Top 50+ Docker Interview Questions {Freshers + Experienced}

Q1. What is Docker?

Answer: Docker is an open-source platform that automates the packaging, distribution, and running of applications inside lightweight, portable units called containers.

Q2. What is a Docker image?

Answer: A Docker image is a read-only template containing an application's code, runtime, libraries, and dependencies. Containers are created from images.

Q3. What is a Docker container?

Answer: A container is a running instance of a Docker image — an isolated process with its own filesystem, network, and resource limits, sharing the host OS kernel.

Q4. What is a Dockerfile?

Answer: A Dockerfile is a text file containing a series of instructions (FROM, COPY, RUN, CMD, etc.) that Docker uses to build an image.

Q5. What is Docker Hub?

Answer: Docker Hub is a public cloud registry where Docker images can be stored, shared, and pulled from — similar to how GitHub hosts code repositories.

Q6. What is the difference between an image and a container?

Answer: An image is a static, read-only template; a container is a running (or stopped) instance created from that image. Many containers can be created from a single image.

Q7. What are Docker image layers?

Answer: Each instruction in a Dockerfile creates a new, cached layer. Layers are stacked using a union file system, allowing Docker to reuse unchanged layers across builds for speed and efficiency.

Q8. What is a multi-stage build?

Answer: A multi-stage build uses multiple FROM statements in one Dockerfile, allowing you to compile or build an application in one stage and copy only the final artifacts into a smaller, production-ready image — reducing final image size.

Q9. How do you reduce Docker image size?

Answer: Use minimal base images (like alpine), combine RUN commands to reduce layers, remove build-time dependencies in the same layer they were installed, use multi-stage builds, and add a .dockerignore file.

Q10. What is the difference between CMD and ENTRYPOINT?

Answer: CMD provides default arguments that can be overridden at runtime, while ENTRYPOINT defines the fixed executable that always runs. They are often combined: ENTRYPOINT for the executable, CMD for default arguments.

Q11. What is a Docker volume?

Answer: A volume is a persistent storage mechanism managed by Docker, stored outside the container's writable layer, allowing data to survive container restarts and removal.

Q12. What is the difference between a volume and a bind mount?

Answer: A volume is fully managed by Docker and stored in Docker's storage area, while a bind mount maps a specific host directory or file directly into the container, giving more control but less portability.

Q13. What are the default Docker network drivers?

Answer: The main drivers are bridge (default for standalone containers), host (shares the host's network stack directly), none (no networking), and overlay (used for multi-host communication, often with Swarm or Kubernetes).

Q14. How do containers communicate with each other?

Answer: Containers on the same custom bridge network can communicate using their container name as a hostname, thanks to Docker's built-in DNS resolution.

Q15. What happens to data when a container is removed?

Answer: Any data written inside the container's writable layer is lost when the container is removed, unless that data was stored in a volume or bind mount.

Q16. What is Docker Compose?

Answer: Docker Compose is a tool for defining and running multi-container applications using a single YAML file, letting you start, stop, and configure an entire application stack with one command.

Q17. What is the difference between docker run and docker compose up?

Answer: docker run starts a single container from the command line, while docker compose up starts one or more services defined declaratively in a docker-compose.yml file, wiring up networks and volumes automatically.

Q18. What is Docker Swarm?

Answer: Docker Swarm is Docker's native clustering and orchestration tool, allowing multiple Docker hosts to be managed as a single virtual system, with built-in service scaling and load balancing.

Q19. How does Kubernetes relate to Docker?

Answer: Kubernetes orchestrates containers across a cluster of machines — scheduling, scaling, and healing them — while Docker (or another container runtime) is often used to build and run the underlying containers.

Q20. How do you keep Docker images secure?

Answer: Use official or verified base images, keep images updated, avoid running containers as root, scan images for vulnerabilities, and remove unnecessary tools and packages from production images.

Q21. What is a .dockerignore file used for?

Answer: It tells Docker which files and directories to exclude from the build context, reducing image size and preventing sensitive files (like .env or .git) from being copied into the image.

Q22. What is the principle of least privilege in Docker?

Answer: It means running containers with only the permissions they need — for example, avoiding the --privileged flag, running as a non-root user, and limiting resource access — to reduce the impact of a potential compromise.

Q23. How do you limit container resource usage?

Answer: Using flags like --memory and --cpus with docker run, or resource requests/limits in Compose and Kubernetes manifests, to cap how much CPU and memory a container can consume.

Q24. What is container image scanning?

Answer: The process of analyzing an image's layers and dependencies for known vulnerabilities using tools like Docker Scout, Trivy, or Snyk, typically integrated into a CI/CD pipeline.