DEVPREP CODEX · #06

Docker Interview Questions

150 curated questions graded from Foundations (Easy) to Practical Patterns (Medium) and Internals & Architecture (Hard).

TOTAL QUESTIONS

150

THEORY QUESTIONS

150

IMPLEMENTATION FOLIOS

FREE QUESTIONS

5 / Level

Easy Level·50 Questions Total

Foundations & Core Concepts

Open Full Easy List

Q1What is Docker? How does it differ from a Virtual Machine (VM)?

Docker: A containerization platform that packages apps and dependencies into lightweight, portable containers sharing the host OS kernel.
Virtual Machine: Runs a complete guest OS on virtualized hardware via a hypervisor.
Key Differences:
- OS Kernel: Docker shares the host kernel; VMs have independent guest kernels.
- Size: Containers are megabytes; VMs are gigabytes.
- Startup: Containers boot in milliseconds; VMs take minutes.
- Overhead: Containers have near-zero overhead; VMs suffer high CPU/RAM virtualization tax.

Q2Explain the differences between an Image and a Container.

Docker Image: An immutable, read-only template containing code, runtime, libraries, and config. Acts as the blueprint (class in OOP).
Docker Container: A runtime instance of an image. Represents an isolated process running on the host (object in OOP).
Writable Layer: A container adds a thin, temporary writable layer on top of the image's immutable layers to store modifications.

Q3What is the purpose of the FROM directive in a Dockerfile?

Base Image: Specifies the starting parent image (e.g., FROM alpine:3.18) for subsequent instructions.
Position: Must be the first non-comment instruction (unless defining build-time variables via ARG first).
Multi-stage: Can appear multiple times in a single Dockerfile to initiate new build stages.

Q4Explain the difference between RUN, CMD, and ENTRYPOINT.

RUN: Executes commands during the build phase to install packages and create new image layers.
CMD: Defines default runtime commands/arguments that can be easily overridden by appended arguments in docker run.
ENTRYPOINT: Configures a container to run as an executable. Appended arguments in docker run are added to the entrypoint rather than overriding it.

Q5How do COPY and ADD differ in a Dockerfile?

COPY: Safely copies local files or directories from the host context into the container filesystem. (Preferred for standard copies).
ADD: Has two additional features:
- Can fetch files from remote URLs.
- Automatically extracts compressed tar/gzip/zip files into the container destination.

45 More Easy Questions Locked

Unlock the complete Docker Easy question bank

Get instant access to all 50 questions, in-depth model answers, code sandboxes, and all 27+ technologies for a single one-time payment.

Unlock All — One-time payment · Lifetime access

Medium Level·50 Questions Total

Mechanisms & Practical Patterns

Open Full Medium List

Q1Detail the architecture of the Docker Engine.

Client-Server Architecture: Composed of three primary parts:
- Docker Client (docker): The CLI tool that accepts user commands and communicates with the daemon over a REST API (via Unix sockets or TCP).
- Docker Daemon (dockerd): A background service that listens for API requests and manages Docker objects (images, containers, networks, volumes).
- Containerd & Runc: The daemon relies on containerd (container lifecycle management) which spawns runc (the lightweight OCI-compliant runtime) to create and run containers.

Q2How does BuildKit differ from the legacy Docker builder?

BuildKit: The modern, highly optimized build engine (enabled via DOCKER_BUILDKIT=1).
Advantages over legacy:
- Parallel Execution: Builds independent stages concurrently.
- Cache Mounts: Supports mounting compilation caches (RUN --mount=type=cache) that persist between builds.
- Secrets Mounts: Mounts build secrets (RUN --mount=type=secret) securely without baking them into final image layers.
- Garbage Collection: Intelligent, automatic cleanup of intermediate build states.

Q3Explain how Docker image layers work and how they share space.

Union File System (UnionFS): Docker images are stacked layers where each layer represents a instruction in the Dockerfile.
Layer Immutability: Each layer is read-only.
Storage Sharing: If multiple images share the same parent layer, that layer is stored only once on disk.
Writable Layer: At runtime, Docker adds a thin, writable container layer. Read operations fall back to the image layers, while modifications copy the file up to the writable layer (Copy-on-Write).

Q4Explain the HEALTHCHECK directive and its parameters.

Purpose: Instructs Docker how to test a container to verify it is actively functioning (not just running as a zombie process).
Key Parameters:
- --interval=30s: Time between checks.
- --timeout=5s: Maximum time allowed for a single check.
- --start-period=10s: Initial grace period for slow-starting apps.
- --retries=3: Number of consecutive failures before marking as unhealthy.
Exit Codes: The test script must exit with 0 (healthy) or 1 (unhealthy).

Q5How do Docker networks handle service discovery?

Embedded DNS: Docker runs an internal DNS server at 127.0.0.11 inside each container.
Service Name Resolution: Within a user-defined network, containers resolve neighboring container IPs by using their container names or network aliases.
Limitation: The default bridge network does not support embedded DNS and requires outdated --link flags.

45 More Medium Questions Locked

Unlock the complete Docker Medium question bank

Get instant access to all 50 questions, in-depth model answers, code sandboxes, and all 27+ technologies for a single one-time payment.

Unlock All — One-time payment · Lifetime access

Hard Level·50 Questions Total

Internals & System Architecture

Open Full Hard List

Q1Describe the container runtime stack beneath the Docker daemon.

Architecture: Docker has evolved from a monolithic daemon into a modular, decoupled OCI-compliant execution stack:
- Docker Daemon (dockerd): Exposes the high-level API, manages images, networks, volumes, and handles authentication.
- Containerd: An industry-standard container supervisor. It manages the full container lifecycle, including snapshotting, image transfers, and execution states.
- Containerd-Shim: A tiny monitor process spawned for each container. It keeps the stdout/stderr streams open, reports exit codes, and maintains the container execution state even if dockerd or containerd restarts, preventing container termination.
- Runc: A lightweight, CLI-based OCI runtime. It receives the bundle configuration from containerd, interacts with the Linux kernel namespaces/cgroups to spawn the isolated processes, and exits immediately.

Q2How does container escape occur at the kernel level? Give examples.

Mechanism: Occurs when a process running inside a container bypasses namespace isolation and cgroup boundaries, gaining direct access to the host kernel or host file system.
CVE-2019-5736 (runc): An attacker with container root access overwrote the host runc binary during a docker exec execution, allowing arbitrary host execution upon subsequent runc invocations.
CVE-2024-21626 (runc): Leveraged open file descriptors pointing to the host's /sys/fs/cgroup directory. By changing the working directory to /proc/self/fd/[ID], a process could escape the container root directory during initialization.
Mitigation: Run containers with --user (non-root), drop dangerous capabilities, and enforce strict AppArmor/Seccomp profiles.

Q3Explain the inner workings of User Namespaces (userns) and UID/GID mapping.

Concept: Maps the root user (UID 0) inside a container to an unprivileged, high-numbered UID (e.g., UID 100000) on the host machine.
Configurations: Handled by /etc/subuid and /etc/subgid files, which define blocks of subordinate UIDs/GIDs allocated to users:
- dockersub:100000:65536 grants the user dockersub 65,536 system UIDs starting at 100000.
Benefit: If a containerized process is compromised and escapes, it possesses root permissions only within its isolated namespace and is treated as an unprivileged user on the host, preventing host takeover.

Q4Detail the network routing path for a packet traveling from a container to the external internet.

Step 1 (Internal): The container process writes to its virtual network interface eth0.
Step 2 (Veth Pair): The packet travels across a veth (Virtual Ethernet) pair, exiting the container’s private network namespace and entering the host namespace via a virtual interface starting with veth....
Step 3 (Bridge): The host veth interface is attached to a virtual bridge interface (like docker0). The bridge switches the packet to the host network stack.
Step 4 (Routing & iptables): The host kernel routes the packet. It matches a Post-Routing NAT (Network Address Translation) rule in iptables (the MASQUERADE target), which rewrites the packet’s source IP from the container's private IP to the host's physical network IP.
Step 5 (Physical NIC): The packet is forwarded out of the host's physical network interface card (e.g., eth0) to the physical gateway.

Q5What is the OCI specification and why is it critical?

Open Container Initiative (OCI): A governance structure established by Docker and industry partners to standardize container formats and runtimes.
Core Specs:
- Image Specification: Defines the base layout, layers, manifests, and configuration file format for an image.
- Runtime Specification: Standardizes the execution lifecycle and filesystem bundles, ensuring any compliant runtime (e.g., runc, crun, gVisor) can run any OCI-compliant image.

45 More Hard Questions Locked