Docker interview questions

An image is a read-only template made of layers, built from a Dockerfile or pulled from a registry. A container is a running instance of an image with its own writable layer. I can start many containers from one image, and removing a container does not change the image.

Containers share the host operating system's kernel and isolate processes, so they are light and start in seconds. A virtual machine runs a full guest operating system on virtual hardware, which uses more resources but gives stronger isolation. I would use containers to package applications and VMs when I need a different kernel or stricter separation.

ENTRYPOINT sets the program that always runs, and CMD sets default arguments or a default command that docker run arguments can replace. For example, with ENTRYPOINT python app.py and CMD --port 8000, running the image with --port 9000 changes only the port. I use the exec form for both so signals reach the app.

I order the Dockerfile so things that change rarely come first, for example copying the dependency file and installing packages before copying the source code. That way code changes reuse the cached install layer. I also add a .dockerignore file and use a smaller base image where it fits.

I mount a named volume at the database's data directory, for example pgdata at /var/lib/postgresql/data. The volume lives outside the container's writable layer, so removing and recreating the container keeps the data. I still take regular backups, because a volume is not a backup.

First I check that the app uses the other service's name as the host, not localhost, and the container port rather than the published host port. Then I check docker compose ps and logs to see if the target service is actually running and ready. Finally I use docker compose exec to open a shell in one container and test the connection directly.