Chapter 56: Docker CI/CD with Jenkins and ECR, Deploy to Amazon ECS, Troubleshooting, Best Practices and Interview Questions

56.6 Docker interview questions with answers

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

Suppose we have a DevOps interview at Razorpay next week. Interviewers rarely ask us to recite flags. They ask why, and then they ask us to prove it. What is the difference between an image and a container? Show me. Why is your build slow? Show me the cache. Your container died with 137. What happened? A good answer has three parts: a one-line definition, a real example from work or a lab, and a trade-off or gotcha. In this lesson we practise the most common Docker questions in that shape, from fresher to senior level. For the key ones we run a small live demo so we can say: I have done this, here is the output. Read the questions aloud, answer in under a minute, then check the model answer.

What: every term in plain English

• Image — Read-only layered template: filesystem plus metadata.
• Container — A running process from an image, with a thin writable layer, namespaces and cgroups.
• Namespaces — Kernel isolation for PID, network, mount, user, UTS, IPC.
• cgroups — Kernel limits for CPU, memory and IO.
• Union filesystem — overlay2 stacks layers into one view.
• Build cache — Reuse of unchanged layers; invalidated from the first changed step.
• Volume — Docker-managed persistent storage outside the container layer.
• Bridge network — Default local network with NAT; user-defined bridges add DNS.
• OCI — Open standards for image format and runtime.

How: step by step

1. Define in one line. Short and correct.
2. Give a real example. A lab, a project, numbers.
3. Name a trade-off. Shows depth.
4. Demo when possible. Proof beats words.
5. Admit what you do not know. Then say how you would find out.

Command reference table

Example 1: Demo: image vs container, and the writable layer

Goal. Demo: image vs container, and the writable layer.

Commands

docker pull nginx:1.27
docker run -d --name c1 nginx:1.27
docker run -d --name c2 nginx:1.27
docker exec c1 sh -c 'echo hi-from-c1 > /usr/share/nginx/html/x.txt'
docker exec c2 ls /usr/share/nginx/html
docker diff c1
docker ps -s --format '{{.Names}} {{.Size}}'

What each line does

• one image, two containers — Same read-only layers shared.
• write in c1 — Goes to c1's own writable layer.
• ls in c2 — c2 does not see it.
• docker diff — Shows A (added) and C (changed) files.
• ps -s — Writable layer size per container, plus virtual size.

Green output

50x.html
index.html
C /usr/share/nginx/html
A /usr/share/nginx/html/x.txt
c1 1.09kB (virtual 192MB)
c2 1.09kB (virtual 192MB)

Expected result. Answer: an image is a read-only template; a container is a process plus a thin writable layer. Two containers share 192 MB of image and use about 1 KB each.

Example 2: Demo: containers are processes with namespaces and cgroups

Goal. Demo: containers are processes with namespaces and cgroups.

Commands

docker run -d --name lim --memory 128m --cpus 0.5 nginx:1.27
docker top lim
ps -eo pid,comm | grep nginx | head -2
docker exec lim sh -c 'echo $$; cat /proc/1/cmdline | tr "\0" " "'
docker inspect -f '{{.HostConfig.Memory}} {{.HostConfig.NanoCpus}}' lim
cat /sys/fs/cgroup/system.slice/docker-$(docker inspect -f '{{.Id}}' lim).scope/memory.max

What each line does

• docker top — The container's processes, seen from the host.
• ps on host — Same nginx processes, with host PIDs.
• PID 1 inside — PID namespace: inside, nginx is PID 1.
• Memory / NanoCpus — The limits we set.
• memory.max — The real cgroup v2 file the kernel enforces.

Green output

UID   PID    CMD
root  41231  nginx: master process nginx -g daemon off;
41231 nginx
1 nginx: master process nginx -g daemon off;
134217728 500000000
134217728

Expected result. Answer: a container is not a VM. It is a normal Linux process isolated by namespaces and limited by cgroups, sharing the host kernel.

Example 3: Demo: build cache and why order matters

Goal. Demo: build cache and why order matters.

Dockerfile

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["python", "app.py"]

Commands

echo 'requests==2.32.3' > requirements.txt
echo 'print("v1")' > app.py
docker build -t cachedemo . 2>&1 | grep -E 'CACHED|DONE' | tail -3
echo 'print("v2")' > app.py
docker build -t cachedemo . 2>&1 | grep -E 'CACHED|DONE' | tail -4

What each line does

• requirements first — Dependencies layer depends only on requirements.txt.
• change app.py — Only COPY . . and later steps rebuild.
• CACHED — pip install was reused.
• Wrong order — COPY . . first would reinstall packages on every code change.

Green output

#9 DONE 6.8s
#8 [4/5] RUN pip install --no-cache-dir -r requirements.txt CACHED
#9 [5/5] COPY . .
#9 DONE 0.1s

Expected result. Answer: each step is cached by its inputs; the first changed step and all after it rebuild. Put rarely changing steps first.

Every command, step by step (plain docker and Compose)

1. Fresher: image vs container

   docker images; docker ps
   

   What it does: Template vs running process.

   nginx 1.27 ... / c1 Up
   

2. Fresher: CMD vs ENTRYPOINT

   docker run IMAGE extra-arg
   

   What it does: CMD is replaced by args; ENTRYPOINT is kept and gets args.

   ENTRYPOINT ["curl"] + args
   

3. Mid: volume vs bind mount

   docker volume ls; docker run -v $PWD:/app ...
   

   What it does: Docker-managed vs host path.

   local pgdata
   

4. Mid: container networking

   docker network create app; docker run --network app ...
   

   What it does: User-defined bridge gives DNS by name.

   db resolves to 172.19.0.2
   

5. Mid: exit 137

   docker inspect -f '{{.State.OOMKilled}}' c
   

   What it does: SIGKILL, often OOM.

   true
   

6. Senior: secrets

   docker secret create / BuildKit --mount=type=secret
   

   What it does: Never ENV or layers.

   secret mounted at /run/secrets
   

7. Senior: supply chain

   trivy image; cosign verify
   

   What it does: Scan, SBOM, sign, verify.

   Verified OK
   

When it is red 1

Interviewer: 'Is a container a lightweight VM?'

Cause. A common trap.

Fix, step by step

1. No: containers share the host kernel; VMs have their own kernel on a hypervisor.
2. Mention the trade-off: faster and smaller, weaker isolation than a VM.

When it is red 2

Interviewer: 'Your image is 2 GB. What do you do?'

Cause. Tests practical optimisation.

Fix, step by step

1. Measure with docker history, then slim base, .dockerignore, multi-stage, clean layers.
2. Give a real number from lesson 56-4.

When it is red 3

Interviewer: 'Containers cannot reach each other by name.'

Cause. Tests networking.

Fix, step by step

1. They are on the default bridge or different networks.
2. Use a user-defined network or Compose.

Practice tasks

docker diff c1

docker diff c1

docker exec lim cat /proc/1/cmdline

cat /sys/fs/cgroup/.../memory.max

docker build -t cachedemo .

docker run curlimg -I https://example.com

docker run --memory 50m ...

cosign verify --key cosign.pub IMAGE

docker run --network app alpine nslookup db

Define, example, trade-off.

Recap

• Answer in three parts: definition, example, trade-off.
• Containers are processes with namespaces and cgroups.
• Images are read-only layers; containers add a writable layer.
• Know exit codes, networking, volumes and cache cold.
• Senior answers cover security and supply chain.
• Demos make answers believable.

FAQ

Q. How many questions should I prepare?

The 40 in this lesson and the earlier chapter quizzes cover most interviews.

Q. What if I don't know an answer?

Say so, then explain how you would find out: docs, docker inspect, a quick test.

Q. Do they ask about Kubernetes in Docker interviews?

Often yes: pods vs containers, why Kubernetes, and how images get to a cluster.

Q. Should I mention Podman?

Yes, briefly: daemonless, rootless, Docker-compatible CLI.

Q. How deep on internals?

Namespaces, cgroups, overlay2 and OCI at one-line level is enough for most roles.

Q. What about Docker Swarm?

Know what it is and when it fits; most companies use Kubernetes or ECS.

Q. How do I show hands-on experience?

Talk about one project end to end: Dockerfile, Compose, CI build and scan, registry, deploy, and one incident you fixed.

Q. Is Docker Desktop paid?

Free for personal use, education and small companies; larger companies need a paid subscription. Docker Engine on Linux stays free.

Interview questions

1. What happens when you run docker run nginx?

   Model answer: The CLI calls the daemon API; the daemon pulls the image if missing, containerd and runc create namespaces and cgroups, overlay2 mounts the layers, a network interface is attached, and nginx starts as PID 1.

2. How do you pass config to containers?

   Model answer: Environment variables for simple values, mounted config files or Swarm configs for files, and secrets for passwords, never baked into the image.

3. What is the difference between docker stop and docker kill?

   Model answer: stop sends SIGTERM, waits 10 seconds, then SIGKILL; kill sends SIGKILL at once (or the signal you choose).

4. How do you roll back a bad image?

   Model answer: Redeploy the previous immutable commit tag or digest; that is why we never overwrite tags.

5. Image vs container?

   Model answer: Image is a read-only layered template; container is a running instance with a writable layer.

6. Container vs VM?

   Model answer: Container shares the host kernel and isolates with namespaces and cgroups; a VM runs its own kernel on a hypervisor.

7. CMD vs ENTRYPOINT?

   Model answer: ENTRYPOINT is the fixed executable; CMD gives default args that docker run args replace.

8. COPY vs ADD?

   Model answer: COPY copies files; ADD also extracts local tars and fetches URLs. Prefer COPY.

9. Volume vs bind mount vs tmpfs?

   Model answer: Volume is Docker-managed, bind mount is a host path, tmpfs is memory only.

10. How do containers talk to each other?

    Model answer: On a user-defined network by container or service name using Docker's embedded DNS.

11. What is a multi-stage build?

    Model answer: Multiple FROM stages; copy only artifacts into the final small image.

12. How do you make builds faster?

    Model answer: Layer order, .dockerignore, BuildKit cache mounts, remote cache in CI.

13. How do you secure containers?

    Model answer: Non-root, read-only, drop caps, no-new-privileges, limits, scanning, signing, secrets at runtime.

14. What does exit code 137 mean?

    Model answer: SIGKILL, often the OOM killer; check OOMKilled.

15. What is Docker Compose for?

    Model answer: Defining and running multi-container apps on one host with one YAML file.

16. What is OCI?

    Model answer: Open Container Initiative: standards for image format, runtime and distribution, so images work in Docker, containerd and Podman.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview cardComparison card

मराठी cards