Docker Interview Questions

What should you focus on for a Docker interview?

Can you explain images, containers, and virtual machines?

Start with what Docker does for packaging, dependencies, configuration, and deployment. That question appeared in 18 of 90 interviews. Docker basics appeared in more of these interviews than any other topic.

Reviews of real answers found a clear gap: some answers did not distinguish images from containers. Images package an application and its dependencies. Containers run those images. Can you explain Docker while keeping that difference clear?

Then compare containers with virtual machines. Can you explain the differences in performance, resource use, and security? Can you describe use cases for each, rather than only give their definitions?

Can you explain how you build and run an application?

Dockerfile and image questions appeared in 19 of 90 interviews. Check whether you can describe how you build an image and explain the instructions you use, not just name them.

• What is a multi-stage build, and how would you implement one?
• What is the difference between ENTRYPOINT and CMD?
• How would you use Docker Compose for a local setup with an application and its dependencies?
• How do volumes keep application data persistent across container restarts?
• How would you use environment variables, build arguments, and file mounts to configure an application?

Can you explain deployment, delivery, and security?

Deployment and orchestration questions appeared in 23 of 90 interviews. Can you explain the different roles of Docker and Kubernetes? Go beyond defining the tools: describe how they support scaling and reliability together.

For delivery and security, use these checks:

• Can you describe where automated tests and deployment gates fit in a Docker CI/CD pipeline?
• Can you explain how you would version images, move them through a registry, and roll back a deployment?
• Can you describe how you would scan an image for vulnerabilities and fix what you find?
• Can you explain how you would manage secrets for a containerized application?

Can you investigate a problem with a running container?

Troubleshooting questions covered crashes, memory limits, connection failures, API and worker errors, misleading health checks, logging problems, and performance issues.

Choose a problem from that list. Can you say what you would check first and what the result would tell you? For a crash, include memory limits in your explanation. For a health check that looks fine while the application has errors, explain how you would investigate beyond the health check.

Who gets asked Docker

The 20 most asked Docker questions

Counted by interview, not by mention: a question asked twice in one conversation counts once.

1. What is Docker, and how does it help with application packaging, dependencies, configuration, and deployment?

   Asked in 18 of 90 interviews · last asked Oct 7 · Concept · Junior

   Show answer

   Docker is a tool for packaging and running applications in containers. A Dockerfile defines how to build an image containing the application and its dependencies; a container is a running instance of that image. You can deploy the same image across compatible environments and pass configuration at runtime, which helps reduce setup differences.

   • Images package application code, libraries, and other dependencies.
   • Containers run images as isolated processes sharing the host kernel.
   • A Dockerfile lists the steps used to build an image.
   • Runtime configuration keeps environment-specific settings and secrets out of the image.

   What the interviewer checks: The interviewer checks whether you understand how Docker separates packaging, running, and configuration to make deployment more consistent.

   Common mistake (in 3 of 6 reviewed answers): Many answers forget that images package the application and its dependencies, while containers run those images.

   Other ways it was asked

   • “What is Docker?”
   • “What is a Dockerfile, and what is it used for?”
   • “What is Docker used for?”

2. How do Docker containers compare with virtual machines in performance, resource use, security, and use cases?

   Asked in 6 of 90 interviews · last asked Sep 16 · Concept · Junior

   Show answer

   Docker containers share the host's kernel, while each virtual machine runs its own guest OS and kernel. Containers usually start faster and use less memory and disk space. VMs usually provide stronger isolation, but need more resources. Containers suit packaging and scaling services; VMs suit different operating systems and workloads needing stronger separation.

   • Lower container overhead does not mean every application runs faster than in a VM.
   • A shared kernel makes kernel vulnerabilities a risk across containers on the same host.
   • Containers need a compatible kernel; VMs can run a different OS from the host.
   • Docker Desktop typically runs Linux containers inside a Linux VM, which adds resource overhead.

   What the interviewer checks: The interviewer checks whether you can explain the trade-offs and choose the right approach for a workload.

   Other ways it was asked

   • “What is the difference between Docker and a virtual machine?”
   • “What are Docker containers, and how do they differ from virtual machines?”
   • “What is the difference between a virtual machine and a container?”

3. What is a Docker image, and how does it differ from a container?

   Asked in 4 of 90 interviews · last asked Oct 7 · Concept · Junior

   Show answer

   A Docker image is a read-only template containing application code, dependencies, and configuration. A container is an instance of that image, with its own writable layer. The image stays unchanged, while the container can run, stop, and store changes in its writable layer.

   • One image can create many separate containers.
   • A stopped container is still a container.
   • Removing a container deletes its writable layer; use volumes for data that must survive removal.
   • Docker builds images and runs containers; Kubernetes manages containers across machines.

   What the interviewer checks: The interviewer checks whether you understand the difference between a packaged application and an instance created from it.

   Other ways it was asked

   • “What is the difference between a Docker image and a container?”
   • “What is the difference between a container image and a container?”
   • “How would you define a Docker image?”

4. What is a multi-stage Docker build, and how do you implement one?

   Asked in 4 of 90 interviews · last asked Oct 5 · Tooling · Mid-level

   Show answer

   A multi-stage Docker build uses multiple FROM instructions in one Dockerfile. You build the app in one stage, then copy its output into a separate runtime stage with COPY --from. This keeps build tools out of the final image. It is useful for making production images smaller and reducing unnecessary software.

   • Name stages with AS, then reference those names in COPY --from.
   • Only copied files and the final stage’s contents go into the final image.
   • The final stage must include everything the app needs to run.

   CodeCopy

   FROM golang:1 AS build
   WORKDIR /src
   COPY . .
   RUN CGO_ENABLED=0 go build -o /app .
   
   FROM scratch
   COPY --from=build /app /app
   ENTRYPOINT ["/app"]

   What the interviewer checks: The interviewer checks whether you can separate build dependencies from runtime needs using correct Dockerfile syntax.

   Other ways it was asked

   • “What are multi-stage builds in Docker, and when are they useful?”
   • “What are multi-stage Docker builds, and when would you use them?”
   • “What are Docker multi-stage builds, and when would you use them?”

5. What roles do Docker and Kubernetes play, and how do they support scalable, resilient applications together?

   Asked in 4 of 90 interviews · last asked Oct 22 · Concept · Mid-level

   Show answer

   Docker packages applications and their dependencies into images and runs them as containers. Kubernetes manages containerized applications across machines. It supports scaling, distributes traffic, and replaces failed workloads to keep applications available. Together, they provide consistent packaging and coordinated operation, but applications still need correct health checks, resource settings, and data storage.

   • Docker provides consistent application environments; Kubernetes coordinates deployment and operation across a cluster.
   • Kubernetes can scale replicas automatically when autoscaling is configured.
   • Replicas, health checks, and replacement pods help applications survive failures.
   • Kubernetes runs Docker-built images through compatible runtimes such as containerd; it does not require Docker Engine.

   What the interviewer checks: The interviewer checks whether you distinguish packaging and running containers from managing their scaling and recovery.

   Other ways it was asked

   • “Why do we use Kubernetes with Docker?”
   • “Can you talk about how Docker and Kubernetes together contribute to the scalability and resilience of microservices architectures?”
   • “What problems does Docker solve, and what is Kubernetes used for?”

6. What is the difference between ENTRYPOINT and CMD in Docker?

   Asked in 3 of 90 interviews · last asked Sep 4 · Concept · Mid-level

   Show answer

   ENTRYPOINT sets the main program the container runs. CMD provides a default command, or default arguments when used with ENTRYPOINT in exec form. Arguments after the image name in docker run replace CMD, not ENTRYPOINT. Use ENTRYPOINT for a fixed tool and CMD for defaults users can easily change.

   • Without ENTRYPOINT, CMD can define both the program and its arguments.
   • Use docker run --entrypoint to replace ENTRYPOINT.
   • Use exec form, such as ["echo"], when combining ENTRYPOINT with CMD arguments.
   • Shell-form ENTRYPOINT ignores CMD and arguments passed after the image name.

   CodeCopy

   Dockerfile:
   FROM alpine
   ENTRYPOINT ["echo"]
   CMD ["hello"]
   
   Commands:
   docker build -t greeter .
   docker run greeter        # prints hello
   docker run greeter Sam    # prints Sam

   What the interviewer checks: The interviewer checks whether you understand container startup commands and how users can override them.

   Other ways it was asked

   • “In a Docker file, what's the practical difference between CMD and ENTRYPOINT, and when would you choose one over the other?”
   • “What is the difference between CMD and ENTRYPOINT in Docker?”

7. What is Docker Compose used for?

   Asked in 3 of 90 interviews · last asked Oct 15 · Concept · Junior

   Show answer

   Docker Compose is used to define and run applications with multiple containers. You describe services, networks, and volumes in a YAML file, then use commands like `docker compose up` to create and start them together. It is commonly used for local development and testing.

   • Keeps configuration for related services, such as an app and its database, in one file.
   • Provides commands to start, stop, rebuild, and view logs for the application.
   • Containers can reach each other by service name on a shared Compose network.
   • Startup order alone does not mean a service is ready; use health checks when needed.

   What the interviewer checks: The interviewer checks whether you understand how Compose manages related containers as one application.

   Other ways it was asked

   • “What is Docker Compose, and what is it used for?”
   • “How does Docker Compose work?”

8. How do Docker volumes keep application data persistent across container restarts?

   Asked in 3 of 90 interviews · last asked Oct 13 · Concept · Junior

   Show answer

   Docker volumes store application data outside the container’s writable layer. Docker mounts a volume at a path inside the container, so data written there survives container restarts and removal. A replacement container can use the same data by mounting the same volume.

   • A restart alone does not erase the container’s writable layer; removing the container does.
   • Only data written to the mounted volume is stored in that volume.
   • Volumes persist separately from containers, but explicitly deleting a volume deletes its data.
   • For PostgreSQL, mount the volume at the data location used by your image version and configuration.

   What the interviewer checks: The interviewer checks whether you understand how volume storage differs from a container’s writable layer.

   Other ways it was asked

   • “Why are Docker volumes used?”
   • “Why would you use a Docker volume?”
   • “How can you persist PostgreSQL data in a Docker container so it survives container restarts?”

9. Can you explain how Docker works?

   Asked in 2 of 90 interviews · last asked Sep 23 · Concept · Junior

   Show answer

   Docker runs applications in isolated environments called containers. It builds images that package application code and its dependencies, then creates containers from those images. The Docker client sends commands to the Docker daemon, which manages images, containers, networks, and storage. Containers share a host kernel rather than each running a full operating system.

   • Images are templates; containers are instances with their own writable layer.
   • Linux containers use namespaces for isolation and cgroups to control resource use.
   • Containers usually start faster and use fewer resources than virtual machines.
   • Docker Desktop runs Linux containers inside a Linux virtual machine on macOS and Windows.

   What the interviewer checks: The interviewer checks whether you understand images, containers, Docker's basic architecture, and how containers differ from virtual machines.

   Other ways it was asked

   • “Can you tell me a little more about Docker?”

10. What methods can you use to build a Docker image?

    Asked in 2 of 90 interviews · last asked Aug 25 · Concept · Mid-level

    Show answer

    The usual method is to write a Dockerfile and run `docker build`. This makes the build repeatable and easy to track in version control. You can also use `docker commit` to create an image from a container’s changes, but this is harder to reproduce. Another option is `docker import`, which creates an image from a root filesystem archive.

    • A Dockerfile defines the base image and the steps needed to build your image.
    • `docker build` uses a build context and can reuse cached layers.
    • `docker commit` saves container changes, but not data in mounted volumes.
    • `docker import` creates an image from a filesystem archive; it does not run Dockerfile instructions.

    CodeCopy

    # Run in the directory containing your Dockerfile.
    docker build -t my-app:latest .

    What the interviewer checks: The interviewer checks whether you know the main methods and why Dockerfile builds are preferred.

    Other ways it was asked

    • “How do you build a Docker image?”

11. What are Docker layers?

    Asked in 2 of 90 interviews · last asked Aug 30 · Concept · Junior

    Show answer

    Docker image layers are read-only sets of filesystem changes stacked to form an image. Layers can add, change, or delete files. Docker can share layers between images and reuse cached build steps. When a container is created, Docker adds a writable layer on top for that container’s changes.

    • Filesystem-changing build steps create layers; some instructions only update image metadata.
    • Shared layers save disk space and reduce downloads.
    • Deleting a file in a later layer does not remove its data from earlier layers.
    • Removing a container deletes its writable layer, but not data stored in volumes.

    What the interviewer checks: The interviewer checks whether you understand image structure, layer reuse, and where container changes are stored.

    Other ways it was asked

    • “What are Docker image layers, and how do they work?”

12. How do you write a Dockerfile, and what practices make it efficient?

    Asked in 2 of 90 interviews · last asked Oct 7 · Tooling · Mid-level

    Show answer

    A Dockerfile is a text file with instructions for building a Docker image. Start with a base image, set a working directory, copy files, install dependencies, and define the startup command. Copy dependency files before application code so Docker can reuse cached installation layers.

    • Use a small, trusted base image and pin its version for more predictable builds.
    • Use multi-stage builds to keep build tools out of the final image.
    • Use .dockerignore to exclude local dependencies, Git files, and secrets from the build context.
    • Run the application as a non-root user when possible.

    CodeCopy

    FROM node:24-bookworm-slim
    WORKDIR /app
    COPY package.json package-lock.json ./
    RUN npm ci --omit=dev && npm cache clean --force
    COPY --chown=node:node . .
    USER node
    CMD ["node", "server.js"]

    What the interviewer checks: The interviewer checks whether you can build a working image while controlling build time, image size, and security.

    Other ways it was asked

    • “How do you write a Dockerfile?”
    • “What is a Dockerfile, and what are best practices for making it efficient?”

13. What is the difference between a Dockerfile and Docker Compose?

    Asked in 2 of 90 interviews · last asked Aug 25 · Concept · Junior

    Show answer

    A Dockerfile defines how to build a container image. Docker Compose defines how to run an application’s containers, including their networks and volumes, in a YAML file. Compose can use existing images or build images from Dockerfiles.

    • A Dockerfile contains build steps, such as installing packages and copying application files.
    • Compose configures services, ports, environment variables, networks, and volumes.
    • Docker Compose uses Docker to manage containers; it does not replace Docker.
    • Compose can manage one service or several related services.

    What the interviewer checks: The interviewer is checking whether you understand building images versus configuring and running containers.

    Other ways it was asked

    • “What is the difference between Docker and Docker Compose?”

14. What ways can you pass runtime configuration into a Docker container besides environment variables?

    Asked in 2 of 90 interviews · last asked Jan 29 · Tooling · Junior

    Show answer

    You can pass runtime configuration through command-line arguments or configuration files mounted with bind mounts or volumes. In Docker Swarm, you can also use configs for settings and secrets for sensitive values. The application must support reading configuration from the method you choose.

    • Arguments after the image name replace CMD and are passed to an exec-form ENTRYPOINT, if configured.
    • Mount configuration files read-only to prevent the container from changing them.
    • Docker Swarm provides configs and secrets; ordinary docker run does not provide these features.

    CodeCopy

    docker run --mount type=bind,src=/srv/app/config.yml,dst=/etc/app/config.yml,readonly myapp --config /etc/app/config.yml
    # Assumes myapp has an ENTRYPOINT that accepts --config.

    What the interviewer checks: The interviewer is checking whether you know how to supply settings at runtime without rebuilding the image.

    Other ways it was asked

    • “How can you pass information into a Docker container?”
    • “Besides environment variables, what other ways can you pass information into a Docker container?”
    • “How do you pass parameters into a Docker container?”

15. What Docker network types are available, and how does bridge networking work?

    Asked in 2 of 90 interviews · last asked Jul 16 · Concept · Mid-level

    Show answer

    Docker provides bridge, host, none, overlay, macvlan, and ipvlan networks. Bridge connects containers on one Docker host through a virtual switch, with separate container IP addresses. Containers on the same bridge can communicate directly. Bridge networks normally use NAT for outbound traffic and published ports for access from outside the host.

    • User-defined bridges provide DNS by container name; the default bridge does not.
    • Host networking shares the host’s network stack; none disables networking except loopback.
    • Overlay connects containers across Docker hosts, commonly for Swarm services.
    • Macvlan gives containers separate MAC addresses on the physical network; ipvlan shares the parent interface’s MAC address.

    CodeCopy

    docker network create app-net
    # Publish container port 80 on the host's loopback port 8080.
    docker run -d --name web --network app-net -p 127.0.0.1:8080:80 nginx
    curl http://127.0.0.1:8080

    What the interviewer checks: The interviewer checks whether you can choose a network type and explain container communication, isolation, and port publishing.

    Other ways it was asked

    • “Can you explain the different Docker network types and what each one is used for?”
    • “How do the Docker network types differ, and how does communication work between the host and a container?”
    • “What is a bridge network in Docker?”

16. How do you expose a Dockerized application externally, and how does port publishing differ from EXPOSE?

    Asked in 2 of 90 interviews · last asked Sep 23 · Concept · Mid-level

    Show answer

    Publish the container port with `docker run -p` or Compose `ports` to make the app reachable through the host. The app must listen on a reachable container interface, not just localhost. `EXPOSE` documents a container port; it does not publish it. External access also needs a reachable host address and firewall rules that allow traffic.

    • `-p 8000:8080` maps host port 8000 to container port 8080.
    • Configure mappings when starting the container, not in the Dockerfile.
    • Published ports bind to all host interfaces by default; use a specific address to restrict access.
    • Publishing does not require `EXPOSE`; `-P` publishes exposed ports to automatically assigned host ports.

    CodeCopy

    # Assumes the app listens on 0.0.0.0:8080 inside the container.
    docker run -d -p 8000:8080 my-app
    # From another machine, use the Docker host's reachable address.
    curl http://HOST_IP:8000

    What the interviewer checks: The interviewer checks whether you understand app binding, host-to-container port mapping, and why EXPOSE alone does not allow external access.

    Other ways it was asked

    • “How would you make a Dockerized Python application available externally over a network?”
    • “If an application listens on port 8080 and its Dockerfile declares EXPOSE 8080, where do you configure host-to-container port mapping?”

17. What replaced Docker Scan, and what technology did the original Docker Scan use under the hood?

    Asked in 2 of 90 interviews · last asked Sep 22 · Concept · Mid-level

    Show answer

    Docker Scout replaced Docker Scan. The original Docker Scan used Snyk’s vulnerability scanning technology to check container images for known vulnerabilities.

    • Docker Scout is the replacement for the deprecated Docker Scan CLI plugin.
    • Docker Scan relied on Snyk, not a Docker-built scanning engine.

    What the interviewer checks: The interviewer is checking whether you know Docker’s current scanning tool and the technology behind its older tool.

    Other ways it was asked

    • “What replaced Docker Scan, and what technology did Docker Scan use under the hood?”

18. How would you design a Docker CI/CD pipeline with registries, environment promotion, Argo CD, and rollout strategies?

    Asked in 2 of 90 interviews · last asked Oct 1 · Tooling · Senior

    Show answer

    CI tests code, builds and scans a Docker image, then pushes it to a registry. I promote the same image digest through development, staging, and production by updating deployment files in Git. Argo CD syncs Kubernetes with Git, with production approval gates. I choose a rollout strategy, monitor health, and revert Git for rollback.

    • Use registry access controls and image digests, not mutable tags, for reliable promotion.
    • Keep environment settings separate from images; store secrets outside Git and images.
    • Rolling updates suit simple deployments; canary and blue-green need traffic control, often through Argo Rollouts.
    • Gate promotion on tests and health checks; database changes must remain compatible with rollback.

    What the interviewer checks: The interviewer checks whether you can connect secure builds, repeatable promotion, GitOps deployment, and safe rollout recovery.

    Other ways it was asked

    • “How would you design a CI/CD pipeline for a Dockerized application or microservices?”
    • “How would you deploy and operate an application end to end, including the build and image registry, Argo CD synchronization, rollout strategy, and promotion across development, staging, and production?”

19. How would you configure Jenkins to connect to and use a Docker server?

    Asked in 2 of 90 interviews · last asked Sep 4 · Tooling · Mid-level

    Show answer

    Install the Docker CLI on the Jenkins agent that runs the job. Set DOCKER_HOST to the Docker server address and store connection credentials in Jenkins. For a remote server, use SSH or TLS with client certificates. Test with docker info from the agent, then run Docker commands in the pipeline.

    • Give the Jenkins agent permission to access Docker; daemon access usually grants powerful host privileges.
    • For TLS, enable certificate verification and securely provide client certificates to the job.
    • Plain Docker CLI commands do not require a Jenkins Docker plugin.
    • Use Docker Pipeline for pipeline helpers, or the Docker plugin to provision container-based Jenkins agents.

    What the interviewer checks: The interviewer checks whether you can connect Jenkins securely and understand that Docker commands run on Jenkins agents.

    Other ways it was asked

    • “I have a Docker server and want to integrate it with Jenkins. What steps would you follow?”

20. How would you deploy and orchestrate containers across multiple servers for scaling and production reliability?

    Asked in 2 of 90 interviews · last asked Sep 23 · Tooling · Mid-level

    Show answer

    I would use Kubernetes to deploy Docker-built images across multiple servers. I would push versioned images to a registry, then use Deployments and Services to run and expose the application. For reliability, I would spread replicas across servers and configure health checks and resource limits. I would add autoscaling, rolling updates, monitoring, and alerts.

    • Readiness checks stop traffic to unready containers; liveness checks can trigger restarts.
    • Resource requests guide scheduling; limits restrict container resource use.
    • Replica autoscaling needs available cluster capacity; node autoscaling can add servers.
    • Use persistent storage for stateful services, with backups and a tested recovery plan.

    What the interviewer checks: The interviewer checks whether you can handle scaling, failures, and safe updates beyond running containers on one server.

    Other ways it was asked

    • “How would you use Docker and Kubernetes to deploy an application across multiple servers?”
    • “How would you deploy and orchestrate a multi-container application to support scaling and production reliability?”

Related interview questions

• DevOps Engineer interview questions
• Software Engineer interview questions
• System Administrator interview questions
• AI Engineer interview questions
• Data Engineer interview questions
• Cloud Engineer interview questions
• AWS interview questions
• Azure interview questions
• Kubernetes interview questions
• Terraform interview questions
• CI/CD interview questions
• Linux interview questions
• Active Directory and Windows Server interview questions

How this list is made

Every question here was asked by a real interviewer in a real job interview that a candidate ran MeetAssist in. After the call, the interviewer's questions are pulled from the transcript. Practice sessions, tests, exams and anything that was not a job interview are dropped.

Questions are rewritten so they make sense on their own: names of people, employers and clients are removed, and speech-to-text mistakes are fixed. Small talk, logistics and questions about one candidate's own résumé are left out. Rephrasings of the same question are merged, and the count is the number of different interviews it came up in.

The interviews come from candidates who use MeetAssist, so they lean towards software, data and AI roles: the shares describe these interviews, not every Docker interview. Answers to the most asked questions are written and checked by an editor; a "common mistake" is shown only when reviews of real answers in these interviews show it, with the count.

90 interviews, 70 candidates, Jan 2026 to Oct 2026. Updated every month with new interviews.