Interview Q&A / Docker & Kubernetes

1. What is the difference between CMD and ENTRYPOINT in a Dockerfile?

   ENTRYPOINT sets the program the container always runs, and CMD sets default arguments or a default command that is easy to override. Arguments passed to docker run replace CMD but are appended to ENTRYPOINT; changing ENTRYPOINT needs the --entrypoint flag.

   IntermediateIn-depth3 min read
2. Does EXPOSE in a Dockerfile make a port reachable from outside?

   No. EXPOSE is only documentation of the port the app listens on. To make it reachable from the host you must publish it with -p, or -P to publish all exposed ports to random host ports.

   BeginnerQuick answer1 min read
3. What is a .dockerignore file and why do you need it?

   A .dockerignore lists files and folders excluded from the build context sent to the Docker daemon. It speeds up builds, keeps secrets and node_modules out of the image, and avoids needless cache invalidation.

   BeginnerQuick answer1 min read
4. Why do Dockerfiles chain commands with && in one RUN instruction?

   Each RUN creates a layer, and deleting files in a later layer does not shrink the image. Chaining install and cleanup in one RUN means the temporary files never get stored in any layer.

   BeginnerQuick answer1 min read
5. Why should you pin the base image version in a Dockerfile?

   FROM python without a version or with latest can change between builds, so a rebuild may break or introduce new vulnerabilities. Pinning a specific tag or digest gives repeatable builds you update on purpose.

   BeginnerQuick answer1 min read
6. Why use WORKDIR instead of RUN cd in a Dockerfile?

   WORKDIR sets the working directory for all later instructions and the running container, and creates it if missing. RUN cd only affects that single RUN line, because each RUN starts a fresh shell.

   BeginnerQuick answer1 min read
7. How do you run a container as a non-root user using the Dockerfile USER instruction?

   Create an unprivileged user with RUN, then switch with USER before CMD. All later instructions and the running process then use that user, which limits the damage if the app is compromised.

   IntermediateQuick answer1 min read
8. What does the HEALTHCHECK instruction do in a Dockerfile?

   HEALTHCHECK tells Docker how to test that the app inside is actually working. Docker runs the command at intervals and marks the container healthy or unhealthy, visible in docker ps. It does not restart it by itself.

   IntermediateQuick answer1 min read
9. What is a multi-stage build in Docker and why use it?

   A multi-stage build uses several FROM lines in one Dockerfile. You compile in a heavy build stage, then COPY --from only the finished output into a small final stage, so compilers and source never ship.

   IntermediateQuick answer1 min read
10. What is the difference between shell form and exec form for CMD and ENTRYPOINT?

    Exec form is a JSON array and runs the program directly as PID 1. Shell form is a plain string run through /bin/sh -c, so the shell is PID 1 and signals like SIGTERM often never reach your app.

    IntermediateQuick answer1 min read
11. Why do Node.js Dockerfiles use npm ci and copy package.json before the source code?

    Copying package.json first lets Docker cache the dependency layer, so npm only reinstalls when dependencies change. npm ci installs exactly what package-lock.json lists, giving reproducible builds.

    IntermediateQuick answer1 min read