Docker Interview Questions: What Employers Actually Ask in 2026

Q1: What is the difference between a Docker image and a container?

An image is a read-only template — a layered stack of filesystem changes stored as a tar archive. A container is a running instance of an image: it takes the image layers (read-only) and adds a thin writable layer on top. Multiple containers can run from the same image simultaneously, each with their own writable layer.

---

Q2: Explain Docker layers and why they matter for performance.

Each instruction in a Dockerfile creates a new layer. Layers are content-addressed (identified by SHA256 hash) and cached on the host. When you rebuild an image, Docker reuses cached layers until it hits a change.

This matters because: it reduces build times (only changed layers rebuild), reduces pull/push times (only new layers transfer), and reduces disk usage (shared layers exist once in the page cache even when many containers use the same image).

Order instructions in your Dockerfile from least-to-most-frequently changed.

---

Q3: A container exits immediately after starting. How do you debug it?

docker ps -a                          # see exit code
docker logs <container>               # see stdout/stderr before exit
docker inspect <container> | grep ExitCode

Common causes: the CMD process exited (containers run until their main process stops), a startup script failed, a missing environment variable caused the app to crash at init.

# Override entrypoint to get a shell
docker run -it --entrypoint /bin/sh <image>

---

Q4: How does Docker networking work between containers?

Default bridge network: containers cannot reach each other by name. Custom bridge network: Docker's built-in DNS resolves container names to IPs. Overlay network: spans multiple Docker hosts (Swarm). Host network: container shares the host network stack.

For production multi-container apps, always use a custom network with Compose so containers reach each other by service name.

---

Q5: What is the difference between COPY and ADD in a Dockerfile?

Both copy files from build context into the image. ADD also:

Best practice: use COPY unless you specifically need one of ADD's extra features. COPY is explicit about what it does.

---

Q6: How do you reduce Docker image size?

  1. Use a minimal base image (alpine, slim, distroless, or scratch)
  2. Use multi-stage builds — build tools stay in the builder stage
  3. Combine RUN commands to reduce layers: RUN apt-get update && apt-get install -y pkg && rm -rf /var/lib/apt/lists/*
  4. Use .dockerignore to exclude node_modules, .git, tests, docs from the build context
  5. Run as non-root (forces you to avoid installing unnecessary tools)

---

Q7: Container is running but the application is not responding. Walk through your debug steps.

docker logs <container> --tail 50
docker exec -it <container> /bin/sh
# inside: check if the process is running
ps aux
# check if it's listening on the expected port
ss -tlnp
# check if the port is accessible from outside
docker port <container>
# check resource usage
docker stats <container> --no-stream

---

Q8: What is a Docker healthcheck and how does it affect Compose behavior?

HEALTHCHECK --interval=30s --timeout=5s --retries=3   CMD curl -sf http://localhost:8080/health || exit 1

The container reports healthy / unhealthy / starting status. In Compose, depends_on: condition: service_healthy waits for the healthcheck to pass before starting dependent services — critical for avoiding race conditions on startup.

---

Q9: How do you pass secrets into a container securely?

Options in order of security:

  1. Docker secrets (Swarm) — stored encrypted, mounted as files in /run/secrets/
  2. Environment variables via env_file with a gitignored .env file
  3. Mounted secret files via bind mount at runtime (not baked into the image)
  4. External secret stores (HashiCorp Vault, AWS Secrets Manager) fetched at startup

What NOT to do: bake secrets into the Dockerfile (they end up in the image layer history), commit them in environment files, or pass them as ARG (visible in docker history).

---

Q10: What is the difference between CMD and ENTRYPOINT?

ENTRYPOINT defines the executable. CMD provides default arguments to the entrypoint (or the command to run if no entrypoint is set). They interact:

ENTRYPOINT ["nginx"]
CMD ["-g", "daemon off;"]
# Running: docker run myimage -v → nginx -v  (CMD replaced by -v)

Use ENTRYPOINT for the executable, CMD for default arguments. This lets users override arguments without overriding the entrypoint.

---

Q11: How does docker system prune work?

docker system prune              # removes stopped containers, dangling images, unused networks, build cache
docker system prune -a           # also removes unused images (not just dangling)
docker system prune -a --volumes # also removes unused volumes (DATA LOSS)
docker system df                 # see what would be reclaimed

---

Q12: What is a dangling image?

An image with no tag — created when you rebuild an image and the tag moves to the new version. The old layers become untagged. docker images -f dangling=true lists them. They accumulate and consume disk space. docker image prune removes them.

Practice Docker in the ShellGenius Docker Labs — 30 challenges covering real incident scenarios from OOM to network isolation.