Docker Interview Prep Guide

Docker is a platform to build, ship, and run applications in lightweight containers. Benefits: portability, consistency, faster delivery, isolation.

Image = read-only blueprint (layers). Container = running (writable layer on top of image).

A declarative recipe to build an image using instructions like FROM, COPY, RUN, CMD, ENTRYPOINT.

docker build, docker pull, docker run, docker ps, docker stop, docker rm, docker rmi.

A registry stores images. Docker Hub is the default public registry; you can host private registries, too.

COPY copies local files. ADD also supports remote URLs and auto-extracts local tar files. Prefer COPY for clarity.

ENTRYPOINT defines the executable; CMD provides default args. Combine for flexible overrides. ENTRYPOINT ["app"] + CMD ["--flag"].

Persistent data storage managed by Docker. Types: named volumes, bind mounts, and tmpfs. Volumes decouple data from container lifecycle.

bridge (default, NAT), host (shares host network), none (no network), overlay (Swarm/K8s multi-host), macvlan (L2 with real MAC).

Use multiple FROM stages to compile in one stage and copy only artifacts to a minimal runtime stage → smaller, safer images.

Each instruction creates a layer. Cache is reused if the instruction and its context are unchanged. Put frequently changing steps later; group RUN commands; leverage --mount=type=cache in BuildKit.

• Use minimal base images (e.g., distroless, alpine where appropriate).
• Run as non-root (set USER).
• Don’t bake secrets into images; use secrets store.
• Regularly scan images (e.g., Trivy, Grype).
• Pin versions and verify signatures (cosign/Notary v2).

Configured via cgroups & namespaces. Use --cpus, --memory, --pids-limit; namespaces provide PID/NET/IPC/MNT/UTS/USER isolation.

Prefer runtime secret providers (Vault, AWS/GCP/Azure secret managers) or orchestrator secrets. With BuildKit: --secret for build-time, not baked into layers.

Excludes files from the build context to reduce image size and avoid leaking secrets (e.g., .git, node_modules).

Define with HEALTHCHECK in Dockerfile or --health-cmd at run time to let orchestrators know container readiness/liveness.

Compose: local multi-container dev; Swarm: simple clustering/orchestration; Kubernetes: full-featured orchestration at scale.

docker logs, docker exec -it, docker inspect, docker events, network checks (docker network ls/inspect), and minimal debug images (e.g., busybox).

Pin versions/digests; avoid apt cache bloat; use multi-stage; remove build deps; compress layers; prefer COPY --chown to fix perms without extra layers.

• Build once, tag immutably (app:1.4.2 + git SHA), push to registry.
• Scan images in pipeline; fail on high CVEs.
• Use BuildKit (DOCKER_BUILDKIT=1), buildx for multi-arch.
• Promote images across envs via tags (dev → qa → prod).

Place volatile steps (deps install with changing lockfiles, source copy) later. Copy lockfiles before source to maximize cache hits.

Bind mounts map host paths (great for dev, but host-dependent). Named volumes are managed by Docker (portable, safer defaults for prod data).

Use docker login, credentials helpers, or orchestrator secrets; restrict pulls by namespace; enable content trust/signing.

Avoid mutable latest in prod; use immutable digests (@sha256:…) or versioned tags to ensure deterministic deploys.

To reduce privilege on shared hosts/CI. Trade-offs: some networking/storage features differ; good security hardening measure.