Guides

Docker Interview Questions and Answers (30, Freshers and Scenario Based)

By Ravindra Bagale, AWS & DevOps trainer · LinkedIn · Published: 16 October 2026 · Last updated: 17 October 2026

These are the Docker interview questions asked most often, from fresher basics to scenario rounds, with short answers and commands you can run to prove them. Practise on a free-tier EC2 instance or your laptop. When you can explain image → container → ports, volumes and networks and walk through a scenario like "the container exits right away", you are ready for most Docker rounds.

docker build -t orders-api:1.0 .
docker run -d --name api -p 8080:3000 orders-api:1.0
docker ps -a
docker logs api
docker exec -it api sh

The flow every answer comes back to

Basics

Q1. What is Docker?

A tool to package an app with everything it needs (runtime, libraries, config) into an image, and run it as an isolated container on any machine with a container engine.

Q2. Image vs container?

An image is a read-only template, like a class. A container is a running instance of it, like an object. docker run nginx creates a container from the nginx image.

Q3. Container vs virtual machine?

A VM has its own full OS kernel on a hypervisor. Containers share the host kernel and isolate processes with namespaces and cgroups, so they start in seconds and use less memory.

Q4. What is a Dockerfile?

A text file with build steps (FROM, COPY, RUN, CMD) that docker build turns into an image, one layer per instruction.

Q5. CMD vs ENTRYPOINT?

ENTRYPOINT is the fixed program. CMD gives default arguments that docker run image args can replace. Example: ENTRYPOINT ["python"], CMD ["app.py"].

Q6. COPY vs ADD?

COPY copies files. ADD can also unpack local tar files and download URLs. Use COPY unless you need those extras, because it is clearer.

Q7. What is a Docker volume?

Storage managed by Docker that lives outside the container's writable layer, so data survives when the container is removed. Databases like MySQL and PostgreSQL need one.

Q8. Bind mount vs volume?

A bind mount maps a host folder (-v /home/ravi/site:/usr/share/nginx/html). A named volume (-v dbdata:/var/lib/mysql) is managed by Docker. Use volumes for data, bind mounts for local development.

Networking and commands

Q9. What does -p 8080:80 mean?

Host port 8080 forwards to container port 80. Open http://server:8080 to reach nginx listening on 80 inside.

Q10. How do two containers talk to each other?

Put them on the same user-defined network (docker network create app). They reach each other by container name, for example mysql:3306.

Q11. How do you see why a container stopped?

docker ps -a for the status and exit code, then docker logs <name>, then docker inspect <name> for details such as OOMKilled.

Q12. How do you get a shell in a running container?

docker exec -it <name> sh (or bash if the image has it).

Q13. What does docker system prune do?

It removes stopped containers, unused networks, dangling images and build cache to free disk. -a also removes unused images, and --volumes removes unused volumes, which can delete data.

Building better images

Q14. What is a multi-stage build?

Using one stage with build tools (Maven, Go, npm) and copying only the result into a small runtime stage. The final image is smaller and has fewer vulnerabilities.

Q15. How do you make builds faster?

Order the Dockerfile so rarely changing steps come first: copy package files and install dependencies before copying the source, so the dependency layer is cached.

Q16. Why use .dockerignore?

To keep .git, node_modules, .env files and test data out of the build context and the image. It speeds builds and avoids leaking secrets.

Q17. Why not run containers as root?

If the app is broken into, root inside the container makes escaping to the host and changing files easier. Add a USER line with a normal user.

Q18. Why avoid the latest tag?

latest changes without warning, so two servers can run different code. Pin versions like nginx:1.27 and use the git SHA for your own images.

Scenario round

Q19. Your container exits right after it starts. What do you check?

docker ps -a for the exit code, then docker logs. Exit 0 often means the main process ran in the background and finished; exit 1 is an app error; 137 is memory.

Q20. The image is 1.5 GB. How do you shrink it?

Use a slim or Alpine base, a multi-stage build, npm ci --omit=dev or pip --no-cache-dir, clean package caches in the same RUN line, and add a .dockerignore.

Q21. A container cannot reach MySQL on localhost. Why?

Inside a container, localhost is the container itself. Use the MySQL container's name on a shared network, or the host's IP.

Q22. The disk fills up on a Docker host. What do you do?

docker system df to see what uses space, prune images and build cache, and set log rotation (max-size, max-file) for the json-file driver.

Q23. How do you pass secrets to a container safely?

Not in the Dockerfile or image. Use environment values from a secret store at runtime (AWS Secrets Manager, Kubernetes Secrets), or BuildKit --secret for build-time needs.

Q24. Docker Hub returns toomanyrequests in CI. Fix?

Log in with an account, or mirror base images to Amazon ECR (pull-through cache) or another private registry.

Q25. How do you run the same app on dev, test and prod?

One image, different config through environment variables or mounted config files. Never build a separate image per environment.

A live example you can show

This compose file runs a Node.js API with MySQL, a shared network and a volume, which covers questions 7 to 10 in one go:

services:
  api:
    image: orders-api:1.0
    ports: ["8080:3000"]
    environment:
      DB_HOST: mysql
    depends_on: [mysql]
  mysql:
    image: mysql:8.4
    environment:
      MYSQL_ROOT_PASSWORD: Lab@12345
      MYSQL_DATABASE: orders
    volumes: ["dbdata:/var/lib/mysql"]
volumes:
  dbdata:

Run docker compose up -d, then docker compose down and up again, and show the data is still there because of the volume.

Summary table