Chapter 70: DevOps Interview Questions by Topic and Company
70.3 Docker Interview Questions
Docker che prashna pratyek company madhe yetat. Image, container, Dockerfile - sopya bhashet uttar dya.
What you will learn in this lesson
- 35 real Docker questions with short answers
- Which companies asked them, from public interview stories
- Fresher, experienced and senior levels
- A simple way to answer: why, what, how
Why: the problem
Most apps now ship as containers. A slow 3 GB image or a container that keeps restarting is daily work, so interviewers test it.
What: how to read this lesson
Each question has a short answer in three parts.
- Why: the reason the thing exists.
- What: the plain meaning.
- How: how you use it, often with a small command.
"Asked at" names a company only when a public interview story says the question was asked there. No tag means it is a common question that many companies ask.
Companies with the most questions in this lesson: Wipro (9), Deloitte (8), Tech Mahindra (5), Infosys (3), LTIMindtree (2), TCS (1).
How: answer any question in 4 steps
- Start with the reason. One sentence.
- Give the plain meaning. No big words.
- Show one command or file.
- Add one example from your work. Then stop and wait.
Fresher questions
Q1. What is the difference between a Docker image and a container?
Why: This is the first Docker question almost everywhere.
What: An image is a read-only template (like a class). A container is a running instance of it (like an object).
How: Many containers can run from one image; each gets its own writable layer.
docker build -t app:1.0 .
docker run -d --name app1 app:1.0
Q2. What is the lifecycle of a Docker container?
Why: You must know the states to debug.
What: Created → Running → Paused → Stopped (Exited) → Removed.
How: Commands: create, start, pause, stop, kill, rm.
docker ps -a
docker stop app1 && docker rm app1
Q3. How do you persist data in Docker?
Why: Container files are lost when it is removed.
What: Use volumes (managed by Docker) or bind mounts (a host folder).
How: Use named volumes for databases.
docker volume create pgdata
docker run -d -v pgdata:/var/lib/postgresql/data postgres:16
Q4. What is Docker Compose?
Why: Real apps have many containers.
What: Compose runs a multi-container app from one YAML file.
How: Define services, networks and volumes; start with docker compose up.
services:
web:
build: .
ports: ["8080:3000"]
db:
image: postgres:16
Q5. How do you see container logs?
Why: Logs are the first debug step.
What: Docker stores each container's stdout/stderr.
How: Use docker logs with -f to follow and --tail to limit.
docker logs -f --tail 100 app1
Q6. How do you expose a container to the outside world?
Why: Users must reach the app.
What: Publish a port: host port → container port.
How: Use -p host:container.
docker run -d -p 8080:80 nginx
Q7. What is the difference between RUN and CMD?
Why: Both appear in every Dockerfile.
What: RUN executes at build time and creates a layer. CMD runs when the container starts.
How: Install packages with RUN; start the app with CMD.
RUN apt-get update && apt-get install -y curl
CMD ["nginx","-g","daemon off;"]
Q8. Write a simple Dockerfile for a Node.js app.
Why: It is a common live task.
What: A Dockerfile lists steps to build the image.
How: Copy package files first so dependency layers are cached.
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
USER node
EXPOSE 3000
CMD ["node","server.js"]
Q9. What is the difference between a virtual machine and a container?
Why: It explains why containers became popular.
What: A VM has its own full OS and kernel. Containers share the host kernel and isolate processes.
How: Containers start in seconds and are lighter; VMs give stronger isolation.
Q10. What is .dockerignore?
Why: It keeps junk and secrets out of the image.
What: It lists files not sent to the build context.
How: Ignore .git, node_modules, logs and .env.
.git
node_modules
*.log
.env
Q11. What is the difference between COPY and ADD?
Why: Simple, often asked.
What: COPY copies files. ADD also unpacks tar files and can download URLs.
How: Prefer COPY; it is clearer.
COPY . /app
Q12. How do you get a shell inside a running container?
Why: You need to look inside to debug.
What: docker exec runs a new process inside the container.
How: Use -it with sh or bash.
docker exec -it app1 sh
Q13. What is Docker Hub?
Why: It is where most public images live.
What: A public registry for images. Official images are maintained and scanned.
How: Pull official or verified images and pin a version tag.
docker pull nginx:1.27-alpine
Q14. What is the difference between docker run and docker start?
Why: Basic CLI.
What: run creates a new container from an image and starts it. start restarts an existing stopped container.
docker start app1
Q15. What is a Docker registry?
Why: Images must be shared.
What: A server that stores and serves images (Docker Hub, ECR, GHCR, Harbor).
How: Tag with the registry address before push.
docker tag app:1 123.dkr.ecr.ap-south-1.amazonaws.com/app:1
Experienced questions (2-5 years)
Q16. What is the difference between volumes and bind mounts?
Why: Choosing wrong causes data loss or permission problems.
What: Volumes live in Docker's area and are portable. Bind mounts map any host path.
How: Volumes for prod data; bind mounts for local code during development.
docker run -v $(pwd):/app node:20
Q17. What is the difference between ENTRYPOINT and CMD?
Why: It decides how your container starts.
What: ENTRYPOINT is the fixed program. CMD gives default arguments that users can override.
How: Use ENTRYPOINT for the binary and CMD for default flags. Use the JSON (exec) form.
ENTRYPOINT ["python","app.py"]
CMD ["--port","8000"]
Q18. What is a multi-stage build?
Why: Smaller and safer images.
What: You build in one stage with all tools, then copy only the result into a small final image.
How: Use FROM ... AS build, then COPY --from=build.
FROM node:20 AS build
WORKDIR /app
COPY . .
RUN npm ci && npm run build
FROM nginx:alpine
COPY --from=build /app/dist /usr/share/nginx/html
Q19. How do you reduce a Docker image size?
Why: Big images are slow to pull and have more CVEs.
What: Size comes from the base image, build tools and extra files.
How: Use slim/alpine or distroless bases, multi-stage builds, .dockerignore, join RUN lines and clear caches.
docker images app
docker history app:1.0
Q20. What are Docker network types?
Why: Containers must talk to each other.
What: bridge (default, single host), host (shares host network), none, overlay (many hosts, Swarm), macvlan.
How: Put related containers on one user-defined bridge so they reach each other by name.
docker network create appnet
docker run --network appnet --name db postgres
Q21. What is an overlay network?
Why: Multi-host container traffic needs it.
What: An overlay network connects containers on different hosts as if they were on one network.
How: Used by Docker Swarm; Kubernetes uses CNI plugins instead.
docker network create -d overlay mynet
Q22. How do you scan Docker images for vulnerabilities?
Why: Old packages in images get attacked.
What: Scanners compare packages in the image to CVE lists.
How: Use Trivy, Grype or Docker Scout in the pipeline; fail on HIGH/CRITICAL.
trivy image --severity HIGH,CRITICAL --exit-code 1 app:1.0
Q23. A container was killed with OOMKilled. What do you do?
Why: Memory limits protect the host.
What: The container used more memory than its limit.
How: 1) docker inspect for OOMKilled. 2) Check memory use with docker stats. 3) Fix leak or raise the limit. 4) Tune app heap (e.g. Java -Xmx).
docker inspect -f '{{.State.OOMKilled}}' app1
docker stats --no-stream
Q24. How do you cache Docker layers to speed up CI builds?
Why: Slow builds slow every developer.
What: Docker reuses a layer if its instruction and inputs did not change.
How: Put rarely-changing steps first; use BuildKit cache (--cache-from or cache mounts) in CI.
docker buildx build --cache-from type=registry,ref=repo/app:cache --cache-to type=registry,ref=repo/app:cache,mode=max -t repo/app:1 .
Q25. How do you write a secure Dockerfile?
Why: Containers often run with too much power.
What: Security means small base, no secrets, non-root user, pinned versions.
How: Use multi-stage, USER non-root, no secrets in ENV/ARG, read-only filesystem at run time, scan the image.
RUN adduser -D appuser
USER appuser
Q26. How do you pass environment variables at build time vs run time?
Why: Wrong use leaks secrets or breaks builds.
What: ARG is for build time only. ENV is set in the image and at run time. -e sets run-time vars.
How: Never put secrets in ARG or ENV; use BuildKit secrets or a secret store.
docker build --build-arg VERSION=1.2 .
docker run -e APP_ENV=prod app
Q27. Which container registry would you choose and why?
Why: Images need a safe home.
What: Options: Docker Hub, Amazon ECR, GitHub Container Registry, Azure ACR, Harbor.
How: Choose based on cloud (ECR with EKS), private access, scanning and cost.
aws ecr get-login-password | docker login --username AWS --password-stdin <acct>.dkr.ecr.ap-south-1.amazonaws.com
Q28. What Linux features make containers possible?
Why: Deeper Docker understanding.
What: Namespaces isolate what a process sees (PID, net, mount). cgroups limit what it uses (CPU, memory). Union file systems (overlayfs) give layers.
How: Mention these three in one line each.
Q29. A container keeps restarting. How do you debug it?
Why: Restart loops are common.
What: The main process exits, so Docker restarts it.
How: 1) docker ps -a for exit code. 2) docker logs. 3) docker inspect. 4) Run the image with a shell to test. 5) Fix command, env or config.
docker logs app1
docker run -it --entrypoint sh app:1.0
Q30. What is the difference between docker stop and docker kill?
Why: Graceful stop protects data.
What: stop sends SIGTERM then SIGKILL after a timeout. kill sends SIGKILL right away.
How: Use stop; make your app handle SIGTERM.
docker stop -t 30 app1
Q31. What is a dangling image and how do you clean up Docker disk space?
Why: Docker can fill the disk on CI agents.
What: Dangling images have no tag. Old containers, volumes and build cache also use space.
How: Use docker system df to see, and prune to clean.
docker system df
docker system prune -f
docker builder prune -f
Q32. What is a container HEALTHCHECK?
Why: Running does not mean healthy.
What: HEALTHCHECK runs a command to mark the container healthy or unhealthy.
How: Compose can wait for healthy services.
HEALTHCHECK --interval=30s CMD curl -f http://localhost:3000/health || exit 1
Q33. How do you limit CPU and memory for a container?
Why: One container should not starve others.
What: Docker uses cgroups for limits.
How: Use --memory and --cpus.
docker run -d --memory 512m --cpus 1 app:1.0
Q34. A container cannot reach the database. How do you check?
Why: Very common in microservices.
What: The problem is DNS, network, port, firewall or credentials.
How: 1) Same network? 2) nslookup the DB name inside. 3) nc -zv db 5432. 4) Check DB listens on 0.0.0.0. 5) Check credentials.
docker exec app1 nc -zv db 5432
Q35. DNS resolution fails inside a container. What do you check?
Why: Name failures break every call.
What: Containers use Docker's DNS (127.0.0.11) on user networks or copy the host resolv.conf.
How: Check /etc/resolv.conf inside, test with nslookup, try --dns, check host DNS and firewall.
docker exec app1 cat /etc/resolv.conf
docker run --dns 8.8.8.8 busybox nslookup google.com
Practice tasks
Easy What is the difference between a Docker image and a container?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is the lifecycle of a Docker container?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy How do you persist data in Docker?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What is the difference between volumes and bind mounts?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy What is Docker Compose?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy How do you see container logs?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Easy How do you expose a container to the outside world?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Medium What is the difference between ENTRYPOINT and CMD?
Why: Saying it once with your own words makes it stick.
What to do: Answer this question as if the interviewer just asked it.
- Open a lab VM or container, never production.
- Run or write the example from the answer.
- Read the output line by line.
- Say the answer aloud in under 60 seconds.
Check: Your answer has a reason, a plain meaning and one command.
Homework: try at home
- Pick five questions you find hard.
- Write your own answer for each in three lines.
- Record yourself answering them. Listen once and improve.
Recap
In short
- Answer in order: why, what, how, then one example.
- Show one small command when you can.
- "Asked at" comes from public interview stories.
- Practise aloud; do not memorise word for word.
FAQ
Do I need to learn all 35 questions?
No. Start with the fresher ones. Then add the experienced ones for your level.
Should I memorise these answers?
No. Understand the why, then say it in your own words. Interviewers notice memorised lines.
What if I do not know an answer?
Say so honestly. Then explain how you would find out, step by step.
Are these questions only for one company?
No. "Asked at" shows where people said it was asked. Other companies ask the same things.
How long should an answer be?
About 30 to 60 seconds. Give a reason, a plain meaning and one example.
Is a lab really needed?
Yes. Running the command once makes your answer real and confident.
Interview questions
Practise these five first. Many companies asked them.
- What is a multi-stage build? - You build in one stage with all tools, then copy only the result into a small final image.
- How do you reduce a Docker image size? - Size comes from the base image, build tools and extra files.
- How do you scan Docker images for vulnerabilities? - Scanners compare packages in the image to CVE lists.
- What is the difference between a Docker image and a container? - An image is a read-only template (like a class).
- What is the difference between volumes and bind mounts? - Volumes live in Docker's area and are portable.
Quick quiz
Q1. What is the difference between a Docker image and a container?
An image is a read-only template (like a class).
Q2. What is the difference between RUN and CMD?
RUN executes at build time and creates a layer.
Q3. How do you cache Docker layers to speed up CI builds?
Docker reuses a layer if its instruction and inputs did not change.
Q4. What is the difference between COPY and ADD?
COPY copies files.
Q5. DNS resolution fails inside a container. What do you check?
Containers use Docker's DNS (127.0.0.11) on user networks or copy the host resolv.conf.
Samajla ka?
Revision card
Interview card