Interview Q&A / Docker & Kubernetes
Docker & Kubernetes interview questions
Images, containers, Dockerfiles, pods and deployments, from first principles.
Prefer rapid revision? Practise Docker & Kubernetes short interview answers →
- Does data in a Docker volume survive docker rm?
Yes. Removing a container does not remove its named volume. Anonymous volumes are also kept unless you use docker rm -v. Data is deleted only when you run docker volume rm or prune.
BeginnerQuick answer1 min read - Does EXPOSE in a Dockerfile make a port reachable from outside?
No. EXPOSE is only documentation of the port the app listens on. To make it reachable from the host you must publish it with -p, or -P to publish all exposed ports to random host ports.
BeginnerQuick answer1 min read - Explain the main parts of a Kubernetes Deployment YAML.
apiVersion and kind identify the object, metadata names it, spec.replicas sets the count, spec.selector says which Pods it owns, and spec.template is the Pod blueprint whose labels must match the selector.
BeginnerQuick answer1 min read - How can two Docker containers talk to each other?
Put them on the same user-defined network and call one from the other using its container or service name and the container port. Publishing a port with -p is only needed for access from the host.
BeginnerQuick answer1 min read - How do you check a container's IP address, environment variables and resource usage?
docker inspect shows full JSON details such as IP, env vars, mounts and state, and -f with a Go template pulls out one field. docker stats shows live CPU, memory and network usage.
BeginnerQuick answer1 min read - How do you find out why a Docker container exited immediately?
Run docker ps -a to see its status and exit code, then docker logs for the output. A container lives only as long as its main process, so a quick exit means the process finished or crashed.
BeginnerQuick answer1 min read - How do you mount a volume or folder as read-only in a container?
Add :ro to the -v option, or readonly in --mount. The container can then read the files but any write attempt fails. This protects config files and source mounts from accidental changes.
BeginnerQuick answer1 min read - How do you push a locally built image to a registry?
Tag the image with the registry's full name, log in with docker login, then run docker push. The tag must include the registry host and repository name, or Docker pushes to Docker Hub.
BeginnerQuick answer1 min read - How do you view and follow the logs of a running container?
Use docker logs <container>. Add -f to follow new lines, --tail N to show only the last N lines, and --since to limit by time. It shows whatever the main process wrote to stdout and stderr.
BeginnerQuick answer1 min read - What are the bridge, host and none network modes in Docker?
bridge (default) gives a container its own network and IP behind a virtual switch, host shares the host's network stack with no isolation, and none disables networking except loopback.
BeginnerQuick answer1 min read - What are the different Service types in Kubernetes?
ClusterIP exposes a Service only inside the cluster, NodePort opens a port on every node, LoadBalancer provisions a cloud load balancer, and ExternalName maps the Service to an external DNS name.
BeginnerQuick answer1 min read - What does docker run -d -p 8080:80 --name web nginx do?
It starts a container named web from the nginx image in the background (-d) and publishes container port 80 on host port 8080, so http://localhost:8080 reaches nginx.
BeginnerQuick answer1 min read - What happens when you delete a Pod that belongs to a Deployment?
The ReplicaSet notices the count is below the desired replicas and immediately creates a replacement Pod with a new name and IP. To really remove the app, delete or scale the Deployment instead.
BeginnerQuick answer1 min read - What happens when you run docker run nginx and the image is not on your machine?
Docker looks locally, does not find nginx:latest, pulls it from Docker Hub, then creates and starts the container. With no tag given it uses latest, which is just a default tag name, not a guarantee of the newest version.
BeginnerQuick answer1 min read - What is a .dockerignore file and why do you need it?
A .dockerignore lists files and folders excluded from the build context sent to the Docker daemon. It speeds up builds, keeps secrets and node_modules out of the image, and avoids needless cache invalidation.
BeginnerQuick answer1 min read - What is a container registry, and how does Docker Hub differ from a private registry?
A registry stores and serves images. Docker Hub is the public default with free public repos, while a private registry such as ECR, GCR, ACR, GHCR or a self-hosted one restricts access to your team.
BeginnerQuick answer1 min read - What is a Pod in Kubernetes and why is it not just a container?
A Pod is the smallest deployable unit in Kubernetes: one or more containers that share an IP address, ports and volumes and are always scheduled together on the same node. Most Pods hold one main container.
BeginnerQuick answer1 min read - What is a ReplicaSet and how does it relate to a Deployment?
A ReplicaSet keeps a specified number of identical Pods running, replacing any that die. A Deployment manages ReplicaSets, creating a new one for each version to enable rolling updates and rollbacks.
BeginnerQuick answer1 min read - What is an Ingress in Kubernetes and how does it differ from a LoadBalancer Service?
An Ingress defines HTTP and HTTPS routing rules by host and path, handled by an Ingress controller. One load balancer can serve many services, while a LoadBalancer Service creates one external load balancer per Service.
BeginnerQuick answer1 min read - What is the difference between a named volume and a bind mount?
A named volume is storage created and managed by Docker, stored in its own area and portable between containers. A bind mount maps an exact host folder into the container, which suits live code editing but depends on the host layout.
BeginnerQuick answer1 min read - What is the difference between docker compose stop, down and down -v?
stop halts containers but keeps them. down stops and removes containers and networks. down -v also deletes the named volumes, which destroys stored data.
BeginnerQuick answer1 min read - What is the difference between docker exec and docker attach?
docker exec starts a new process inside a running container, such as a shell. docker attach connects your terminal to the container's existing main process, so exiting it can stop the container.
BeginnerQuick answer1 min read - What is the difference between docker rm, docker rmi and docker system prune?
docker rm deletes containers, docker rmi deletes images, and docker system prune bulk-removes stopped containers, unused networks and dangling images. Add -a for all unused images, and --volumes for unused volumes.
BeginnerQuick answer1 min read - What is the difference between docker stop and docker kill?
docker stop sends SIGTERM so the app can shut down cleanly, then SIGKILL after a 10 second grace period. docker kill sends SIGKILL (or a signal you choose) straight away, with no chance to clean up.
BeginnerQuick answer1 min read - Why do Dockerfiles chain commands with && in one RUN instruction?
Each RUN creates a layer, and deleting files in a later layer does not shrink the image. Chaining install and cleanup in one RUN means the temporary files never get stored in any layer.
BeginnerQuick answer1 min read - Why is using the latest tag in production considered a bad practice?
latest is a moving target, so deployments are not reproducible. You cannot tell which version runs, rollbacks are unclear, and nodes may pull different images at different times. Use explicit version or digest tags.
BeginnerQuick answer1 min read - Why should you never put passwords or API keys in a Dockerfile or image?
Anything baked into a layer, through ENV, ARG, COPY or RUN, can be read by anyone who can pull the image, using docker history or by unpacking layers. Inject secrets at runtime instead.
BeginnerQuick answer1 min read - Why should you pin the base image version in a Dockerfile?
FROM python without a version or with latest can change between builds, so a rebuild may break or introduce new vulnerabilities. Pinning a specific tag or digest gives repeatable builds you update on purpose.
BeginnerQuick answer1 min read - Why use WORKDIR instead of RUN cd in a Dockerfile?
WORKDIR sets the working directory for all later instructions and the running container, and creates it if missing. RUN cd only affects that single RUN line, because each RUN starts a fresh shell.
BeginnerQuick answer1 min read - A Kubernetes Service is not routing traffic to your Pods. How do you debug it?
Check kubectl get endpoints for the Service. If it is empty, the Service selector does not match the Pod labels, or the Pods are not ready. Also verify targetPort matches the container port.
IntermediateQuick answer1 min read