Docker Interview Questions and Answers

Docker questions open almost every backend and DevOps interview. These are the ones asked most, from the basics to how you would keep an image small and secure.

Q1BeginnerBasics

What is the difference between an image and a container?

Short answer

An image is a read-only template - the app, its dependencies and configuration, built in layers from a Dockerfile. A container is a running instance of an image with its own writable layer on top. One image can run as many containers.

Terminal · Terminal

docker build -t myapp:1.0 .        # build an image from the Dockerfile
docker run -d --name web1 myapp:1.0  # start a container from it
docker run -d --name web2 myapp:1.0  # a second container, same image
docker ps                            # list running containers

Common mistake

Saying changes made inside a container change the image. They do not - they are lost when the container is removed, unless you use a volume or build a new image.

Likely follow-ups

What is an image layer, and why does layer order matter?
What happens to a container's data when it stops, and when it is removed?

Q2BeginnerBasics

How is a container different from a virtual machine?

Short answer

A virtual machine runs a full guest operating system on a hypervisor. A container shares the host's kernel and isolates only the process, using Linux namespaces and cgroups - so it starts in seconds and uses far less memory.

	Container	Virtual machine
Operating system	Shares the host kernel	Its own full guest OS
Start-up time	Seconds or less	Usually minutes
Size	Megabytes	Gigabytes
Isolation	Process-level (namespaces, cgroups)	Hardware-level (hypervisor)

Common mistake

Saying containers are always more secure than VMs. A VM gives stronger isolation, because a container shares the host kernel.

Likely follow-ups

What are namespaces and cgroups?
When would you still choose a VM over a container?

Q3IntermediateDockerfile

What is the difference between CMD and ENTRYPOINT?

Short answer

ENTRYPOINT sets the program the container always runs. CMD gives default arguments - or a default command - that anything passed to docker run replaces. Used together, ENTRYPOINT is the program and CMD its default arguments.

Dockerfile · Dockerfile

ENTRYPOINT ["java", "-jar", "/app/app.jar"]
CMD ["--server.port=8080"]

# docker run myapp                       -> java -jar /app/app.jar --server.port=8080
# docker run myapp --server.port=9090    -> java -jar /app/app.jar --server.port=9090

Use the exec form (a JSON array), as above. The shell form runs the program under /bin/sh, which then does not receive stop signals properly.

Common mistake

Using the shell form, so docker stop has to wait for its timeout and then kill the container instead of letting it shut down cleanly.

Likely follow-ups

How do you override an ENTRYPOINT at run time? (docker run --entrypoint.)
Why does PID 1 matter inside a container?

Q4BeginnerDockerfile

What is the difference between COPY and ADD?

Short answer

Both copy files into the image. ADD can also extract a local tar archive and fetch a URL. Prefer COPY - it does only what it says, so the build is predictable.

Dockerfile · Dockerfile

COPY target/app.jar /app/app.jar   # plain copy - the usual choice
ADD vendor.tar.gz /opt/vendor/      # copies AND extracts the archive

Common mistake

Using ADD for ordinary files out of habit. It hides behaviour - an archive gets unpacked whether you meant it or not.

Likely follow-ups

What is .dockerignore for?
Why copy dependency files before the source code?

Q5IntermediateStorage

What is the difference between a volume and a bind mount?

Short answer

A volume is storage Docker creates and manages, independent of the host's folder layout - the right choice for data like a database. A bind mount maps a specific host path into the container - handy in development to see code changes live.

Terminal · Terminal

docker volume create pgdata
docker run -d -v pgdata:/var/lib/postgresql/data postgres   # volume
docker run -d -v "$(pwd)/src:/app/src" myapp:dev            # bind mount

A third option, tmpfs, keeps data in memory only - useful for secrets or scratch files that must never reach disk.

Common mistake

Keeping database data only in the container's writable layer. It disappears when the container is removed.

Likely follow-ups

How do you back up a volume?
Who owns the files in a bind mount, and why can that cause permission errors?

Q6AdvancedDockerfilePerformance

How do you make a Docker image smaller?

Short answer

Use a multi-stage build so build tools never reach the final image, start from a slim base image, add a .dockerignore, and combine install-and-clean-up steps so caches do not stay in a layer.

Dockerfile (multi-stage, Spring Boot) · Dockerfile

# Stage 1: build with the full JDK and Maven
FROM maven:3.9-eclipse-temurin-17 AS build
WORKDIR /src
COPY pom.xml .
RUN mvn -B dependency:go-offline     # cached until pom.xml changes
COPY src ./src
RUN mvn -B -DskipTests package

# Stage 2: run with only a JRE
FROM eclipse-temurin:17-jre
WORKDIR /app
COPY --from=build /src/target/app.jar app.jar
ENTRYPOINT ["java", "-jar", "app.jar"]

The final image holds only the JRE and the jar. Maven, the JDK and the source code stay in the build stage and are thrown away.

Common mistake

Running apt-get install in one RUN and cleaning up in another. The deleted files still sit in the earlier layer, so the image is no smaller.

Likely follow-ups

Why copy pom.xml before the source code?
What is a distroless image, and what do you give up with one?

Answers describe documented behaviour, checked against the sources listed. Platforms change between releases - confirm limits and versions before an interview.