1. What is Docker?

Answer:
Docker is an open-source containerization platform used to build, package, and run applications inside lightweight, portable containers. It helps manage the entire lifecycle of containers — building images, running containers, pushing/pulling images from registries, etc.

You can add:
“In my projects, I use Docker to write Dockerfiles, build images, run containers, optimize image size, and push artifacts to registries like Docker Hub/ECR.”

2. How are Containers different from Virtual Machines?

Answer:

Containers	Virtual Machines
Lightweight	Heavyweight
Share the host OS kernel	Have full guest OS
Start in milliseconds	Start in minutes
Only need application + dependencies	Need OS + kernel + libraries
Image size is small (MBs)	Large images (GBs)

Never say containers “don’t have an OS” — correct answer is:
They include only minimal system libraries, not a full OS.

3. Explain the Docker Lifecycle.

Answer:
The Docker lifecycle includes:

Write Dockerfile
Build image → docker build
Run container → docker run
Tag & Push image to registry (Docker Hub, ECR, GCR)
Pull image on any environment
Manage containers (start/stop/remove/prune)

4. What are the main Docker components?

Answer:

Docker Client (CLI) – sends commands
Docker Daemon – core engine that executes actions
Docker Images – read-only templates
Docker Containers – running instances of images
Docker Registry – stores images (Docker Hub, ECR, private registry)

Daemon is the “heart” of Docker — if it stops, Docker actions cannot be executed.

5. Difference between `COPY` and `ADD` in Dockerfile?

Answer:

COPY – Copies files/folders from local machine → image (preferred)
ADD – Same as COPY + supports downloading from URL or auto-extracting archives.

Use COPY unless you specifically need ADD’s special features.

6. Difference between `CMD` and `ENTRYPOINT`?

Answer:

CMD	ENTRYPOINT
Provides default arguments	Provides main executable
Can be overridden using CLI	Not overridden by default
`docker run image ls` → ls replaces CMD	`docker run image ls` → ls becomes argument

Best practice: Use ENTRYPOINT for the main command and CMD for default arguments.

Example:

ENTRYPOINT ["python", "app.py"]
CMD ["--port", "8000"]

7. What are Docker networking types? What is the default?

Answer:

bridge – default network for containers
host – container shares host network
overlay – used in multi-host (Swarm/Kubernetes)
macvlan – container appears as a physical device on network
none – no network

8. How do you isolate networking between containers?

Answer:
Create a custom bridge network:

docker network create secure_net
docker run --network secure_net ...

Containers on different networks cannot talk to each other unless explicitly connected.

9. What is a Multi-Stage Docker Build?

Answer:
It allows you to use multiple FROM statements and copy only the required build artifacts into the final image.

Why?

Reduces image size
Removes build tools from production image
Improves security

Example: Reduce image from ~800MB → 1MB using scratch/alpine.

10. What are Distroless Images?

Answer:
Distroless images (e.g., gcr.io/distroless/...) are minimal images that contain only:

your application
required runtime dependencies

They do not contain:
❌ shell (sh, bash)
❌ package managers (apt, yum)
❌ OS utilities (ping, curl)

Benefit:
Extremely secure, tiny, no attack surface.

🔥 Real-Time Docker Challenges (Must-Know for Interviews)

1. Docker Daemon – Single Point of Failure

Docker daemon is one single process
If daemon crashes → containers may stop or fail

Modern solution: Podman (daemonless, rootless).

2. Docker Daemon Runs as Root

By default, daemon runs with root privileges
If a container is compromised, host becomes vulnerable

Solution:

Use rootless Docker
Use Podman (runs fully rootless)
Always set USER in Dockerfile

3. Image Size Issues

Developers often install unnecessary tools
Leads to huge (GB-sized) images
Slow deploys, security risks

Solutions:

Multi-stage builds
Distroless images
Base images like alpine

4. Networking Misconfigurations

Wrong port mappings
Misuse of host network
Containers unintentionally communicating

Solution:
Custom networks & proper isolation.

5. Security Vulnerabilities

Using outdated base images
Running containers as root
Storing secrets inside images

Solution:

Scan images (Trivy, Anchore)
Use secrets manager
Use non-root user in Dockerfile

Day 19 - Docker Interview Q&A

Comments

DevOps

Day 20 - Kubernetes Introduction

More from this blog

Day 32 - Kubernetes Interview Q&A

Day 31 - KUBERNETES MONITORING USING PROMETHEUS & GRAFANA

Day 30 - Kubernetes ConfigMaps & Secrets

Day 29 - Kubernetes Custom Resources

Day 28 - Kubernetes Service, Ingress, TLS & Ingress Controllers

1. What is Docker?

2. How are Containers different from Virtual Machines?

3. Explain the Docker Lifecycle.

4. What are the main Docker components?

5. Difference between `COPY` and `ADD` in Dockerfile?

6. Difference between `CMD` and `ENTRYPOINT`?

7. What are Docker networking types? What is the default?

8. How do you isolate networking between containers?

9. What is a Multi-Stage Docker Build?

10. What are Distroless Images?

🔥 Real-Time Docker Challenges (Must-Know for Interviews)

1. Docker Daemon – Single Point of Failure

2. Docker Daemon Runs as Root

3. Image Size Issues

4. Networking Misconfigurations

5. Security Vulnerabilities

Command Palette

Comments

DevOps

Day 20 - Kubernetes Introduction

More from this blog

1. What is Docker?

2. How are Containers different from Virtual Machines?

3. Explain the Docker Lifecycle.

4. What are the main Docker components?

5. Difference between COPY and ADD in Dockerfile?

6. Difference between CMD and ENTRYPOINT?

7. What are Docker networking types? What is the default?

8. How do you isolate networking between containers?

9. What is a Multi-Stage Docker Build?

10. What are Distroless Images?

🔥 Real-Time Docker Challenges (Must-Know for Interviews)

1. Docker Daemon – Single Point of Failure

2. Docker Daemon Runs as Root

3. Image Size Issues

4. Networking Misconfigurations

5. Security Vulnerabilities

5. Difference between `COPY` and `ADD` in Dockerfile?

6. Difference between `CMD` and `ENTRYPOINT`?