Docker Interview Questions and Answers

A Docker image is a stack of read-only layers. Each Dockerfile instruction creates a layer, and layers are shared between images and cached.

Build cache:

• Docker checks each instruction in order. If the instruction and its inputs, such as copied files or the base image, are unchanged, it reuses the cached layer.
• The first changed instruction invalidates that layer and all following layers.

COPY package*.json ./
RUN npm ci --omit=dev
COPY . .

Copy dependency manifests and install dependencies before copying source so those layers stay cached when only code changes. Combine related RUN commands and clean caches in the same layer. Use a .dockerignore to avoid sending large or changing files that bust the cache. Multi-stage builds reuse layers across stages and keep the final image lean.

Both persist data outside the container's writable layer, but they are managed differently.

• Volumes are stored in a Docker-managed location under /var/lib/docker/volumes. Docker creates and manages them, they work identically on any host, and they are the recommended way to persist data. Volumes support drivers for remote or cloud storage.
• Bind mounts map an arbitrary host path into the container. They depend on the host filesystem layout, are great for development such as mounting source code, and can modify host files.

docker volume create appdata
docker run -d -v appdata:/var/lib/postgresql/data postgres
docker run -d -v "$(pwd)/src:/app/src" node:20

Use volumes for databases and production state, and bind mounts for local development and configuration. tmpfs mounts keep data in memory for sensitive scratch data.

Docker creates network namespaces and connects containers using drivers.

• bridge (default): containers get private IPs on a virtual bridge. Same-network containers resolve each other by name, and external access needs port publishing. User-defined bridges provide automatic DNS.
• host: the container shares the host network stack, so there is no isolation and no port mapping. Best performance, but port conflicts are possible.
• none: no networking except loopback.
• overlay: spans multiple Docker hosts for Swarm services.
• macvlan: assigns a MAC address so containers appear as physical devices on the LAN.

docker network create app-net
docker run -d --network app-net --name api api:1.0
docker run -d --network app-net --name web web:1.0

Prefer user-defined bridge networks over the default bridge for service discovery, and use host mode only when you need raw performance or non-HTTP protocols.

A multi-stage build uses several FROM stages in one Dockerfile. You can compile in an early stage and copy only the artefacts into a minimal final stage.

FROM golang:1.22 AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -o /app/server .

FROM gcr.io/distroless/static
COPY --from=build /app/server /server
ENTRYPOINT ["/server"]

Benefits:

• Much smaller final images because build tools, compilers, and source are not shipped.
• A smaller attack surface and fewer CVEs.
• Faster pulls and less registry storage.
• Cleaner separation of build and runtime concerns.

Each stage can be targeted for debugging with --target. Use distroless or alpine base images for the runtime stage, and pin versions for reproducible builds.