Interview Prep Guide

Docker Production Operations Interview Questions

Docker questions on secure builds, image supply chains, runtime limits, networking, debugging, caching, and production operations.

Applied Docker Questions

How does Docker layer caching affect build design?
Stable expensive steps should occur before frequently changing files, with precise copy boundaries and lockfiles to keep caching correct.
What should a useful .dockerignore contain?
Exclude source-control data, local dependencies, build output, secrets, logs, caches, and files not required by the build context.
How should a container receive configuration and secrets?
Keep environment-specific configuration outside the image and inject secrets at runtime through an appropriate protected mechanism.
What is the difference between ENTRYPOINT and CMD?
ENTRYPOINT defines the executable behavior while CMD supplies default arguments or a replaceable default command.
How do Docker networks support multi-container applications?
User-defined networks provide scoped connectivity and service-name discovery while published ports expose selected services outside that network.

How do you build a minimal and secure container image?
Use a trusted minimal base, multi-stage builds, pinned dependencies, non-root execution, no embedded secrets, scanning, and signed provenance.
How should CPU and memory limits be used for containers?
Set evidence-based requests and limits, understand throttling and out-of-memory behavior, and align application concurrency and heap settings.
How do signals and PID 1 behavior affect container shutdown?
The main process must receive and handle termination signals, reap children where needed, and complete bounded cleanup before the grace period ends.
What is image provenance and why does it matter?
Provenance records how an image was built and from which inputs; signatures and attestations help verify trusted artifacts through the supply chain.
How would you debug a container that exits immediately?
Inspect exit status and logs, verify command and architecture, compare configuration, override entrypoint safely, and reproduce the exact image.

A container works locally but cannot reach a production dependency. What do you check?
Compare DNS, routes, proxies, certificates, network policy, credentials, environment values, and the exact deployed image.
Your image suddenly grows by 800 MB. How do you investigate?
Compare layer history and build context, inspect changed dependencies and artifacts, then remove the responsible layer with a reproducible build fix.
A container is repeatedly killed for memory. What is your response?
Confirm OOM evidence, profile application memory, inspect concurrency and limits, bound caches or work, and change capacity only with measurements.
How would you patch a critical vulnerability in a widely deployed base image?
Assess exposure, update and rebuild through the controlled pipeline, test, scan, sign, roll out progressively, and verify old images are no longer running.

How would you reduce the attack surface of a production container?
Use a minimal trusted base, remove build tools, run without root, keep the filesystem read-only where possible, drop capabilities, scan dependencies, and patch through rebuilt images.