Intermediate Docker Interview Questions and Answers

Each Dockerfile instruction creates a read-only layer of file changes. Layers are stacked, cached, and shared between images. A running container adds a thin writable layer on top.

Docker reuses a layer if the instruction and its inputs are unchanged. Once one step changes, all later steps rebuild. So copy dependency files and install them before copying code.

Use a slim or Alpine base, multi-stage builds, and a .dockerignore. Combine install and clean-up in one RUN, and do not install what you do not need.

A Dockerfile with several FROM stages. You build in one stage, then COPY --from only the result into a small final image, which leaves compilers and source code behind.

It excludes files from the build context, such as node_modules, .git and .env. This makes builds faster, and keeps secrets out of images.

Layers only add. The file remains in the earlier layer. Delete it in the same RUN that created it.

ARG exists only during the build, and is set with --build-arg. ENV is available during the build and in the running container. Neither is safe for secrets.

CMD ["node", "app.js"] makes your app PID 1, so it receives signals such as SIGTERM. The shell form runs through sh, which may not pass signals on, so docker stop waits and then kills it.

no, on-failure, always and unless-stopped. They tell Docker when to restart a container after it exits or the daemon restarts.

A command that Docker runs regularly to test whether the app works. The status is starting, healthy or unhealthy. Plain Docker only reports it, but Compose and orchestrators can act on it.

The process was killed by SIGKILL (128 + 9), usually by the out-of-memory killer, or by docker kill. Check OOMKilled in docker inspect.

Check docker ps -a for the exit code, and docker logs for messages. Run the image with a shell, such as docker run -it --rm image sh, or override the entrypoint to look inside.

With --memory and --cpus on docker run, or mem_limit and cpus in Compose.

bridge is a private network on one host, and is the default. host shares the host's network. none has no networking. overlay connects containers across hosts.

User-defined networks have an embedded DNS server, at 127.0.0.11, which resolves container and service names. The default bridge network does not offer this.

Plain depends_on only controls start order. condition: service_healthy waits until the dependency passes its health check, which matters for databases.

It removes the containers and networks, and also the named volumes, which deletes the data.

Pass it at run time, not in the image. Environment variables work, but they can be seen with docker inspect. Mounted secret files are better, using Compose secrets, Kubernetes Secrets or a cloud secrets manager.

Bind-mount the source into the container and run a watching server, or use docker compose watch. Use an extra volume so that the mount does not hide node_modules.

With the commit ID and a release version, so that each image can be traced and rolled back. Avoid deploying latest.