Walk me through a basic Dockerfile for a FastAPI app

WHAT THIS TESTS: The interviewer wants to see that you understand Docker image layering, cache invalidation, and the difference between build-time and run-time steps. They also care whether you know why exec-form CMD matters for PID 1 signal handling in containers, and whether you can articulate security and performance trade-offs like using a slim base image.

A GOOD ANSWER COVERS: First, choosing a minimal base image such as python:3.11-slim to reduce attack surface and final image size. Second, copying only the requirements file before the application code so that pip install runs in a cached layer and does not rebuild on every source change. Third, copying the FastAPI source code after dependencies are installed. Fourth, exposing the port the app listens on, typically 8000. Fifth, using exec-form CMD with a JSON array such as CMD followed by uvicorn, main:app, --host, 0.0.0.0, --port, 8000 so Uvicorn runs as PID 1 and receives SIGTERM directly from Docker. Optionally mentioning a non-root user is a strong senior signal.

COMMON WRONG ANSWERS: A red flag is using shell-form CMD like CMD uvicorn main:app --host 0.0.0.0 --port 8000 because Docker spawns a shell process as PID 1 and signals may not reach Uvicorn cleanly, preventing graceful shutdown. Another mistake is copying the entire project before installing requirements, which means any code edit invalidates the dependency layer and forces a full pip reinstall. Using the full python image without justification is also weak because it bloats the image unnecessarily. Forgetting to expose the port or misunderstanding that EXPOSE is documentation unless paired with runtime port mapping is another common slip.

LIKELY FOLLOW-UPS: The interviewer may ask how you would handle production concerns such as running multiple Uvicorn workers inside the container versus running one process per container and scaling horizontally. They might ask how to use a non-root USER directive or multi-stage builds to further shrink the image. You could also be asked about health checks, dockerignore files, or how to pass configuration via environment variables rather than hardcoding flags in the Dockerfile.

ONE CONCRETE EXAMPLE: A solid Dockerfile looks like this in concept. FROM python:3.11-slim. WORKDIR /code. COPY ./requirements.txt /code/requirements.txt. RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt. COPY ./app /code/app. EXPOSE 80. CMD in exec form using uvicorn, app.main:app, --host, 0.0.0.0, --port, 80. This ordering keeps the heavy pip install layer cached while lightweight source changes only rebuild the final layers. The exec-form CMD ensures Uvicorn is the direct child of the container init and can shut down gracefully when Docker sends a stop signal.

Source: fastapi.tiangolo.com