56.7 Docker interview questions, answered with commands
Friends, in a DevOps interview at an MNC, the interviewer does not want a definition you memorised. They want to see that you have actually used Docker. So the best answer is short: one sentence, then a command, then what the output proves. Today we take the twelve questions that come up again and again at companies like Accenture, Wipro, Amazon and Deloitte, and answer each one this way, with three small proofs.
मित्रांनो, MNC मधल्या DevOps interview मध्ये interviewer ला तुम्ही पाठ केलेली definition नको असते. तुम्ही खरंच Docker वापरलं आहे हे त्यांना बघायचं असतं. म्हणून सर्वात चांगलं उत्तर छोटं असतं: एक वाक्य, मग एक command, मग output काय सिद्ध करतो. आज आपण Accenture, Wipro, Amazon आणि Deloitte सारख्या companies मध्ये पुन्हा पुन्हा विचारले जाणारे बारा प्रश्न घेऊ, आणि प्रत्येकाचं उत्तर असंच, तीन छोट्या पुराव्यांसह देऊ.
दोस्तों, MNC के DevOps interview में interviewer को आपकी रटी हुई definition नहीं चाहिए. वे देखना चाहते हैं कि आपने सच में Docker इस्तेमाल किया है. इसलिए सबसे अच्छा जवाब छोटा होता है: एक वाक्य, फिर एक command, फिर output क्या साबित करता है. आज हम Accenture, Wipro, Amazon और Deloitte जैसी companies में बार बार पूछे जाने वाले बारह सवाल लेंगे, और हर एक का जवाब ऐसे ही, तीन छोटे सबूतों के साथ देंगे.
1. Start from a story
At an Accenture interview, two candidates got the same question: what is the difference between CMD and ENTRYPOINT.
The first candidate recited a paragraph from a website. The interviewer nodded and moved on.
The second candidate said: ENTRYPOINT is the fixed program, CMD is the default arguments, and arguments after the image name replace CMD. Then she wrote a three-line Dockerfile on the whiteboard and showed what docker run prints with and without extra arguments. The interviewer asked two follow-up questions and she got the offer.
Today we practise answering like the second candidate.
2. The twelve questions
Step 1: Q1. Container vs virtual machine?
Why: The most common first question.
What: A VM has its own kernel; a container shares the host kernel and isolates processes with namespaces and cgroups. So containers start in milliseconds and use far less memory.
Example 1: Same kernel
Type this:
uname -r && docker run --rm alpine uname -r
You will see:
6.1.112
6.1.112
What it means: The container reports the host kernel.
Example 2: Start time
Type this:
time docker run --rm alpine true
You will see:
real 0m0.41s
What it means: Under a second. A VM takes a minute.
Example 3: Just a process
Type this:
docker run -d --name s alpine sleep 300 >/dev/null && ps -eo pid,comm | grep -m1 sleep && docker rm -f s
You will see:
48211 sleep
s
What it means: The container is a normal process on the host.
Step 2: Q2. Image vs container?
Why: Class and object.
What: An image is a read-only template made of layers. A container is a running instance with a thin writable layer on top. One image can run many containers.
Example 4: One image
Type this:
docker image ls nginx:1.27-alpine --format '{{.ID}}'
You will see:
a5967740120f
What it means: One template.
Example 5: Many containers
Type this:
for i in 1 2 3; do docker run -d --name w$i nginx:1.27-alpine >/dev/null; done; docker ps --filter ancestor=nginx:1.27-alpine --format '{{.Names}}'
You will see:
w3
w2
w1
What it means: Three instances.
Example 6: Writable layer
Type this:
docker exec w1 touch /tmp/x && docker diff w1 && docker exec w2 ls /tmp
You will see:
A /tmp/x
(empty)
What it means: Each container has its own changes.
Step 3: Q3. CMD vs ENTRYPOINT?
Why: Program and default arguments.
What: ENTRYPOINT is the fixed executable. CMD gives default arguments. Arguments after the image name replace CMD, not ENTRYPOINT.
Example 7: Dockerfile
Type this:
FROM alpine
ENTRYPOINT ["ping","-c","1"]
CMD ["localhost"]
You will see:
(Dockerfile)
What it means: Fixed ping, default host.
Example 8: Default
Type this:
docker build -q -t pinger . >/dev/null && docker run --rm pinger | head -1
You will see:
PING localhost (127.0.0.1): 56 data bytes
What it means: Uses CMD.
Example 9: Override CMD
Type this:
docker run --rm pinger 1.1.1.1 | head -1
You will see:
PING 1.1.1.1 (1.1.1.1): 56 data bytes
What it means: Only the argument changed.
Step 4: Q4. COPY vs ADD?
Why: Prefer COPY.
What: COPY copies local files. ADD can also download URLs and unpack tar files, which is surprising, so best practice is COPY unless you need tar extraction.
Example 10: COPY
Type this:
COPY app.tar.gz /tmp/
You will see:
(file stays a tar)
What it means: Predictable.
Example 11: ADD unpacks
Type this:
ADD app.tar.gz /opt/app/
You will see:
(contents extracted)
What it means: Hidden behaviour.
Example 12: Check
Type this:
docker run --rm addtest ls /opt/app | head -2
You will see:
bin
lib
What it means: ADD extracted the archive.
Step 5: Q5. How do you reduce image size?
Why: Show numbers.
What: Slim base, .dockerignore, production dependencies only, multi-stage builds and cleaning caches in the same RUN.
Example 13: Before
Type this:
docker image ls shop-web:fat --format '{{.Size}}'
You will see:
1.12GB
What it means: Full base and dev tools.
Example 14: After
Type this:
docker image ls shop-web:ms --format '{{.Size}}'
You will see:
248MB
What it means: Multi-stage with slim base.
Example 15: Proof of layers
Type this:
docker history shop-web:ms --format '{{.Size}}' | head -3
You will see:
12MB
89MB
0B
What it means: No heavy build layers.
Step 6: Q6. How do containers talk to each other?
Why: User-defined networks and DNS.
What: On a user-defined bridge network Docker runs an internal DNS, so containers reach each other by name. The default bridge has no name resolution.
Example 16: Create
Type this:
docker network create appnet && docker run -d --name db --network appnet redis:7-alpine
You will see:
appnet
91c2...
What it means: Database on the network.
Example 17: By name
Type this:
docker run --rm --network appnet redis:7-alpine redis-cli -h db ping
You will see:
PONG
What it means: Name resolution works.
Example 18: Default bridge fails
Type this:
docker run --rm redis:7-alpine redis-cli -h db ping
You will see:
Could not connect to Redis at db:6379: Name does not resolve
What it means: No DNS on the default bridge.
Step 7: Q7. Volume vs bind mount?
Why: Docker-managed vs host path.
What: A named volume is managed by Docker and best for databases. A bind mount maps a host folder and is best for development code.
Example 19: Volume
Type this:
docker run -d --name pg -v pgdata:/var/lib/postgresql/data -e POSTGRES_PASSWORD=example-only postgres:16-alpine && docker volume ls --format '{{.Name}}' | grep pgdata
You will see:
pgdata
What it means: Docker manages the location.
Example 20: Bind mount
Type this:
docker run --rm -v "$PWD":/src alpine ls /src | head -2
You will see:
Dockerfile
src
What it means: Your folder inside the container.
Example 21: Data survives
Type this:
docker rm -f pg && docker volume inspect --format '{{.Name}}' pgdata
You will see:
pg
pgdata
What it means: Container gone, data kept.
Step 8: Q8. What does exit code 137 mean?
Why: Troubleshooting question.
What: Killed by signal 9, usually out of memory. Check OOMKilled in inspect.
Example 22: Cause it
Type this:
docker run --name hog --memory 32m alpine sh -c 'tail /dev/zero'
You will see:
(no output)
What it means: Killed by the kernel.
Example 23: Prove it
Type this:
docker inspect --format '{{.State.ExitCode}} {{.State.OOMKilled}}' hog
You will see:
137 true
What it means: OOM confirmed.
Example 24: Fix
Type this:
docker run --rm --memory 256m alpine echo fine
You will see:
fine
What it means: Higher limit, or fix the memory use.
Step 9: Q9. How do you handle secrets?
Why: Never in the image.
What: No passwords in ENV or layers. Use BuildKit secrets for build time and Docker or Swarm secrets, Kubernetes secrets or AWS Secrets Manager at run time.
Example 25: Bad
Type this:
docker history --no-trunc nobad:1 --format '{{.CreatedBy}}' | grep -i pass
You will see:
ENV DB_PASS=example-only
What it means: Anyone with the image can read it.
Example 26: Build secret
Type this:
docker build --secret id=npmrc,src=$HOME/.npmrc -t good:1 .
You will see:
=> RUN --mount=type=secret,id=npmrc ...
What it means: Used and not stored.
Example 27: Runtime file
Type this:
docker run --rm -v ./db_pass.txt:/run/secrets/db_pass:ro alpine cat /run/secrets/db_pass
You will see:
example-only
What it means: Read from a file at run time, mounted read-only.
Step 10: Q10. Restart policies?
Why: Self-healing on one host.
What: no, on-failure, always and unless-stopped. unless-stopped restarts after crashes and reboots but respects a manual stop.
Example 28: Set it
Type this:
docker run -d --name r --restart unless-stopped alpine sh -c 'sleep 2; exit 1'
You will see:
5e1a...
What it means: Will restart after each crash.
Example 29: Watch
Type this:
sleep 8 && docker inspect --format '{{.RestartCount}}' r
You will see:
3
What it means: Docker keeps restarting it.
Example 30: Remove
Type this:
docker rm -f r
You will see:
r
What it means: Clean up.
Step 11: Q11. How do you push an image to ECR from CI?
Why: Pipeline question.
What: Build with the commit tag, scan, log in with get-login-password and --password-stdin using an IAM role, then push.
Example 31: Login
Type this:
aws ecr get-login-password --region ap-south-1 | docker login --username AWS --password-stdin 123456789012.dkr.ecr.ap-south-1.amazonaws.com
You will see:
Login Succeeded
What it means: No stored keys.
Example 32: Tag with commit
Type this:
docker tag shop-api:dev 123456789012.dkr.ecr.ap-south-1.amazonaws.com/shop-api:$(git rev-parse --short=7 HEAD)
You will see:
(no output)
What it means: Traceable tag.
Example 33: Push
Type this:
docker push 123456789012.dkr.ecr.ap-south-1.amazonaws.com/shop-api:a1b2c3d
You will see:
a1b2c3d: digest: sha256:9f2c... size: 1784
What it means: Done.
Step 12: Q12. Docker Compose vs Kubernetes?
Why: When to use which.
What: Compose runs multi-container apps on one host and is great for development and small servers. Kubernetes runs across many nodes with scheduling, self-healing, scaling and rolling updates.
Example 34: Compose
Type this:
docker compose up -d && docker compose ps --format '{{.Service}}'
You will see:
web
api
db
What it means: One machine.
Example 35: Kubernetes
Type this:
kubectl get pods -o wide | awk 'NR>1{print $1, $7}'
You will see:
api-7c9-x2 node-a
api-7c9-k8 node-b
What it means: Spread across nodes.
Example 36: Convert
Type this:
kompose convert -f compose.yaml && ls *-deployment.yaml
You will see:
api-deployment.yaml
web-deployment.yaml
What it means: A start for moving to Kubernetes.
3. How to practise
Say every answer aloud in under thirty seconds. Then run the command on your laptop so you have seen the output yourself.
After each answer, add one line about where you used it: in which project, for which problem. Interviewers remember stories, not definitions.
If you do not know an answer, say what you would check and which command you would run. That is still a good answer.
4. Common mistakes in Docker interviews
Mistake one: answering with a long definition and no example. Keep the definition to one sentence and spend the rest of the time on the proof.
Mistake two: saying containers are lightweight virtual machines. They are processes that share the host kernel; say it that way and show uname -r.
Mistake three: claiming you always use the latest tag. Interviewers want to hear about pinned versions and commit tags.
Mistake four: saying you put passwords in environment variables in the Dockerfile. Talk about build secrets and runtime secrets instead.
Mistake five: freezing on a question you do not know. Say how you would find out, for example docker COMMAND --help or reading the inspect output.
Check yourself
Q1. How should you structure an interview answer?
One sentence, a command, the output, what it proves.
Q2. CMD vs ENTRYPOINT in one sentence?
ENTRYPOINT is the fixed program; CMD is default arguments that run arguments replace.
Q3. Why do containers on the default bridge not find each other by name?
Only user-defined networks have Docker's built-in DNS.
Q4. What does exit 137 mean?
Killed by signal 9, usually OOM.
Friends, for every question: one sentence, one command, the output, and where you used it. Did you understand? Let us try it once more. Ask a friend to pick five questions at random and answer each in thirty seconds with the command typed live.
मित्रांनो, प्रत्येक प्रश्नासाठी: एक वाक्य, एक command, output, आणि तुम्ही ते कुठे वापरलं. मित्राला यादृच्छिकपणे पाच प्रश्न निवडायला सांगा आणि प्रत्येकाचं उत्तर तीस सेकंदात, command live टाइप करून द्या.
दोस्तों, हर सवाल के लिए: एक वाक्य, एक command, output, और आपने उसे कहाँ इस्तेमाल किया. किसी दोस्त से कहिए कि बिना क्रम के पाँच सवाल चुने, और हर एक का जवाब तीस सेकंड में, command live टाइप करके दीजिए.
Ravindra Bagale's Tip
An interviewer forgets definitions in a minute but remembers the candidate who typed the command and showed the output.
Interviewer definitions एका मिनिटात विसरतो, पण command टाइप करून output दाखवणारा candidate लक्षात ठेवतो.
Interviewer definitions एक मिनट में भूल जाता है, पर command टाइप करके output दिखाने वाला candidate याद रखता है.
Lab: try at home
- Answer Q1 to Q4 aloud and run each proof.
- Show the default bridge DNS failure and the fix.
- Cause and prove an OOM kill.
- Show the difference between a volume and a bind mount.
- Push one image to a registry with a commit tag.
- Explain Compose vs Kubernetes with both commands.
- Record yourself answering five questions.
Recap
- Answer with a sentence, a command and its output.
- Know the basics: VM, image, container, CMD, ENTRYPOINT.
- Know runtime: networks, volumes, restart policies.
- Know troubleshooting: exit codes and inspect.
- Know delivery: CI to ECR and when to use Kubernetes.