Frequently asked Docker and Kubernetes interview questions on images, containers, Dockerfiles, layers, volumes, networking, Compose, security, pods, deployments and troubleshooting, with hints and answers.
22 questions · Updated
Template and running instance.
An image is a read-only template that holds the app and its dependencies. A container is a running instance of an image, with its own writable layer.
What do they share?
A virtual machine runs a full guest operating system. Containers share the host's kernel, so they are much smaller and start in seconds, though the isolation is weaker.
Which side is the host?
It forwards port 8080 on the host to port 80 in the container. The left side is always the host.
Build time or start time?
RUN executes during the build, and saves the result in a layer. CMD sets the default command when a container starts.
Storage outside the container.
Attach a named volume to the database's data folder, such as -v pgdata:/var/lib/postgresql/data.
Dependencies before code.
FROM python:3.13-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
USER nobody
CMD ["python", "app.py"]What keeps a container alive?
A container lives only as long as its main process. The process may have finished or crashed. Check docker ps -a for the exit code, and read docker logs.
What happens after a changed step?
A changed step rebuilds itself and everything after it. Put slow, rarely changing steps such as dependency installs first, and copy your code last.
Build tools are not needed at run time.
It uses several FROM stages: one to build, and a final one that copies in only the result. The image is much smaller, and contains less that can be attacked.
Base image, stages and context.
Use a slim or Alpine base, multi-stage builds and .dockerignore, and clean up in the same RUN step that installs packages.
Who chooses the location?
Docker manages a volume, which suits production data. A bind mount uses a host path that you choose, which suits development.
What does localhost mean inside a container?
localhost is the container itself. Put both containers on one network, and connect using the database's service or container name.
128 plus a signal number.
The process received SIGKILL (128 + 9), usually from the out-of-memory killer. Check OOMKilled in docker inspect.
Started is not the same as ready.
Plain depends_on waits only until the container starts, not until the database accepts connections. Add a health check, and use condition: service_healthy.
Not in the image.
Never put them in a Dockerfile or an image, because docker history can reveal them. Pass them at run time, ideally as mounted secret files, and use BuildKit secrets during builds.
What if the app is compromised?
If an attacker gets into the app, they have fewer rights in the container, and less chance of escaping to the host. Add USER to the Dockerfile.
Isolate, limit, layer.
Namespaces isolate processes, networks and mounts. cgroups limit CPU and memory. Union file systems such as overlay2 provide layered storage.
Who receives the signal?
The app is not handling SIGTERM, often because it runs under a shell as PID 1. Docker waits, then kills it. Use the exec form of CMD, handle signals, or add --init.
What brings a pod back?
A pod is one or more containers, and does not come back if deleted. A Deployment keeps a set number of pods running, and handles rolling updates and rollbacks.
Restart, or stop sending traffic?
A failing readiness probe removes the pod from Service traffic. A failing liveness probe restarts the container.
Pod addresses change.
Pods are replaced, and their IP addresses change. A Service gives a stable name and address for a group of pods, chosen by label, and balances traffic among them.
Previous logs and events.
Run kubectl logs --previous and kubectl describe pod. Look for a bad config, a missing secret, a failing probe, or an out-of-memory kill.