56.7 Docker interview questions with answers
Story. Suppose we are preparing for an Infosys or Netflix DevOps interview. These are the Docker questions asked most often, with short, clear answers.
Steps
- Basics: image vs container, VM vs container
- Build: CMD vs ENTRYPOINT, COPY vs ADD, layers
- Run: restart, limits, networks, volumes
- Compose & orchestration
- Security & troubleshooting
# Practise answering by running these:
docker run --rm alpine echo hello # image vs container
docker history nginx:1.27 # layers
docker run --rm --memory 64m alpine free -m # limits
docker network create demo && docker network ls
docker compose config
What each line does
echo hello— A container is a running instance of an image.history— Images are stacked read-only layers.--memory— cgroups enforce limits.network create— User-defined networks give DNS by name.compose config— Validate before deploy.
When it is green.
hello
When it is red.
Common wrong answer: "Containers are lightweight VMs."
Fix. Better: containers are isolated processes sharing the host kernel, using namespaces for isolation and cgroups for limits.
Quick quiz
Q1. Image vs container?
An image is a read-only template; a container is a running instance with a writable layer.
Q2. CMD vs ENTRYPOINT?
ENTRYPOINT is the fixed program; CMD gives default arguments that docker run can replace.
Q3. COPY vs ADD?
COPY just copies; ADD also extracts local tar files and fetches URLs. Prefer COPY.
Q4. How do containers on one host talk?
On a user-defined bridge network, using service or container names through Docker's DNS.
Q5. How do you persist data?
Named volumes or bind mounts; the container layer is lost on rm.
Q6. What is a multi-stage build?
Several FROM stages; only the final stage ships, so build tools stay out.
Q7. What does exit code 137 mean?
Killed by SIGKILL, often OOM.
Q8. How do you reduce image size?
Slim/distroless base, multi-stage, .dockerignore, cleanup in the same RUN.
Q9. depends_on vs healthcheck?
depends_on with condition service_healthy waits for a healthy dependency.
Q10. Docker vs Kubernetes?
Docker builds and runs containers; Kubernetes orchestrates them across many nodes.
Q11. How do you keep secrets out of images?
BuildKit secret mounts at build, secret files at runtime, never ENV or COPY.
Q12. What are namespaces and cgroups?
Namespaces isolate what a process sees; cgroups limit what it uses.
Lab
- Create a Jenkins pipeline that builds, scans and pushes to ECR.
- Deploy the image to ECS Fargate and update it once.
- Break a container on purpose and fix it with the playbook.
- Shrink one image by at least 50%.
- Answer the interview questions aloud without notes.
Practice task
Build an end-to-end flow: commit, Jenkins build, Trivy scan, ECR push, ECS rolling deploy. Write down every command and output.
Ravindra Bagale's Tip
Interview madhe command chalvun dakhavlat tar jast impact padto. Roj ek lab kara.
In short
- Tag images with the commit and push with --password-stdin.
- ECS pulls with the execution role and injects secrets.
- Troubleshoot in order: ps, logs, inspect, exec, events.
- Shrink images with slim bases and multi-stage.
- Follow the best practices checklist for every service.
Samajla ka?
Revision card
Interview card
Comparison card