v. Data is deleted only when you run docker volume rm or prune.

   BeginnerQuick answer1 min read
7. How can two Docker containers talk to each other?

   Put them on the same user-defined network and call one from the other using its container or service name and the container port. Publishing a port with -p is only needed for access from the host.

   BeginnerQuick answer1 min read
8. How do you check a container's IP address, environment variables and resource usage?

   docker inspect shows full JSON details such as IP, env vars, mounts and state, and -f with a Go template pulls out one field. docker stats shows live CPU, memory and network usage.

   BeginnerQuick answer1 min read
9. How do you find out why a Docker container exited immediately?

   Run docker ps -a to see its status and exit code, then docker logs for the output. A container lives only as long as its main process, so a quick exit means the process finished or crashed.

   BeginnerQuick answer1 min read
10. How do you mount a volume or folder as read-only in a container?

    Add :ro to the -v option, or readonly in --mount. The container can then read the files but any write attempt fails. This protects config files and source mounts from accidental changes.

    BeginnerQuick answer1 min read
11. How do you push a locally built image to a registry?

    Tag the image with the registry's full name, log in with docker login, then run docker push. The tag must include the registry host and repository name, or Docker pushes to Docker Hub.

    BeginnerQuick answer1 min read
12. How do you view and follow the logs of a running container?

    Use docker logs <container>. Add -f to follow new lines, --tail N to show only the last N lines, and --since to limit by time. It shows whatever the main process wrote to stdout and stderr.

    BeginnerQuick answer1 min read
13. What are the bridge, host and none network modes in Docker?

    bridge (default) gives a container its own network and IP behind a virtual switch, host shares the host's network stack with no isolation, and none disables networking except loopback.

    BeginnerQuick answer1 min read
14. What does docker run -d -p 8080:80 --name web nginx do?

    It starts a container named web from the nginx image in the background (-d) and publishes container port 80 on host port 8080, so http://localhost:8080 reaches nginx.

    BeginnerQuick answer1 min read
15. What happens when you run docker run nginx and the image is not on your machine?

    Docker looks locally, does not find nginx:latest, pulls it from Docker Hub, then creates and starts the container. With no tag given it uses latest, which is just a default tag name, not a guarantee of the newest version.

    BeginnerQuick answer1 min read
16. What is a container registry, and how does Docker Hub differ from a private registry?

    A registry stores and serves images. Docker Hub is the public default with free public repos, while a private registry such as ECR, GCR, ACR, GHCR or a self-hosted one restricts access to your team.

    BeginnerQuick answer1 min read
17. What is the difference between a named volume and a bind mount?

    A named volume is storage created and managed by Docker, stored in its own area and portable between containers. A bind mount maps an exact host folder into the container, which suits live code editing but depends on the host layout.

    BeginnerQuick answer1 min read
18. What is the difference between docker exec and docker attach?

    docker exec starts a new process inside a running container, such as a shell. docker attach connects your terminal to the container's existing main process, so exiting it can stop the container.

    BeginnerQuick answer1 min read
19. What is the difference between docker rm, docker rmi and docker system prune?

    docker rm deletes containers, docker rmi deletes images, and docker system prune bulk-removes stopped containers, unused networks and dangling images. Add -a for all unused images, and --volumes for unused volumes.

    BeginnerQuick answer1 min read
20. What is the difference between docker stop and docker kill?

    docker stop sends SIGTERM so the app can shut down cleanly, then SIGKILL after a 10 second grace period. docker kill sends SIGKILL (or a signal you choose) straight away, with no chance to clean up.

    BeginnerQuick answer1 min read
21. Why is using the latest tag in production considered a bad practice?

    latest is a moving target, so deployments are not reproducible. You cannot tell which version runs, rollbacks are unclear, and nodes may pull different images at different times. Use explicit version or digest tags.

    BeginnerQuick answer1 min read
22. Why should you never put passwords or API keys in a Dockerfile or image?

    Anything baked into a layer, through ENV, ARG, COPY or RUN, can be read by anyone who can pull the image, using docker history or by unpacking layers. Inject secrets at runtime instead.

    BeginnerQuick answer1 min read
23. How can you see what is making up the size of a Docker image?

    docker history lists every layer with its command and size. For file-level detail, the open-source tool dive shows what each layer adds or wastes, which helps you spot big leftovers.

    IntermediateQuick answer1 min read
24. How do you publish a container port only on localhost, not to the whole network?

    Bind the host side to the loopback address: docker run -p 127.0.0.1:8080:80. By default -p 8080:80 listens on all interfaces, so anyone on your network can reach it.

    IntermediateQuick answer1 min read
25. How do you scan Docker images for known vulnerabilities?

    Use a scanner such as Trivy, Grype or Docker Scout to compare packages in the image against CVE databases. Run it in CI, fail builds on high severity issues, and rebuild regularly on updated base images.

    IntermediateQuick answer1 min read
26. What does docker run --read-only do and how do you handle apps that need to write?

    --read-only makes the container's root filesystem unwritable, so malware cannot modify binaries or drop files. Give the app writable tmpfs or volume mounts only for the paths it truly needs, such as /tmp.

    IntermediateQuick answer1 min read
27. What does the --privileged flag do and why avoid it?

    --privileged gives the container nearly all Linux capabilities and access to all host devices, removing most isolation. A compromised privileged container can often take over the host, so use it rarely, if at all.

    IntermediateQuick answer1 min read
28. What is a tmpfs mount in Docker and when would you use it?

    A tmpfs mount stores data in the host's memory only, never on disk, and it vanishes when the container stops. It suits temporary or sensitive scratch data and fast temporary files.

    IntermediateQuick answer1 min read
29. What is the difference between alpine, slim and distroless base images?

    alpine is a tiny distro using musl libc and apk. slim variants are trimmed Debian images using glibc. distroless images contain only your app and its runtime, with no shell or package manager, giving the smallest attack surface.

    IntermediateQuick answer1 min read
30. What is the difference between an image tag and an image digest?

    A tag like 1.27 is a movable label that can be re-pointed to a different image. A digest (sha256:...) is a hash of the image contents, so it always identifies exactly one image.

    IntermediateQuick answer1 min read