Docker and Containers Interview Questions for DevOps
25 Docker and Containers questions with answers for devops roles — 8 easy, 14 medium, 3 hard.
About Docker and Containers
Containers package an application with its dependencies so it runs the same everywhere. This topic covers images, layers, Dockerfile instructions, multi-stage builds, networking, volumes, Docker Compose, resource limits, health checks and image security, plus debugging containers that crash, bloat or lose data.
Sheet progressStart practicing
3 QUESTIONS FREESign up to unlock the full question bank and track your progress.Unlock every question and answer, then continue practising company-wise and package-wise.
✓ 3 questions free • Unlock the rest in seconds
01
What is the difference between a container and a virtual machine?
A virtual machine runs a full guest operating system on a hypervisor, so it is heavier, takes minutes to boot and uses gigabytes. A container shares the host kernel and isolates only the application and its dependencies using namespaces and cgroups, so it starts in seconds and uses far less memory. VMs give stronger isolation; containers give density and portability.
02
What is the difference between a Docker image and a container?
An image is a read-only template made of layers, containing the application, libraries and configuration, built from a Dockerfile. A container is a running instance of an image with a thin writable layer on top. You can start many containers from one image. Changes made inside a container are lost when it is removed unless they are stored in volumes.
03
What is the difference between COPY and ADD in a Dockerfile?
COPY copies local files and directories into the image and does nothing else. ADD can also download from a URL and automatically extracts local tar archives. Because that extra behaviour can be surprising, best practice is to use COPY by default and ADD only when you specifically want tar extraction. For downloads, use curl in a RUN step so you can verify checksums.
Docker Compose defines and runs multi-container applications from a YAML file, usually compose.yaml. You describe services, networks, volumes, environment variables and dependencies, then start everything with docker compose up. It is ideal for local development and testing, for example an API, database and cache together. For production orchestration across many hosts, teams use Kubernetes instead.
05
A container exits immediately after it starts. How do you debug it?
Run docker ps -a to see the exit code and docker logs <id> for output. Exit code 0 usually means the main process finished, for example a script that ran once or a service started in background mode, so the container has nothing to keep it alive. Non-zero codes point to errors such as missing config. Start an interactive shell with docker run -it --entrypoint sh to inspect.
06
Database data disappeared after the container was recreated. Why, and how do you fix it?
Data written inside the container's writable layer is deleted when the container is removed. The database must store its data directory in a named volume or bind mount, for example -v pgdata:/var/lib/postgresql/data. Then containers can be upgraded or recreated without losing data. Also take regular backups, because volumes protect against container removal, not against disk failure.
07
Which Docker commands do you use to debug a running container?
docker ps # running containers
docker logs -f --tail 100 api # follow logs
docker exec -it api sh # shell inside
docker inspect api # config, IP, mounts, env
docker stats # live CPU and memory
docker top api # processes inside
docker cp api:/app/log.txt . # copy a file out
docker events # daemon events
Use sh for alpine images, where bash may not exist.
08
How do you keep yourself updated with new DevOps tools and practices?
I follow official release notes for tools I use, such as Kubernetes and Terraform, and read a few engineering blogs and CNCF updates weekly. I learn by doing, so I try new tools in a small home lab or free cloud tier before suggesting them. I also prepare for certifications to structure my learning, and share short notes with my team.
09
How do Docker image layers and build caching work?
Each Dockerfile instruction like RUN, COPY or ADD creates a layer. Docker caches layers and reuses them if the instruction and its inputs have not changed; once one layer changes, all later layers rebuild. So copy dependency files and install dependencies first, then copy source code. That way code changes do not reinstall all packages, and builds become much faster.
10
What is the difference between CMD and ENTRYPOINT?
ENTRYPOINT defines the main executable that always runs, while CMD provides default arguments or a default command that can be overridden from docker run. For example, ENTRYPOINT ["python", "app.py"] with CMD ["--port", "8000"] lets users change only the port. Use the exec (JSON array) form so the process runs as PID 1 and receives signals properly.
bridge is the default: containers get private IPs on a virtual bridge and reach outside through NAT; user-defined bridges also provide DNS by container name. host shares the host's network stack directly, with no port mapping. none disables networking. overlay connects containers across multiple hosts in Swarm. macvlan gives a container its own MAC address on the physical network.
12
What is the difference between volumes and bind mounts?
A volume is storage managed by Docker under its own directory, created with docker volume create and referenced by name; it is portable and is the recommended way to persist data such as databases. A bind mount maps a specific host path into the container, which is handy for local development hot reload but depends on host directory layout and permissions.
13
What is a multi-stage Docker build and why use it?
A multi-stage build uses several FROM instructions in one Dockerfile. Early stages contain compilers and build tools to produce the artefact; the final stage starts from a small runtime image and copies only the built output with COPY --from. The result is a much smaller image with fewer vulnerabilities, because build tools, source code and caches never reach production.
14
Your Docker image is 1.5 GB. How do you reduce its size?
Switch to a slimmer base image such as a slim or distroless variant. Use a multi-stage build so compilers and build caches stay out of the final image. Combine package installs and clean caches in the same RUN layer. Add a .dockerignore to exclude .git, node_modules and test data. Then inspect remaining layers with docker history or the dive tool.
15
Two containers on the same host cannot talk to each other. What do you check?
Check that both are on the same user-defined network with docker network inspect; the default bridge does not resolve container names. Use the service or container name and the container's internal port, not localhost and not the published host port. Confirm the app listens on 0.0.0.0 rather than 127.0.0.1. Then test with curl or nc from inside one container.
16
The host disk is filling up because of Docker. How do you clean up and prevent it?
Check usage with docker system df. Remove stopped containers, dangling images and unused networks with docker system prune, and old build cache with docker builder prune; be careful with the volumes flag. Container logs are a common culprit, so configure log rotation with max-size and max-file in daemon.json. In CI agents, schedule regular pruning jobs.
17
Write a production-ready Dockerfile for a Node.js application.
FROM node:20-alpine
WORKDIR /app
ENV NODE_ENV=production
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
USER node
EXPOSE 3000
CMD ["node", "server.js"]
Dependencies are copied and installed before source code so the layer is cached. npm ci gives reproducible installs, USER node avoids running as root, and exec form CMD lets the app receive signals.
18
Write a multi-stage Dockerfile for a Java Spring Boot application.
FROM maven:3.9-eclipse-temurin-21 AS build
WORKDIR /src
COPY pom.xml .
RUN mvn -B dependency:go-offline
COPY src ./src
RUN mvn -B package -DskipTests
FROM eclipse-temurin:21-jre-alpine
WORKDIR /app
COPY --from=build /src/target/*.jar app.jar
RUN adduser -D appuser
USER appuser
EXPOSE 8080
ENTRYPOINT ["java", "-jar", "app.jar"]
The final image has only the JRE and the JAR, not Maven or source.
19
Write a Docker Compose file for a web app with a PostgreSQL database.
docker run -d --name api \
--memory=512m --memory-swap=512m \
--cpus=1.5 \
--restart=unless-stopped \
myapp:1.0
# change limits on a running container
docker update --memory=1g --memory-swap=1g api
If the process exceeds the memory limit it is OOM killed, so set application heap sizes below the limit. --cpus caps CPU time rather than reserving cores.
FROM nginx:1.27-alpine
COPY site/ /usr/share/nginx/html/
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
CMD wget -qO- http://localhost/ || exit 1
# check status
docker inspect --format '{{.State.Health.Status}}' web
Docker marks the container healthy or unhealthy. Compose can wait on it with condition: service_healthy. Kubernetes ignores HEALTHCHECK and uses its own probes.
22
Tell me about a time you introduced a new tool or practice to your team.
Situation: new developers took two days to set up our app locally because of different OS versions and manual database installs. Task: I wanted to make onboarding easy. Action: I created a Docker Compose setup with the app, database and seed data, wrote a short README and demoed it. Result: setup dropped to under an hour and the team adopted it for CI.
23
How do containers work under the hood using namespaces and cgroups?
Linux namespaces give each container its own isolated view of process IDs, network interfaces, mount points, hostname, users and IPC, so it believes it is alone on the machine. Control groups (cgroups) limit and account for CPU, memory and I/O usage. A container runtime such as containerd with runc sets these up, plus an overlay file system for image layers.
24
What are the best practices for securing Docker images?
Use small, trusted base images such as distroless or alpine and pin versions or digests. Run as a non-root user, use multi-stage builds, and never bake secrets into layers. Scan images with Trivy or similar in CI and rebuild regularly to pick up patches. At runtime, drop Linux capabilities, use read-only root file systems and sign images to verify their source.
25
Your container takes 10 seconds to stop and does not shut down gracefully. Why?
docker stop sends SIGTERM to PID 1 and waits 10 seconds before SIGKILL. If the Dockerfile uses shell form like CMD node app.js, PID 1 is a shell that does not forward signals, so the app never gets SIGTERM. Use exec form CMD ["node", "app.js"], use exec in entrypoint scripts, or add an init such as tini with --init, and handle SIGTERM in code.
Frequently asked questions
How important is Docker and Containers in DevOps interviews?
Containers package an application with its dependencies so it runs the same everywhere. This topic covers images, layers, Dockerfile instructions, multi-stage builds, networking, volumes, Docker Compose, resource limits, health checks and image security, plus debugging containers that crash, bloat or lose data.
How should I use the Docker and Containers sheet?
Go top to bottom — easy to hard. Answer before opening each answer, tick what you solved and save misses to Last-Minute Revision.