Docker Interview Questions

Q: What is the difference between an image and a container?

An image is a static, read-only blueprint made of layers. A container is a running instance of that image with an additional writable layer. Multiple containers can run from the same image simultaneously without interfering — they each have their own writable layer.

Q: What is the difference between CMD and ENTRYPOINT?

ENTRYPOINT sets the fixed executable that always runs. CMD provides default arguments that can be overridden at docker run time. When both are set, CMD becomes the default arguments to ENTRYPOINT. Using ENTRYPOINT ["node"] + CMD ["server.js"] means docker run myapp scripts/migrate.js replaces just the CMD.

Q: What are Docker layers and why do they matter?

Each instruction in a Dockerfile creates a new layer that is cached. If nothing in a layer changes, Docker reuses the cached layer — this makes builds fast. Layers are also shared between images using the same base, saving disk space. For this reason, order instructions from stable (infrequently changing) to volatile, and chain related commands in one RUN to minimize layer count.

Q: How do you reduce Docker image size?

• Use Alpine or Distroless base images

• Use multi-stage builds — exclude build tools from final image

• Chain RUN commands to avoid extra layers

• Clean up in the same RUN layer (rm -rf /var/lib/apt/lists/*)

• Use .dockerignore to exclude unnecessary files

• Only install production dependencies (npm ci --only=production)

Q: Named volume vs bind mount — when to use each?

Named volumes are managed by Docker, portable, and are the right choice for persistent data (databases, uploads) in production. Bind mounts map a specific host path and are ideal for development (live code reloading) but are host-dependent. tmpfs mounts are in-memory and are useful for sensitive data or high-performance scratch space.

Q: How does Docker Compose service discovery work?

Docker Compose creates a shared network for all services. Each service is reachable by its service name as a hostname (via Docker's embedded DNS). So if your service is named "db", you connect to it at postgres://user:pass@db:5432/mydb from any other container in the same network.

Q: What is Docker multi-stage build?

A Dockerfile can have multiple FROM instructions, each creating a separate stage. You can COPY --from=<stage> to pull only specific artifacts from a previous stage into the final image. This is used to compile code in a stage with build tools, then copy only the binary/output into a minimal runtime image.

Q: How do containers differ from VMs?

VMs virtualize hardware and run a full OS (hypervisor required, heavy, slow boot). Containers share the host OS kernel using Linux namespaces and cgroups for isolation — they are lightweight, start in milliseconds, and use far less memory. Containers are not as isolated as VMs (same kernel), but the trade-off is acceptable for most use cases.