The Docker Question That 90% of Candidates Fumble

Weak Answer:
"An image is like a file and a container is like
a process that runs it. You use docker run to
start it."

Why this fumbles:
- No layers, no isolation, no runtime explanation.
- Could have been read off a blog.
- Invites no follow-up questions.

Result: the interviewer moves on to a candidate
who actually builds and ships.

Strong Answer:
"An image is a read-only, layered template built
from a Dockerfile — it contains the filesystem,
dependencies, and metadata to start a process.

A container is a running instance of that image,
with its own writable layer and its own isolated
process and network namespace, sharing the host
kernel.

So the image is the blueprint; the container is
the running instance. You can start many
containers from the same image, and they don't
interfere with each other because each has its
own filesystem layer and namespace.

Result: the interviewer asks a follow-up — which
is exactly what you want.

# Dockerfile
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]

Each line becomes a layer.
Layers are cached — that is why COPY
package*.json comes before COPY . .

# Build the image
docker build -t myapp:1.0 .

# Run a container from the image
docker run -d -p 3000:3000 --name myapp myapp:1.0

# The image is now the blueprint.
# The container is a running instance.
# You can run many containers from one image.

docker run -d --name myapp-2 myapp:1.0

services:
  api:
    build: .
    ports:
      - "3000:3000"
    environment:
      - DB_HOST=db
    depends_on:
      - db
  db:
    image: postgres:16
    volumes:
      - pgdata:/var/lib/postgresql/data

volumes:
  pgdata:

Networking:
- Compose creates a user-defined bridge network.
- api can reach db using the service name "db".
- Each container still has its own namespace.

Volumes:
- pgdata is a named volume.
- It lives outside the container, so it survives
  docker compose down (unless you use -v).
- The container's writable layer is ephemeral;
  volumes are not.

Fumble:
- "A container is a lightweight VM."
- "Docker is a type of virtual machine."
- "Images and containers are basically the same."
- No mention of namespaces or the kernel.
- Confusing the writable layer with the image.

Fix:
- Containers share the host kernel; VMs do not.
- A container is an isolated process, not a VM.
- An image is immutable; a container adds a
  writable layer.
- Namespaces provide isolation; cgroups limit
  resources.

Why it matters:
- The VM/container confusion is a red flag —
  it says you have used Docker but never
  understood it.
- The interviewer will always ask a follow-up
  here. Getting it wrong ends the round.