←

# docker & containers

// [25] real interview questions. Answers and sources live in the practice app.

practice this topic
  1. How are containers different from virtual machines?(junior)
  2. Explain image layers. How does Docker use them when building and running images?(mid)
  3. Your Docker builds suddenly got slow — the layer cache stopped being hit. How does the build cache work, and what invalidates it?(mid)
  4. Your application image is 2GB. How do you find out why and shrink it?(mid)
  5. Explain multi-stage builds. What problem do they solve?(mid)
  6. What is the difference between COPY and ADD in a Dockerfile? Which should you use?(junior)
  7. ENTRYPOINT vs CMD — how do they interact, and what's the pitfall with exec form vs shell form?(mid)
  8. What is the build context, and what is .dockerignore for?(junior)
  9. Describe in detail what happens when you run `docker run <image>`.(senior)
  10. True or false: killing the Docker daemon kills all running containers. Explain.(senior)
  11. Which Linux kernel features make containers possible? Explain namespaces vs cgroups.(mid)
  12. Container storage is ephemeral. How do you persist data — volumes vs bind mounts, and when do you use which?(mid)
  13. What container security best practices do you enforce, especially around secrets and privileges?(senior)
  14. A containerized service crashes occasionally and must come back up automatically. What does Docker offer, and which restart policy do you choose?(mid)
  15. True or false: pulling an image with the 'latest' tag gives you the most recently published version. Why does this matter in production?(mid)
  16. What is an image digest, and what problem does it solve that tags cannot?(senior)
  17. A running container exhibits a bug you want teammates to reproduce, including its current state and debug env vars. How do you share it — and why isn't this how you build production images?(mid)
  18. Can two containers on the same host talk to each other by default? Explain how Docker networking makes it work — and why user-defined bridges beat the default one.(mid)
  19. What is the difference between EXPOSE in a Dockerfile and publishing a port with -p?(junior)
  20. Code inside your container calls an API on the host machine's localhost and gets connection refused. Why, and what are the correct options?(mid)
  21. Your stack runs happily on Docker Compose. When is Compose genuinely enough, and what concrete signals say it's time for Kubernetes?(senior)
  22. How do you catch vulnerable packages in your images before they reach production — what does an image scanner actually check, and why is a clean scan not a guarantee?(mid)
  23. What are rootless containers, what attack do they actually blunt, and what are their practical limitations?(senior)
  24. A Docker host's disk is nearly full. How do you find what's eating it and clean up safely — and why doesn't removing containers free volume space?(mid)
  25. Your team wants to run the production PostgreSQL in a container 'like everything else'. Is running stateful services in containers good practice — what actually decides it?(senior)