Interview Q&A / Docker & Kubernetes

1. How do you mount a volume or folder as read-only in a container?

   Add :ro to the -v option, or readonly in --mount. The container can then read the files but any write attempt fails. This protects config files and source mounts from accidental changes.

   BeginnerQuick answer1 min read
2. Why should you never put passwords or API keys in a Dockerfile or image?

   Anything baked into a layer, through ENV, ARG, COPY or RUN, can be read by anyone who can pull the image, using docker history or by unpacking layers. Inject secrets at runtime instead.

   BeginnerQuick answer1 min read
3. Why should you pin the base image version in a Dockerfile?

   FROM python without a version or with latest can change between builds, so a rebuild may break or introduce new vulnerabilities. Pinning a specific tag or digest gives repeatable builds you update on purpose.

   BeginnerQuick answer1 min read
4. How do you publish a container port only on localhost, not to the whole network?

   Bind the host side to the loopback address: docker run -p 127.0.0.1:8080:80. By default -p 8080:80 listens on all interfaces, so anyone on your network can reach it.

   IntermediateQuick answer1 min read
5. How do you run a container as a non-root user using the Dockerfile USER instruction?

   Create an unprivileged user with RUN, then switch with USER before CMD. All later instructions and the running process then use that user, which limits the damage if the app is compromised.

   IntermediateQuick answer1 min read
6. How do you scan Docker images for known vulnerabilities?

   Use a scanner such as Trivy, Grype or Docker Scout to compare packages in the image against CVE databases. Run it in CI, fail builds on high severity issues, and rebuild regularly on updated base images.

   IntermediateQuick answer1 min read
7. What does docker run --read-only do and how do you handle apps that need to write?

   --read-only makes the container's root filesystem unwritable, so malware cannot modify binaries or drop files. Give the app writable tmpfs or volume mounts only for the paths it truly needs, such as /tmp.

   IntermediateQuick answer1 min read
8. What does the --privileged flag do and why avoid it?

   --privileged gives the container nearly all Linux capabilities and access to all host devices, removing most isolation. A compromised privileged container can often take over the host, so use it rarely, if at all.

   IntermediateQuick answer1 min read
9. Why is running a container as root dangerous even though it is isolated?

   Root inside a container is still UID 0 on the shared host kernel. A kernel bug, a bad mount or extra capabilities can let an attacker turn that into host access. Running as non-root removes much of that risk.

   IntermediateQuick answer1 min read