78 Docker & Kubernetes interview questions with detailed answers, sorted from basic to advanced. Free to practice, with progress saved automatically.
Docker packages an application and its dependencies into containers, and Kubernetes schedules and manages those containers across a cluster. The bank covers images and multi-stage builds, Compose and networking, containers versus virtual machines, workload controllers, health probes, resource limits and QoS, service mesh, troubleshooting, and operational security.
and 24 more topics.
Docker packages an app together with its dependencies into a container so it runs the same everywhere. Containers vs VMs: a VM virtualizes hardware, so it is heavy, carries its own OS and boots in minutes; a container shares the host kernel, so it is…
A Dockerfile is a script describing how to build an image, and every instruction becomes a cached layer. The most important rule: put the things that rarely change first. - Layer caching: when source changes but package.json does not, Docker reuses the cached npm ci…
Docker packages an app together with its runtime and dependencies into an image; running that image gives you a container. An image built once behaves the same on a dev machine, in CI and in production, which ends "works on my machine". For frontend work,…
Docker solves the problem of an app working on one machine but failing on another because of different runtime versions, libraries or config. Docker packages the app together with all of those into an image; any machine with Docker runs that image as an identical…
An image is a read-only package; a container is one run of that image, with an extra layer of its own to write to. It is like the relationship between a class and an object: one image creates many containers. Image Container --------- What it…
Each Dockerfile instruction creates a layer or metadata step: RUN, COPY, ADD change the filesystem and create a new layer; ENV, WORKDIR, CMD only add metadata to the image. Docker can reuse cache when the instruction and related context have not changed (for COPY, that…
ENTRYPOINT defines the main program the container always runs. CMD provides default arguments (or a default command when there is no ENTRYPOINT) and is replaced as soon as docker run passes args. They work well together when the image has one main binary and default…
COPY and ADD both put files from the build context (the directory you pass to docker build, usually .) into the image. COPY only copies. ADD also copies, but it adds two implicit behaviors. Line two: ADD recognizes the tar file in the context and…
Multi-stage builds separate the build stage from the runtime stage. The build stage contains compilers, dev dependencies and temporary artifacts; the runtime stage copies only what is needed to run. The result is a smaller image, less security surface and faster deploys. Example with Next.js…
The build context is the whole directory you pass to docker build .. Docker sends all of it to the builder, and COPY/ADD can only take files that are inside it. .dockerignore is a file at the root of the context that lists what to…
Each container has its own network namespace, which means a private network with its own localhost. There are two different situations. Access from the host machine. A service listens on port 8000 inside the container, but the host cannot see that port until you publish…
Environment variables fit non-sensitive configuration such as NODEENV, service URLs or log level. Secrets (passwords, API keys) should reach the container as a file, not as an env var, because env vars leak more easily: - Through Docker: docker inspect prints the whole env of…
HEALTHCHECK tells Docker whether the app is actually healthy, because a live process does not guarantee the app can still serve (it may hang, deadlock or lose its database connection). It can call an internal endpoint, check a port or run a lightweight command. Example:…
A tag is a readable label such as app:1.2.0 or app:latest, and it can be moved to a different image at any time (push a new image under the same tag). A digest is a SHA-256 hash computed from the image content, so one digest…
Containerized apps should log to stdout/stderr so the platform can collect logs (docker logs, kubectl logs, or a log-collecting agent). Log files inside the container are hard to aggregate, and they live in the writable layer, so they disappear when the container is removed or…
Deployment, ReplicaSet, StatefulSet and DaemonSet are all controllers that keep a group of Pods running as declared. They differ in how they treat each individual Pod. Deployment StatefulSet DaemonSet ------------ Pods Identical and interchangeable Each Pod has its own identity (db-0, db-1) One Pod per…
- ClusterIP (default): allocates a virtual IP reachable only from inside the cluster, used for service-to-service calls. - NodePort: on top of a ClusterIP, opens the same port (by default in the 30000-32767 range) on every node; calling <node IP:<nodePort from outside reaches the Service.…
Ingress defines HTTP/HTTPS rules for traffic from outside the cluster to Services inside the cluster, usually based on host/path. Ingress is only a Kubernetes resource; an Ingress Controller such as Traefik, HAProxy or a cloud provider controller is needed to enforce the rules. Unlike a…
The three probes answer three different questions, and a failure has a different consequence for each: - Readiness: is the Pod ready to receive traffic? On failure the Pod is removed from the Service endpoints, so it gets no new requests, but it is not…
A request is the minimum amount of resources a Pod asks for. The scheduler sums the requests of Pods already on a node and only places a new Pod on a node with enough room, so it relies on requests, not on actual usage. A…
A Deployment rolling update gradually replaces old Pods with new Pods. Low downtime needs a correct readiness probe, low maxUnavailable, suitable maxSurge, graceful shutdown and app SIGTERM handling. Example: If readiness reports ready too early or shutdown does not drain requests, a rolling update can…
A label is a key-value pair attached to an object (Pod, Node, Service...). A selector is a label-based filter that lets Services, Deployments, NetworkPolicies or kubectl pick the right group of objects. Kubernetes stores no hard link like "this Pod belongs to that Service": the…
- A PersistentVolume (PV) is a real piece of storage registered with the cluster (EBS, Persistent Disk, NFS…), living independently of any Pod. - A PersistentVolumeClaim (PVC) is a workload's request for storage: "I need 10Gi, read-write from one node". The Pod only references the…
An init container runs before the app containers in the same Pod, one at a time in order: the next one starts only after the previous one exits successfully, and the Pod is not Ready until all have finished. If an init container fails, the…
imagePullPolicy decides whether kubelet (the agent on each node) pulls the image from the registry before starting a container. There are three values: - Always: every container start asks the registry. If the digest on the node matches the registry, the cached copy is used…
Helm and Kustomize both let you reuse one set of manifests across environments (dev, staging, prod) without copying YAML into several versions. They differ in how: - Helm writes manifests as a chart with placeholders like {{ .Values.replicas }}. Each environment has a values.yaml file…
Work from the outside in: what state the Pod is in, what events Kubernetes recorded, what errors the app itself printed, and only then the network. Example: - get pods: the STATUS column (Pending, CrashLoopBackOff, ImagePullBackOff…) and RESTARTS tell you which stage the Pod fails…
Docker Compose describes and runs the several containers of an application on one machine, from a single YAML file. Kubernetes is an orchestration system: it coordinates containers across a cluster of machines, deciding which machine each container runs on and keeping the system matching the…
A VM virtualizes hardware: each VM runs a full guest OS on a hypervisor. A container virtualizes at the OS level: many containers share the host kernel, and each container only packages the app with its dependencies and its own userspace. Consequences: - Size /…
Docker does not run a hypervisor. It builds on two Linux kernel feature groups: - Namespaces — isolate a process's view. Each container gets its own namespaces for pid (process list), net (interfaces, IP, ports), mnt (filesystem), uts (hostname), ipc and user. A process inside…
Docker has seven states (docker ps -a shows them in the STATUS column, and you can filter with --filter status=...): - created — the container was created from an image but not started; no process is running. - running — the main process (PID 1)…
A restart policy decides whether Docker restarts a container when it exits or when the daemon restarts. Set it with --restart: - no (default) — never restart automatically. - on-failure[:N] — restart only when the container exits with a non-zero code (an error); you can…
Docker uses cgroups to cap resources at runtime. By default a container uses nearly unlimited resources, so on a multi-container host you should set explicit limits. Memory: - --memory (hard limit): exceeding it makes the kernel OOM-kill a process inside the container. - --memory-reservation (soft…
A taint is placed on a node to repel Pods: by default Pods will not be scheduled onto that node. A toleration is placed on a Pod to say it accepts a specific taint, letting it land on the tainted node. A taint has the…
These are rules that attract Pods to the right place, complementing taints (which repel). - Node affinity — select nodes by node labels. A more expressive replacement for nodeSelector, it supports hard and soft conditions. Example: run only on disktype=ssd nodes, or prefer zone=a. -…
The scheduler watches for Pods with no node yet (empty nodeName) and, for each Pod, runs two phases: 1. Filtering (predicates) — eliminate nodes that cannot run the Pod. It checks: does the node have enough CPU/memory for the requests, does it satisfy nodeSelector/node affinity,…
Infrastructure as Code (IaC) means managing infrastructure (servers, networks, DNS, clusters...) with version-controlled configuration files instead of clicking through a console. Benefits: reproducibility, review via pull request, a change history, and rebuilding identical environments. Terraform and Ansible are often compared but aim at slightly different…
Because Docker's build cache is invalidated in order: once an instruction is considered changed, every layer after it is rebuilt. If you copy the whole source first and then run npm install, editing a single line changes the directory checksum → the COPY layer misses…
Alpine is tiny (~5 MB) but uses musl libc instead of glibc, which is the source of most of its problems: - Node: native modules need a binary prebuilt for musl. Big packages such as sharp or esbuild ship musl builds, but smaller packages often…
Disk is usually consumed by four groups: unused images, stopped containers, orphaned volumes, and build cache. Inspect before deleting: By default docker system prune removes stopped containers, networks not used by any container, dangling images (<none images whose tag moved), and dangling build cache. It…
Use the service name as the hostname: db:5432. Inside a container, localhost refers to that container itself, not the host machine or another container — each container has its own network namespace. Compose creates a user-defined bridge network for the project with built-in DNS, so…
Shell form (CMD npm start) is wrapped into /bin/sh -c "npm start" → the shell becomes PID 1, with npm and the app below it. Exec form (CMD ["npm", "start"]) runs the first binary directly, with no shell → npm is PID 1 and node…
docker stop sends SIGTERM, waits 10 seconds (default), then sends SIGKILL. Hanging for the full 10 seconds means nothing handled SIGTERM. Three common causes: 1. PID 1 is a shell — shell form, or a start.sh without exec, so sh holds PID 1 and never…
The idea: the build stage holds the toolchain, the runtime stage holds only the artifact. Only the final stage's layers end up in the exported image — everything from earlier stages (devDependencies, compilers, TS sources) is left behind. What gets cut: devDependencies (usually the bulk…
Because ARG values and every RUN command are recorded in the image metadata. Anyone holding the image can read them back: Deleting the file in a later layer does not help: layers are immutable and additive, so anything written in an earlier layer stays in…
By default the container process runs as root (uid 0), and that uid is the same root as on the host — namespaces isolate processes and networking, not users (unless user-namespace remapping is enabled). If an attacker escapes the container or a bind mount points…
Because HEALTHCHECK and restart policies are independent mechanisms. A restart policy only reacts when the main process exits (non-zero exit code, or any exit code with always). If a container is unhealthy while its process is still alive, the Docker Engine only changes the status…
Because the bind mount .:/app shadows the entire /app directory from the image with the host directory — including the nodemodules installed at build time. The host has no nodemodules (or one built for a different OS), so the app cannot resolve modules. The fix…
The container is running, but its readiness probe has not passed, so the Pod is not considered ready to serve traffic. The two columns report different things: - STATUS = the Pod lifecycle phase (Pending, Running, Succeeded...). Running only means containers were started. - READY…
An Ingress is only a routing rule description — it does not handle requests itself. It takes effect only when an Ingress controller is running in the cluster (ingress-nginx, Traefik, HAProxy, or a cloud provider controller). Checklist when an Ingress "does nothing": 1. Is a…
A Pod has no self-healing on its own. If you create a bare Pod and the node dies or the Pod is deleted, nothing recreates it — the application is simply gone. A Deployment adds four things a bare Pod lacks: - Self-healing: through a…
Use kubectl port-forward — it opens a tunnel from a local port to a Pod/Service inside the cluster through the API server, so no firewall change or public Service is needed. Things to remember: - It lives only while the command runs — a debug/dev…
When a liveness probe fails, the kubelet kills and restarts the container. So if the probe checks the wrong thing, the system tears itself down. Two common mistakes: 1. The health endpoint checks dependencies too. If /health queries the DB and the DB is 5…
Kubernetes assigns a QoS class automatically from how you declare requests and limits: - Guaranteed — every container sets both requests and limits for CPU and memory, and request equals limit. - Burstable — at least one request/limit is set, but the Guaranteed conditions are…
OOMKilled means the container exceeded resources.limits.memory and the kernel OOM killer terminated it. Symptoms: rising RESTARTS, and describe showing Last State: Terminated, Reason: OOMKilled, Exit Code: 137. Confirm it: --previous matters — the current container logs belong to the fresh restart and hold no clues.…
It depends on how it is attached, and this is a common misunderstanding. Injected via env / envFrom: NO. Environment variables are set when the container starts; editing the ConfigMap afterwards does not touch the running process. You need new Pods. Mounted as a volume:…
Work from the Service down to the Pod, eliminating one layer at a time. 1. Does the Service have Endpoints? Empty is the strongest clue: either the selector does not match the Pod labels, or the Pods are not READY (a failing readiness probe removes…
Every Service gets a DNS record of the form <service.<namespace.svc.cluster.local, served by CoreDNS. Within the same namespace the short name api is enough; across namespaces you need api.payment. The surprising part lives in the /etc/resolv.conf the kubelet injects into Pods: ndots:5 means any name with…
Both are resource guardrails at the namespace level, but they operate at different layers. ResourceQuota — a ceiling for the whole namespace. It caps total resource consumption and even object counts. LimitRange — rules per container/Pod. It sets minimums, maximums, and default values when a…
With managed Kubernetes, the provider operates the control plane, while worker nodes and everything running on them remain your job. In short: you no longer keep the cluster itself alive, but you still keep your applications alive. In AKS, the control plane — kube-apiserver, etcd,…
