Docker interview questions and answers for real engineering rounds
Docker questions in an interview are usually a production scenario disguised as a definition: why did this image become huge, why cannot one container reach another, why did a deployment lose data, or why does a build use an old dependency. The useful answer names the Docker primitive, says what it isolates or persists, and explains one trade-off. This guide follows the Docker documentation on containers and its multi-stage build guide.
How Docker questions appear in a live interview
You may get a Dockerfile to review, a service that cannot connect to its database, or a request to shrink a production image. Start by stating your assumption, then describe the boundary: process, filesystem, network or persistent data. That same approach helps in a code review round, a live coding interview, and a system-design follow-up.
Junior Docker interview questions
1. What is a container?
A container is an isolated process with the files and configuration it needs to run. It is not a miniature virtual machine: containers on one host share the host kernel, while a VM carries its own guest operating system. That makes containers lighter, but it also means the host and runtime still matter.
2. What is the difference between an image and a container?
An image is an immutable template with filesystem layers and metadata. A container is a running or stopped instance created from that image, with its own writable layer and runtime configuration. Rebuild an image to change the template; recreate a container to apply it.
3. What does a Dockerfile do?
A Dockerfile is a recipe for building an image. Instructions such as FROM, WORKDIR, COPY, RUN and CMD describe the base, filesystem, build steps and default process. A good answer distinguishes build-time steps from what runs when the container starts.
4. What is the difference between COPY and ADD?
Use COPY for local files in most Dockerfiles because its behaviour is explicit. ADD has extra behaviour such as extracting local tar archives and accepting remote URLs, which can hide work and make a build harder to reason about.
5. Does EXPOSE publish a port?
No. EXPOSE documents the port the image expects to listen on. Publishing is a runtime decision, for example docker run -p 8080:80 image, which maps a host port to a container port.
Mid-level Docker interview questions
6. Why does Docker build cache matter?
Docker can reuse a layer when its instruction and relevant inputs have not changed. Put stable dependency manifests before frequently edited application code so installing dependencies can be cached. Do not rely on the cache for correctness: a dependency update must still be represented in the build inputs.
7. What is the difference between a volume and a bind mount?
A named volume is managed by Docker and is a good default for durable service data. A bind mount maps a particular host path into the container and is convenient for local development. The trade-off is portability: a bind mount couples the container to one host filesystem layout.
8. How do containers communicate on one Docker network?
Containers attached to the same user-defined network can address each other by service or container name through Docker's internal DNS. The database need not publish a host port for the API to reach it; publishing is for clients outside that network.
9. Where should secrets go?
Not in a Dockerfile, image layer, source repository or ordinary environment file committed to Git. Inject secrets through the platform's secret mechanism at runtime, grant the smallest necessary access, and rotate a secret if it has reached an image or a log.
10. What is a health check for?
A health check tells the runtime whether the process is ready to serve its intended work, not merely whether its PID exists. A useful check is cheap, has a timeout, and verifies a dependency only when that dependency is essential to accepting traffic.
Senior Docker interview questions
11. Why use a multi-stage build?
Multiple FROM stages let the build stage contain compilers and package managers while the final stage copies only the runtime artifact. The result is generally smaller and has less tooling exposed in production. Name stages so COPY --from=build remains clear if the file changes.
12. How would you make an image smaller and safer?
Start from a suitable maintained base, copy only required files with a .dockerignore, use multi-stage builds, run as a non-root user where practical, and pin or regularly update dependencies according to the team's policy. Smaller is not automatically safer; provenance and patching matter too.
13. Why can a container lose data after restart?
The writable layer belongs to that container. Recreating it creates a fresh writable layer, so data written only there disappears. Put durable data in a volume, a managed database or another explicit persistence layer, then test a replacement rather than assuming restart behaviour.
14. How do you debug a container that starts and exits immediately?
Read the exit code and logs first, then inspect the configured command, environment and image entrypoint. A common cause is that the foreground process completed or failed; starting an interactive shell can help inspect the image, but the fix should make the intended main process stay in the foreground.
15. When is Docker not the whole deployment answer?
Docker packages a process. Production systems still need scheduling, networking, storage, configuration, observability, rollout and recovery decisions. In a system-design follow-up, explain which of those belong to the container image and which belong to the platform around it.
A concise answer shape
For a Docker scenario, say: the boundary that is involved, the primitive you would use, the trade-off, and how you would verify it. For example: a named volume persists database data beyond a container replacement; I would back it up and test restoring it, rather than treating a restart as proof.
Before any live assessment, ask the recruiter which tools and documentation are permitted. Knowing Docker concepts is useful; using unapproved tooling during an assessment is a separate policy question.
Sources
- Docker Docs: What is a container? — official documentation
FAQ
What Docker questions are common in interviews?
Containers versus VMs, images versus containers, Dockerfiles and layer caching, ports and networks, volumes, environment variables and secrets, multi-stage builds, image security, and debugging a failed container are common topics.
How do I explain Docker without memorising commands?
Name the boundary first: a container is an isolated process, an image is its template, a volume is durable data, and a network controls communication. Then give one production trade-off and a verification step.
What is the best answer to containers versus VMs?
Containers package isolated processes that share the host kernel. Virtual machines include a guest operating system and virtualised hardware. Containers are usually lighter; VMs provide a different isolation boundary.
Why are multi-stage builds useful?
They separate build tools from the final runtime image. The final stage copies only the artifact it needs, which usually reduces image size and the amount of tooling present in production.
Should I put secrets in Docker environment variables?
Do not bake secrets into a Dockerfile, image or committed environment file. Use the deployment platform's secret-management mechanism, scope access narrowly, and rotate any secret that was exposed.