Docker Interview Questions & Answers (2026)

What is the difference between a Docker image and a Docker container?

A Docker image is a read‑only template that includes the filesystem layers, application code, runtime, libraries, and metadata needed to run a container. A container is a runnable instance of that image, providing an isolated process space with its own writable layer, networking, and PID namespace. Interviewers expect you to stress immutability of images versus the mutable state of containers, and to mention that containers can be started, stopped, and destroyed without affecting the original image.

How does Docker use layered filesystems and why is it beneficial?

Docker builds images as a stack of read‑only layers, each representing a set of filesystem changes (e.g., RUN, COPY). When a container runs, Docker adds a thin writable layer on top. This design enables layer reuse across images, reducing storage and download time because identical layers are cached locally or shared via registries. Interviewers look for understanding of copy‑on‑write efficiency, layer caching during builds, and how modifying a lower layer forces rebuild of subsequent layers, impacting CI pipelines.

Explain the purpose of a Dockerfile and the best order of instructions for cache efficiency.

A Dockerfile is a declarative script that defines how to assemble an image using sequential instructions like FROM, RUN, COPY, and CMD. For cache efficiency, place instructions that change rarely early—such as FROM, ENV, and installing system packages—so Docker can reuse those layers. Later steps that involve source code copies or frequent changes should be near the end. This ordering minimizes rebuild time in CI/CD, which interviewers view as a sign of production‑ready Docker expertise.

FROM python:3.11-slim
ENV PYTHONUNBUFFERED=1
RUN apt-get update && apt-get install -y build-essential
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python","app.py"]

How do you persist data in Docker containers?

Persist data using Docker volumes or bind mounts. Volumes are managed by Docker and stored in `/var/lib/docker/volumes`, offering portability and easier backup. Bind mounts map a host directory into the container, useful for development when you need live code changes. Interviewers expect you to explain when to choose each method, how to declare them with `-v` or in Compose, and the security implications of exposing host paths.

What is the purpose of the `docker exec` command and a common security consideration?

`docker exec` runs a new process inside an existing container, useful for debugging, migrations, or ad‑hoc tasks. A security concern is that it bypasses the container’s original entrypoint and may grant elevated privileges if the container runs as root. Interviewers look for you to mention using the `--user` flag to limit privileges and ensuring exec access is restricted in production environments via role‑based policies.

Explain the difference between `docker run --rm` and `docker container prune`.

`docker run --rm` automatically removes the container after it exits, keeping the host clean for short‑lived tasks. `docker container prune` removes all stopped containers in bulk, which is useful for periodic cleanup. Interviewers want you to note that `--rm` works per container, while prune is a manual housekeeping command that can delete containers you might still need for debugging.

What is Docker Compose and when would you choose it over Docker Swarm?

Docker Compose is a tool for defining and running multi‑container applications using a single YAML file. It is ideal for local development, testing, and simple staging environments because it manages container lifecycle on a single host. Docker Swarm, on the other hand, provides native clustering, service discovery, and load balancing across multiple nodes. Choose Compose for rapid iteration and Swarm when you need production‑grade orchestration without introducing a full Kubernetes stack. Interviewers expect you to compare scope, networking model, and scaling capabilities.

How do you limit CPU and memory usage for a container?

Use the `--cpus` flag to set a fractional CPU limit (e.g., `--cpus=0.5` for half a core) and `--memory` to cap RAM (e.g., `--memory=512m`). Docker enforces these limits via cgroups, preventing a container from exceeding allocated resources, which protects the host from noisy neighbors. Interviewers look for awareness of both hard limits (`--memory`) and soft limits (`--memory-swap`), and may ask about trade‑offs such as performance impact versus resource isolation.

Describe how Docker networking works with bridge, host, and overlay drivers.

The bridge driver creates an isolated virtual network on a single host, assigning containers private IPs and enabling NAT to the host. The host driver removes isolation, sharing the host’s network stack directly, which can improve performance but reduces security. Overlay networks span multiple Docker hosts, using VXLAN encapsulation to provide a flat network for services in Swarm or Kubernetes. Interviewers expect you to discuss use cases—bridge for most apps, host for performance‑critical services, overlay for multi‑host clustering—and mention port mapping and DNS resolution.

What is a multi‑stage build and how does it improve image size?

A multi‑stage build uses multiple `FROM` statements in a single Dockerfile, allowing you to compile or build artifacts in a temporary builder image and then copy only the final binaries into a minimal runtime image. This eliminates build‑time dependencies, reducing the final image size dramatically (often from hundreds of megabytes to under 50 MB). Interviewers look for you to illustrate the pattern, show a snippet, and discuss benefits such as faster pulls, lower attack surface, and compliance with least‑privilege principles.

FROM golang:1.22-alpine AS builder
WORKDIR /src
COPY . .
RUN go build -o app

FROM alpine:latest
COPY --from=builder /src/app /app
CMD ["/app"]

What is a Docker healthcheck and when should you use it?

A healthcheck defines a command that Docker runs periodically to determine if a container is healthy. If the command exits with 0, Docker marks the container as healthy; otherwise, it becomes unhealthy. Use healthchecks for services that need to be ready before traffic is routed, such as databases or APIs. Interviewers expect you to mention the `HEALTHCHECK` Dockerfile instruction, configuring interval, timeout, retries, and how orchestrators can act on health status.

What is the purpose of the `--init` flag when running a container?

`--init` adds a tiny init process (tini) as PID 1 inside the container, handling zombie reaping and signal forwarding. This prevents issues where the main process does not correctly handle SIGTERM, leading to orphaned processes. Interviewers look for understanding of PID 1 semantics, why an init process is recommended for most containers, and the impact on graceful shutdown.

What is the difference between `docker build` and `docker buildx`?

`docker build` uses the classic builder and supports single‑platform builds. `docker buildx` introduces a CLI plugin that enables multi‑platform builds, build caching, and remote builder instances. It leverages BuildKit for parallel execution and advanced features like exporting to OCI format. Interviewers expect you to mention use cases such as building images for both amd64 and arm64 in CI pipelines, and the performance benefits of BuildKit.

How would you debug a container that cannot resolve DNS names?

First, exec into the container and test `ping` or `nslookup` against known hosts. Verify `/etc/resolv.conf` points to the correct DNS server (often Docker's embedded DNS at 127.0.0.11). Check the network mode; bridge networks rely on the host's DNS settings. If custom DNS is needed, use the `--dns` flag or configure the `dns` section in Compose. Interviewers look for systematic steps and awareness of Docker's internal DNS resolver.

Explain how Docker handles image layers when you modify a Dockerfile line.

Docker caches each layer after it is built. When a Dockerfile line changes, Docker invalidates that layer and all subsequent layers, forcing them to rebuild. Earlier unchanged layers remain cached, speeding up the build. Interviewers want you to discuss the impact on CI pipelines, how to minimize rebuilds by ordering stable commands first, and the role of `--cache-from` to reuse layers from remote images.

How would you troubleshoot a container that keeps exiting with status 137?

Exit code 137 indicates the container was killed by SIGKILL, typically due to out‑of‑memory (OOM) conditions. First, inspect `docker logs` for application errors, then check `docker stats` or host `dmesg` for OOM events. Adjust memory limits (`--memory`) or optimize the application’s memory usage. Interviewers expect you to mention cgroup enforcement, possible swap usage, and verifying that the host has sufficient free RAM.

What are the security implications of running a container as root and how can you mitigate them?

Running as root gives the process full privileges inside the container, and if the container is compromised, an attacker may escape to the host via kernel exploits. Mitigation strategies include using the `USER` directive in Dockerfile to drop privileges, applying `--user` at runtime, enabling user namespaces, and limiting capabilities with `--cap-drop`. Interviewers look for a layered defense approach: least‑privilege user, namespace isolation, and runtime security policies.

Describe the role of Docker Content Trust (DCT) and how to enable it.

Docker Content Trust provides image signing and verification using Notary, ensuring that only trusted images are pulled and run. Enable it by setting the environment variable `DOCKER_CONTENT_TRUST=1` before `docker pull` or `docker run`. This forces Docker to verify signatures against the Notary server. Interviewers expect you to discuss supply‑chain security, the impact on CI pipelines, and fallback strategies when signatures are missing.

How does Docker integrate with Kubernetes, and what are the differences between Docker Engine and container runtimes like containerd?

Kubernetes uses the Container Runtime Interface (CRI) to manage containers; Docker Engine implements this via a shim, but modern clusters prefer lightweight runtimes like containerd or CRI‑O for reduced overhead. Docker still builds images and can push to registries, but the runtime responsibilities (pause, start, stop) are delegated to containerd. Interviewers look for you to explain the deprecation of Docker as a CRI in newer Kubernetes versions and the benefits of using containerd directly.

How would you migrate a legacy monolithic app to Docker containers with minimal downtime?

First, containerize the app by creating a Dockerfile that reproduces the current environment. Use multi‑stage builds to keep the image lean. Deploy the container behind a load balancer with a blue‑green strategy: route traffic to the existing version while the new container starts, then switch traffic once health checks pass. Use rolling updates in Docker Swarm or Kubernetes to gradually replace instances, ensuring zero‑downtime. Interviewers assess your ability to combine Docker with deployment patterns and rollback plans.

Can you explain Docker's copy‑on‑write mechanism and its impact on performance?

Copy‑on‑write (CoW) means that when a container writes to a file, Docker creates a new copy of that block in the writable layer, leaving the underlying image layer unchanged. This allows multiple containers to share the same base layers efficiently. However, heavy write operations can cause fragmentation and increased I/O latency. Interviewers expect you to discuss when to use read‑only containers, volume mounts for write‑heavy workloads, and the trade‑off between storage efficiency and write performance.

How do you secure a Docker registry and what are best practices for image signing?

Secure a private registry with TLS certificates, enforce authentication (basic auth, LDAP, or OAuth), and enable access control lists. Use Docker Content Trust to sign images with Notary, ensuring provenance. Rotate keys regularly, scan images for vulnerabilities with tools like Trivy, and enforce least‑privilege policies for pull/push operations. Interviewers look for a comprehensive security posture covering transport security, auth, signing, and vulnerability management.

What are the benefits and drawbacks of using the `--privileged` flag?

`--privileged` grants the container all capabilities, disables seccomp, and gives access to host devices, effectively removing isolation. This can simplify debugging or allow hardware access, but it dramatically expands the attack surface and defeats many security controls. Interviewers expect you to discuss scenarios where it's justified (e.g., Docker-in-Docker) and to recommend alternatives like fine‑grained `--cap-add` and `--device` flags for least‑privilege access.