Dockerfile Instructions
Both ADD and COPY move files into an image. Why is COPY generally preferred, and what specific 'extra' features does ADD provide?
How do ENTRYPOINT and CMD work together when both are specified in a Dockerfile?
What does the ONBUILD instruction do, and when would you use it?
What does the VOLUME instruction in a Dockerfile do, and what are its implications?
What is the 'scratch' base image, and when would you build an image FROM scratch?
What is the difference between ARG and ENV? Which one would you use for a database URL that needs to change at runtime?
What is the difference between CMD and ENTRYPOINT? How do they behave differently when you pass arguments to docker run?
What is the difference between the exec form and shell form of instructions?
What is the LABEL instruction used for, and what kind of metadata do you typically add?
What is the purpose of the WORKDIR instruction, and why is it preferred over using RUN cd?
What is the STOPSIGNAL instruction, and why might you change the default stop signal for a container?
Orchestration & Swarm
Briefly explain Docker Swarm. How does it differ conceptually from running standalone containers?
Can you explain the concept of a 'Service' in Docker Swarm?
How do secrets and configs work in Docker Swarm, and how are they delivered to services?
How does Docker Swarm perform rolling updates of a service, and what options control the rollout?
What is a Docker stack, and how does it relate to Compose files and Swarm?
What is the difference between 'Replicated' and 'Global' services in Swarm?
What is the difference between a 'Service' and a 'Container' in the context of Docker Swarm?
What is the difference between Docker Compose and Docker Swarm?
What is the difference between manager and worker nodes in a Docker Swarm cluster?
When would you use Docker alone versus moving to an orchestrator like Kubernetes? What problem does an orchestrator solve that Docker Engine does not?
Images Vs Containers & Fundamentals
Conceptually, how does Docker solve the 'it works on my machine' problem across different environments?
Explain the difference between a Docker Image and a Docker Container.
How does Docker facilitate the concept of 'Immutable Infrastructure'?
What are 'immutability' and 'statelessness' in the context of Docker containers?
What does it mean for a container to be 'immutable,' and why is this property important for scaling and deployments?
Docker Architecture & Runtime
Describe the Docker architecture. What are the roles of the Docker Client, Daemon (dockerd), and Registry?
Explain the interaction between the Docker Client, the Docker Daemon (dockerd), and the Registry when you run a command like docker run.
Explain the relationship between the Docker Client, the Docker Daemon (dockerd), and the containerd runtime.
What are the OCI image and runtime specifications, and why do they matter for Docker interoperability?
What is the difference between the Docker Engine running on Linux and Docker Desktop running on macOS/Windows?
What is the role of containerd and runc in the modern Docker engine?
Image Layers & Storage
Explain how the Union File System works in Docker. Why are image layers read-only?
Explain the Docker image layer system and how caching works during a build.
How can you view the history of an image's layers, and why would you want to?
What happens to data written inside a container if the container is deleted? Why is the writable layer considered 'ephemeral'?
What is a 'dangling' image, and why does it occur during the development process?
What is an image digest, and how does it differ from an image tag?
What is the Copy-on-Write strategy, and how does it allow multiple containers to share the same base image without interfering with each other?
What is the difference between a base image and a parent image?
What is the difference between an Image ID and an Image Digest?
What is the overlay2 storage driver, and what role does it play in Docker?
Container Lifecycle & Runtime
Explain the 'PID 1' problem and why it is important for a container to handle signals correctly.
Explain the difference between docker stop and docker kill. What signals are sent to the process inside (SIGTERM vs SIGKILL)?
Explain the different Docker restart policies (no, always, unless-stopped, on-failure).
How do you troubleshoot a container that keeps exiting immediately after starting (CrashLoop)?
What do container exit codes tell you, and what does an exit code like 137 signify?
What is the difference between 'Attached' and 'Detached' mode when running a container?
What is the difference between docker exec and docker attach?
What is the difference between docker run and docker start? What happens to the container's filesystem in between?
What is the difference between interactive (-i) and TTY (-t) modes?
What is the purpose of a HEALTHCHECK instruction? How does it differ from the process simply 'running'?
What is the purpose of the --init flag, and how does it relate to zombie process reaping?
When would you run a container in 'interactive' mode (-it) versus 'detached' mode (-d)?
Networking
Explain the difference between the 'Bridge', 'Host', and 'None' network drivers.
Explain the difference between the default bridge network and host network mode. When would you use host mode?
How do containers communicate with each other by default on a single host? How does Docker's internal DNS work in user-defined networks?
How does Docker's embedded DNS server enable service discovery on user-defined networks?
What is an Overlay network, and in what context is it typically used?
What is the default bridge network in Docker, and how does it facilitate container-to-container communication?
What is the difference between the EXPOSE instruction in a Dockerfile and the -p (publish) flag in docker run?
What is the macvlan network driver, and in what scenarios is it useful?
What were legacy container links, and why have user-defined networks replaced them?
Virtualization & Isolation
Explain the fundamental difference between a Docker container and a Virtual Machine. Why are containers considered more lightweight?
What are Linux Namespaces and Control Groups (cgroups), and what specific roles do they play in Docker's isolation?
What are the implications of containers sharing the host OS kernel? When would this be a security or compatibility concern?
What is rootless Docker, and what security benefits and limitations does it have?
Docker Compose
How can healthchecks be used to gate service startup in Docker Compose (condition: service_healthy)?
How can you scale a service to multiple replicas using Docker Compose?
How do Docker Compose override files (e.g. docker-compose.override.yml) work for different environments?
How do you supply environment variables to services in Compose, including using an env_file or a .env file?
How does Docker Compose differ from a Dockerfile? What is the primary use case for Compose in a developer's workflow?
In Docker Compose, what does depends_on do? Does it guarantee that an application is 'ready' to accept connections? If not, how do you solve that?
What are Docker Compose 'profiles' and how are they used in different environments?
Volumes & Persistent Data
How can two different containers share the same data on a host? Explain the mechanism used.
How would you back up and restore the data stored in a Docker named volume?
What are 'anonymous volumes' and how do they differ from 'named volumes'?
What is a volume driver, and when would you use one instead of the default local driver?
What is the difference between a Docker Volume and a Bind Mount? When would you use each?
When would you use a tmpfs mount?
Resource Limits & Oom
How can you limit the CPU and Memory usage of a container?
How does Docker handle Out of Memory (OOM) events?
Why is it important to set CPU and Memory limits on containers in a shared environment? What happens if a container exceeds its memory limit (OOM)?
Monitoring Debugging & Cleanup
How do you clean up unused Docker images, containers, and volumes to free up disk space?
How does docker logs work, and what are its limitations for long-running production containers?
What are Docker logging drivers, and why would you configure a driver other than the default json-file?
What does docker cp do, and when would you use it?
What does docker diff show, and how is it useful for debugging?
What does docker system df tell you, and how does docker system prune help manage disk usage?
What does docker top show about a running container?
What information does 'docker stats' provide?
What information does docker inspect give you about a container or image?
What is a 'dangling image' and how does it differ from an 'unused image'?
What is docker events, and when would you use it for monitoring or debugging?
Image Building & Optimization
How do you optimize a Docker image for size?
How does Docker decide whether to use a cached layer during a build? Why does the order of instructions in a Dockerfile matter for build performance?
How does Docker's build caching mechanism work, and what causes a 'cache bust'?
What does docker commit do, and why is it generally discouraged for producing images?
What is a 'distroless' or 'Alpine' image, and why are they preferred in production?
What is a multi-stage build? Explain how it helps in reducing the final production image size and improving security.
What is BuildKit, and how does it improve Docker builds compared to the legacy builder?
What is the 'build context' in Docker, and why is it important to manage it using a .dockerignore file?
What is the purpose of a .dockerignore file, and how does it impact build performance?
Why does the order of instructions in a Dockerfile matter for build performance, and why should you COPY dependency files before your source code?
Security
How do you pass build-time secrets to a Docker build without leaking them into the final image layers?
How should you manage sensitive data like API keys or passwords in Docker without 'baking' them into the image?
What does the --privileged flag do, and why should it be avoided in almost all production scenarios?
What is 'Image Scanning' and why is it a critical part of the container lifecycle?
What is /var/run/docker.sock and why is mounting it into a container considered a security risk?
What is Docker Content Trust, and how does image signing help secure your supply chain?
What Linux capabilities are, and how do --cap-add and --cap-drop help enforce least privilege?
Why is it a best practice to use the USER instruction in a Dockerfile rather than running as the default root user?
Why is running a container with a read-only root filesystem a security best practice, and how do you handle writable paths?
Why is the 'one process per container' principle recommended, and when might you break it?
Registries & Tagging
How does a multi-arch image and a manifest list allow one tag to serve different CPU architectures?
How is a fully qualified Docker image name structured (registry, repository, tag/digest)?
What are Docker Hub rate limits, and how do they affect your pulls in a CI or production environment?
What is a 'Multi-arch build' and why is it becoming more common?
What is the difference between an official image, a verified publisher image, and a community image on Docker Hub?
What tagging strategy would you adopt for images across dev, staging, and production?
Why is pinning image tags or digests important for reproducible builds, as opposed to relying on :latest?