Interview questions & answers

Docker interview questions & answers

What are the most common Docker interview questions?

Docker is a platform for packaging applications and their dependencies into lightweight, portable containers that run consistently across any environment. Containers share the host operating system kernel, making them faster and smaller than virtual machines. Interviews test whether you understand images versus containers, how to write a Dockerfile, layer caching, and how containers handle networking, storage, and isolation.

Practise in a free AI mock interview Create my free profile

Updated 2026-06-18 · 15 real, commonly-asked questions with answers.

Key takeaways

Docker is a platform for packaging applications and their dependencies into lightweight, portable containers that run consistently across any environment.
Core areas to revise for Docker: Images vs containers, Dockerfile & instructions, Layers & caching, Volumes & storage, Networking.
This guide answers 15 of the most-asked Docker interview questions — rehearse them in OnJob's free AI mock interview.

Images vs containersDockerfile & instructionsLayers & cachingVolumes & storageNetworkingDocker ComposeMulti-stage buildsImage optimization

Top 15 Docker interview questions

Q1.What is the difference between a Docker image and a container?

A Docker image is a read-only template (a snapshot of an application plus its dependencies and configuration) built in layers. A container is a running, writable instance of an image, with its own isolated process, filesystem, and network. You can create many containers from one image, just as you create many objects from one class.

Q2.How does a container differ from a virtual machine?

A virtual machine includes a full guest operating system running on a hypervisor, making it large (gigabytes) and slow to start. A container shares the host OS kernel and packages only the application and its dependencies, so it is lightweight (megabytes), starts in seconds, and uses fewer resources. Containers isolate at the process level rather than virtualizing hardware.

Q3.What is a Dockerfile?

A Dockerfile is a text file of instructions that Docker reads to build an image automatically. Common instructions include FROM (base image), RUN (execute a command during build), COPY (add files), WORKDIR (set the working directory), EXPOSE (document a port), and CMD or ENTRYPOINT (the default command when a container starts). Each instruction creates a layer.

Q4.What is the difference between CMD and ENTRYPOINT?

ENTRYPOINT defines the executable that always runs when the container starts and is not easily overridden by arguments. CMD provides default arguments or a default command that can be overridden by arguments passed to docker run. A common pattern is ENTRYPOINT for the fixed program and CMD for its default arguments, so users can override the arguments but not the program.

Q5.How does Docker layer caching work?

Each Dockerfile instruction creates a cached layer. When you rebuild, Docker reuses cached layers as long as the instruction and its inputs are unchanged; the first changed instruction invalidates the cache for it and every layer after it. Best practice is to place rarely-changing steps (like installing dependencies) before frequently-changing steps (like copying source code) to maximize cache reuse.

Q6.What is the difference between COPY and ADD?

Both copy files into an image, but COPY only copies local files and directories and is preferred for clarity. ADD does the same but additionally can extract local tar archives automatically and fetch files from a URL. Docker's guidance is to use COPY unless you specifically need ADD's extraction behavior.

Q7.What is a Docker volume and why use one?

A volume is Docker-managed persistent storage that exists outside a container's writable layer, so data survives when the container is removed or recreated. Volumes are the preferred way to persist databases and share data between containers, and they perform better than bind mounts in many cases. Without a volume, data written inside a container is lost when that container is deleted.

Q8.What is the difference between a volume and a bind mount?

A volume is fully managed by Docker and stored in Docker's area on the host, making it portable and the recommended choice for persistence. A bind mount maps a specific host directory or file directly into the container, giving the container access to host files, which is useful in development. Volumes are decoupled from the host's directory structure; bind mounts depend on it.

Q9.What is Docker Compose?

Docker Compose is a tool for defining and running multi-container applications using a single YAML file (compose.yaml) that declares services, networks, and volumes. With one command (docker compose up) it builds and starts all the containers together, wired up to communicate. It is ideal for local development of an app made of several services, such as a web server plus a database.

Q10.How do containers communicate with each other?

By default Docker creates networks; containers on the same user-defined bridge network can reach each other by container or service name, which Docker resolves via built-in DNS. You can also publish a container's port to the host with the -p flag so it is reachable from outside. Compose automatically places services on a shared network so they can find each other by name.

Q11.What is the purpose of EXPOSE in a Dockerfile?

EXPOSE documents which port the containerized application listens on; it is informational and does not actually publish the port to the host. To make the port reachable from the host you must still map it at runtime with docker run -p hostPort:containerPort (or the ports section in Compose). EXPOSE mainly serves as documentation and works with the -P flag to publish all exposed ports.

Q12.What is a multi-stage build and why is it useful?

A multi-stage build uses multiple FROM statements in one Dockerfile, where a later stage copies only the needed artifacts from an earlier build stage. This lets you compile or build in a heavy image (with compilers and dev tools) but ship a small final image containing only the runtime and the built output. The result is a much smaller, more secure production image.

Q13.What does docker run do compared to docker start?

docker run creates a new container from an image and starts it, optionally pulling the image first. docker start restarts an existing, previously created container that is stopped, preserving its configuration. So run is for a fresh container; start resumes one that already exists.

Q14.How do you reduce the size of a Docker image?

Use a minimal base image (such as alpine or a slim variant), combine RUN commands and clean up package caches in the same layer, use multi-stage builds to exclude build tools from the final image, add a .dockerignore file to avoid copying unnecessary files, and copy only what you need. Smaller images build, push, and start faster and have a smaller attack surface.

Q15.What is a container registry like Docker Hub?

A container registry is a storage and distribution system for Docker images. Docker Hub is the default public registry; you push images to it with docker push and pull them with docker pull. Registries let teams share images and let deployment systems retrieve the exact image to run, and private registries (such as Amazon ECR) keep proprietary images secure.

Free AI mock interview

Practise Docker out loud

Reading answers is step one. Rehearse them in OnJob's free AI mock interview, get instant feedback, then apply to AI-matched jobs in one click.

Start a free mock interview Create my free profile