Docker interview questions

Model answer

A VM virtualizes hardware and runs a full guest operating system on a hypervisor, so it is heavy and slow to start. A container is an isolated process that shares the host kernel using namespaces and cgroups, so it starts in milliseconds and uses far fewer resources. Containers package the app and its dependencies but not a full OS, which is why they are smaller and more portable.

Model answer

Each instruction in a Dockerfile creates a read-only layer, and layers stack into the final image. Docker caches each layer and reuses it on the next build if the instruction and its inputs are unchanged. To maximize cache hits, order instructions from least to most frequently changing, for example copy the dependency manifest and install before copying source code.

Model answer

Use a small base image such as Alpine or distroless, use multi-stage builds so only the final artifact ships, combine and clean up package installs in a single RUN, copy only what you need, and use a dotignore file to keep build context lean. A multi-stage build that compiles in a fat builder and copies the binary into a minimal runtime is usually the biggest win.

Model answer

ENTRYPOINT defines the executable that always runs, while CMD provides default arguments that are easy to override at runtime. A common pattern is ENTRYPOINT for the binary and CMD for default flags, so users can pass their own arguments without retyping the command. Both should use the exec form, a JSON array, to avoid an extra shell process.

Model answer

Containers are ephemeral, so anything written to the container layer is lost when the container is removed. Use volumes for data that must persist, which Docker manages outside the container lifecycle, or bind mounts to map a host directory in, which is handy in development. For databases, always use a named volume.

Model answer

Place them on the same user-defined bridge network and they can reach each other by container name, since Docker provides built-in DNS resolution. The default bridge network does not give name resolution, so always create a user-defined network for multi-container apps, which is exactly what Compose does for you.