Question 1

What is the difference between a Docker image and a container?

Accepted Answer

A Docker image is an immutable template that contains the application code, runtime, dependencies, and metadata required to run something. A container is a running instance of that image with its own process state and writable layer.

The practical distinction is important: you build and version images, but you start, stop, and inspect containers. Interviews often reward answers that explain the relationship clearly instead of treating the terms as interchangeable.

Question 2

Why are containers useful in DevOps workflows?

Accepted Answer

Containers make it easier to package software with its dependencies and run it consistently across environments. That reduces “works on my machine” problems and simplifies deployment automation.

They are especially useful in CI/CD, local development, testing, and scalable runtime environments. A strong answer should also mention portability, isolation, and faster environment setup.

Question 3

What is the role of a Dockerfile?

Accepted Answer

A Dockerfile defines how an image is built. It specifies the base image, files to copy, commands to run, environment variables, exposed ports, entrypoint behavior, and more.

The Dockerfile matters because it becomes part of the application delivery process. A clean Dockerfile supports reproducible builds, better caching, smaller images, and easier troubleshooting.

Question 4

Why are multi-stage Docker builds useful?

Accepted Answer

Multi-stage builds let you separate build-time dependencies from runtime artifacts. For example, you can compile an application in one stage and copy only the built output into a smaller final image.

This reduces final image size, improves security by removing unnecessary tooling, and often speeds up deployment. It is one of the most common best practices for production Dockerfiles.

Question 5

What is the purpose of `.dockerignore`?

Accepted Answer

`.dockerignore` prevents unnecessary files from being included in the build context sent to the Docker daemon.

This improves build speed and reduces risk. Without it, local caches, source control folders, secrets, large assets, or temporary files may be copied into the build context accidentally, increasing image size or exposing sensitive data.

Question 6

How do you optimize Docker image builds?

Accepted Answer

I would choose a minimal base image where appropriate, order Dockerfile instructions for better layer caching, pin dependencies, and avoid copying unnecessary files.

A good answer also mentions reproducibility and security. Optimization is not only about image size; it is also about reliable builds, predictable dependency behavior, and minimizing attack surface.

Question 7

What is the difference between `CMD` and `ENTRYPOINT` in Docker?

Accepted Answer

`ENTRYPOINT` defines the main executable for the container, while `CMD` provides default arguments or a default command that can be overridden.

This distinction matters when designing container behavior. A common pattern is using `ENTRYPOINT` for the application binary and `CMD` for default runtime arguments.

Question 8

What is the difference between bind mounts and volumes?

Accepted Answer

Bind mounts map a specific host path into the container. Volumes are managed by Docker and are generally used for persistent data.

Bind mounts are convenient for local development because they reflect host file changes directly. Volumes are usually better for application data because they are more portable and less tightly coupled to the host filesystem layout.

Question 9

How do containers communicate in Docker Compose?

Accepted Answer

Services in the same Compose project typically share a default network and can reach each other by service name.

This makes service-to-service communication easier because you do not need to hardcode container IP addresses. A good answer may also mention port publishing, which is separate from internal network communication.

Question 10

What does `docker exec` do?

Accepted Answer

`docker exec` runs a command inside an existing running container. It is often used for debugging, inspecting files, checking processes, or opening a shell.

While it is useful operationally, production-heavy reliance on `docker exec` can also signal missing observability or weak automation. Good containerized systems should not depend on ad-hoc shell access for normal operation.

Question 11

How do you debug a container that exits immediately?

Accepted Answer

I would start with `docker logs` to inspect the container output, then review the Dockerfile, entrypoint, command, environment variables, mounted files, and any dependency assumptions the container has.

If needed, I would run the image interactively with a shell or override the entrypoint to inspect the runtime environment. The key is to determine whether the container is exiting because it completed successfully, failed on startup, or cannot reach a required dependency.

Question 12

What are common container security best practices?

Accepted Answer

Use minimal base images, avoid running as root when possible, keep packages updated, scan images for vulnerabilities, and avoid baking secrets into images.

Strong answers also mention image signing, least privilege, read-only filesystems where appropriate, and controlling what gets installed at build time. Container security is about reducing both attack surface and operational mistakes.

Question 13

What is the difference between a container and a virtual machine?

Accepted Answer

Containers share the host OS kernel and isolate processes at the operating system level, while virtual machines emulate full machines and include their own guest operating systems.

Containers are usually more lightweight and faster to start, while VMs offer stronger isolation and a more complete OS boundary. Interviews often test whether you understand that containers are not “small VMs.”

Question 14

What is a container registry?

Accepted Answer

A container registry stores and distributes container images so they can be pulled by developers, CI systems, or runtime platforms.

Registries are important because they become the source of truth for deployable images. Strong answers may mention tagging, immutability, access control, and vulnerability scanning in registries.

Question 15

Why should base images be chosen carefully?

Accepted Answer

The base image affects image size, security exposure, compatibility, and maintenance burden.

Using a smaller or more purpose-built base image can reduce attack surface and download size, but it must still support the application’s runtime needs. Thoughtful selection matters more than blindly choosing the smallest image.

Question 16

What does `EXPOSE` do in a Dockerfile?

Accepted Answer

`EXPOSE` documents which port the containerized application intends to listen on. It does not actually publish the port externally by itself.

This question often checks whether you understand the difference between image metadata and runtime networking behavior. Port publishing still needs to be configured when the container runs.

Question 17

What is the difference between `COPY` and `ADD`?

Accepted Answer

`COPY` copies files from the build context into the image. `ADD` can also extract local tar archives and support remote URLs, though remote usage is generally discouraged in many teams.

`COPY` is preferred in most cases because it is simpler and more explicit. Good Docker practices usually favor the least surprising instruction.

Question 18

Why is layer caching important in Docker builds?

Accepted Answer

Docker caches image layers so unchanged steps do not need to be rebuilt every time.

This can make builds much faster, especially in CI. A strong answer should mention ordering Dockerfile instructions so frequently changing files do not invalidate expensive cached layers unnecessarily.

Question 19

What is the writable layer in a container?

Accepted Answer

The writable layer is the temporary filesystem layer added when a container starts. It stores runtime changes made by the container.

This matters because data written there is generally ephemeral and disappears when the container is removed unless persistent storage is mounted. Understanding this is key to safe state handling.

Question 20

Why should most containers run a single main process?

Accepted Answer

A single main process keeps container behavior simple, observable, and aligned with container orchestration patterns.

This does not mean only one OS process can ever exist, but the design should have one clear primary responsibility. Splitting unrelated concerns into separate containers is usually easier to manage.

Question 21

What is PID 1 behavior in containers, and why does it matter?

Accepted Answer

The process running as PID 1 inside a container handles signals differently and may need to reap child processes properly.

This matters because improper PID 1 behavior can cause shutdown issues or zombie processes. Good answers may mention init wrappers or correct signal handling in the application.

Question 22

How do environment variables affect containerized apps?

Accepted Answer

Environment variables are a common way to inject runtime configuration such as ports, URLs, or credentials into containers.

They are useful because they let the same image run in different environments, but sensitive values still need secure handling and should not be baked into the image itself.

Question 23

What is the difference between build-time and runtime configuration?

Accepted Answer

Build-time configuration affects how the image is created, while runtime configuration affects how the container behaves when started.

This distinction is important because mixing them incorrectly can reduce reuse and portability. Generally, images should stay generic while runtime values are injected later.

Question 24

Why are health checks useful in containers?

Accepted Answer

Health checks help determine whether a containerized app is functioning correctly, not just whether the process exists.

They improve operational visibility and can be used by orchestrators to restart or stop routing traffic to unhealthy instances. A poor health check, however, can create instability.

Question 25

What are common reasons container builds fail in CI?

Accepted Answer

Common reasons include missing dependencies, changed base images, network access issues, broken caches, invalid Dockerfile instructions, or missing files in the build context.

A strong answer shows awareness that build problems can come from both application changes and the surrounding pipeline or registry environment.

Question 26

How do you troubleshoot a container networking issue?

Accepted Answer

I would verify the app is listening on the expected port, check port mappings, inspect networks, test name resolution, and confirm whether the problem is inside the container, on the host, or between services.

Networking issues often come from simple mismatches such as binding only to localhost inside the container, but they can also involve DNS, firewalls, proxies, or overlay networking in larger platforms.

Question 27

What is rootless container execution?

Accepted Answer

Rootless execution means running container tooling or containers without full root privileges on the host.

It can reduce host-level risk and improve security posture, though it may come with feature limitations depending on the environment. Mentioning this shows awareness of more advanced container security practices.

Question 28

How do you make container deployments safer in production?

Accepted Answer

I would use immutable tagged images, vulnerability scanning, least-privilege runtime settings, health checks, observability, and a rollout strategy that supports fast rollback.

Production safety is not just about the Dockerfile. It includes the full image lifecycle from build to registry to runtime controls and deployment verification.

Question 29

Why should image tags be used carefully?

Accepted Answer

Image tags can be mutable, so relying only on broad tags like `latest` can make deployments less predictable.

Strong teams use clear versioning and often pin to immutable digests for high-confidence environments. Predictability matters for rollback and debugging.

Question 30

What is the difference between `docker run` and `docker start`?

Accepted Answer

`docker run` creates and starts a new container from an image, while `docker start` starts an existing stopped container.

This distinction is basic but important because it reflects the difference between container creation and container lifecycle management.

Containers (Docker)

1. What is the difference between a Docker image and a container?

2. Why are containers useful in DevOps workflows?

3. What is the role of a Dockerfile?

4. Why are multi-stage Docker builds useful?

5. What is the purpose of `.dockerignore`?

6. How do you optimize Docker image builds?

7. What is the difference between `CMD` and `ENTRYPOINT` in Docker?

8. What is the difference between bind mounts and volumes?

9. How do containers communicate in Docker Compose?

10. What does `docker exec` do?

11. How do you debug a container that exits immediately?

12. What are common container security best practices?

13. What is the difference between a container and a virtual machine?

14. What is a container registry?

15. Why should base images be chosen carefully?

16. What does `EXPOSE` do in a Dockerfile?

17. What is the difference between `COPY` and `ADD`?

18. Why is layer caching important in Docker builds?

19. What is the writable layer in a container?

20. Why should most containers run a single main process?

21. What is PID 1 behavior in containers, and why does it matter?

22. How do environment variables affect containerized apps?

23. What is the difference between build-time and runtime configuration?

24. Why are health checks useful in containers?

25. What are common reasons container builds fail in CI?

26. How do you troubleshoot a container networking issue?

27. What is rootless container execution?

28. How do you make container deployments safer in production?

29. Why should image tags be used carefully?

30. What is the difference between `docker run` and `docker start`?