Top 30 Advanced Docker & Kubernetes Interview Questions and Answers
30 advanced multiple-choice Docker & Kubernetes interview questions, the deep end: internals, failure modes, and the design calls a senior engineer is expected to defend. They come from 30 bites in the Docker & Kubernetes library, the hardest slice of the 144 Docker & Kubernetes interview questions in the library. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
Containers, Helm, orchestration, service mesh
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
Why does an image built with Docker run correctly on a Kubernetes node that uses containerd and runc instead of the Docker daemon?
Show the answer
Answer: c · They all conform to OCI image and runtime specifications
Interoperability comes from shared OCI image and runtime specs, so any compliant tool can consume the same artifact; there is no rebuild or embedded Docker daemon involved.
Read the full bite: What is the OCI and why do its specs matter?
Question 2 of 30
Why can the host run strace against a container process even though strace is absent from the container image?
Show the answer
Answer: c · The container shares the host kernel, so the host PID can be traced directly
Containers are host processes under a shared kernel, so tracing the mapped host PID works from outside; nothing is injected into the image and strace is not hidden inside it.
Read the full bite: Trace a container process's syscalls from the host
Question 3 of 30
After adding USER app to a Dockerfile, the container starts but the app cannot write to its own directory. What was most likely missed?
Show the answer
Answer: c · The application files were not chowned to the app user, leaving them root-owned
Switching USER without changing file ownership leaves files owned by root, so the unprivileged user cannot write them; USER belongs before CMD and non-root users can write to directories they own.
Question 4 of 30
Why is passing an NPM token via a Dockerfile ARG insecure even if you never reference it in the final stage?
Show the answer
Answer: a · The ARG value is recorded in image metadata and visible via docker history
ARG values persist in the image build history and can be inspected, so the secret leaks; BuildKit secret mounts avoid this by keeping the value in tmpfs only during a single RUN. The other claims are fabricated.
Read the full bite: Pass build-time secrets securely with BuildKit
Question 5 of 30
What is the main operational trade-off of using a distroless image instead of Alpine?
Show the answer
Answer: c · There is no shell or package manager, so debugging by exec is not possible
Removing the shell and package manager shrinks the attack surface but means you cannot exec a shell to debug; distroless is generally smaller, runs binaries fine, and does not require root.
Read the full bite: Distroless images: benefits and trade-offs
Question 6 of 30
When you run docker compose up with no -f flags in a directory containing both compose.yaml and compose.override.yaml, what happens?
Show the answer
Answer: d · Compose merges compose.override.yaml on top of compose.yaml automatically
Compose auto-loads and deep-merges compose.override.yaml over the base. It does not ignore it (A) nor wholesale-replace the base (C); merging is the defined behavior, not an error (B).
Read the full bite: Structuring Compose files across environments
Question 7 of 30
Why does copying the full source before installing dependencies hurt build caching when only one code line changes?
Show the answer
Answer: b · The changed source busts the COPY layer, invalidating the later install layer too
A changed layer invalidates itself and every subsequent layer, so installing after copying source forces a reinstall. Caching is not disabled by COPY (A) and does apply to intermediate layers (D).
Question 8 of 30
In a Compose file, a service has profiles: ["debug"] and another service has no profiles key. What does a plain docker compose up start?
Show the answer
Answer: c · Only the service without a profile
Services without a profile always start; profiled services stay off until their profile is activated. So only the unprofiled service runs, not both (B) and not nothing (D).
Read the full bite: Docker Compose profiles for optional services
Question 9 of 30
What makes a vulnerability scan an actual deploy gate rather than just a report?
Show the answer
Answer: c · Configuring the scan step to exit non-zero on findings above a severity threshold so the pipeline fails
A gate must block promotion; a non-zero exit fails the pipeline and stops the build. Reports or emails (A, C) are advisory, and post-deploy scanning (B) is too late to gate.
Question 10 of 30
A pull-through cache reduces cross-region pull cost primarily because:
Show the answer
Answer: d · After the first pull, subsequent in-region pulls are served locally instead of crossing regions
The cache fetches once from upstream then serves the region locally, cutting egress and latency. It does not change compression (A), auth (C), or architecture (B).
Question 11 of 30
What is the role of the filtering phase in the Kubernetes scheduler?
Show the answer
Answer: a · It eliminates Nodes that cannot feasibly run the Pod, leaving candidates for scoring
Filtering applies hard constraints (resources, taints, required affinity) to discard infeasible Nodes; scoring then ranks the survivors. Ranking is the scoring phase (D), and the kubelet starts containers (B).
Question 12 of 30
Why is a CRD alone insufficient to manage a complex application like a database?
Show the answer
Answer: b · A CRD only defines and stores a new resource type; a controller is needed to act on it via a reconciliation loop
A CRD adds schema and storage but takes no action; the Operator's controller watches the resource and reconciles real objects. CRDs are stored in etcd (C) and remain fully supported (D).
Question 13 of 30
Which configuration guarantees zero downtime while making a rolling update as fast as the cluster allows?
Show the answer
Answer: d · maxUnavailable: 0, maxSurge: 100%
maxUnavailable 0 keeps full capacity (zero downtime) and maxSurge 100% spins up a whole parallel set for speed. Any positive maxUnavailable risks a dip, and both at 0 stalls the rollout.
Question 14 of 30
What does progressDeadlineSeconds do when new Pods in a rolling update never become Ready?
Show the answer
Answer: d · It marks the Deployment as failed (ProgressDeadlineExceeded) after that much time without progress
After no progress for that duration, the controller sets the Progressing condition to False with reason ProgressDeadlineExceeded. It does not auto-rollback, delete old Pods, or restart the failing ones.
Read the full bite: Stalled rollouts and progressDeadlineSeconds
Question 15 of 30
Which configuration guarantees no two of a Deployment's Pods share a node?
Show the answer
Answer: a · podAntiAffinity required, topologyKey kubernetes.io/hostname, selecting the Pods' own labels
Required pod anti-affinity on the hostname topology, matching the Pods' own labels, hard-blocks co-location. nodeAffinity targets node selection, podAffinity attracts rather than repels, and resource sizing is a fragile hack.
Read the full bite: Spreading Pods one-per-node for availability
Question 16 of 30
What is the main advantage of kube-proxy's IPVS mode over iptables mode in large clusters?
Show the answer
Answer: d · IPVS uses a kernel hash table and real load-balancing algorithms, scaling better than linear iptables rule chains
IPVS uses an in-kernel hash table and algorithms like round-robin/least-conn, giving near-constant lookups versus iptables' growing linear chains. Both run in kernel and still rely on DNAT; ClusterIPs remain virtual.
Question 17 of 30
After applying a NetworkPolicy that selects app=frontend for Ingress and allows only role=api-gateway, what happens to other Pods' traffic to frontend?
Show the answer
Answer: d · It is denied, because selecting the Pod for Ingress makes it default-deny except what is allowed
Selecting a Pod with an Ingress NetworkPolicy flips it to default-deny, so only the whitelisted api-gateway Pods get through; no explicit deny rule is needed. Enforcement does require a policy-capable CNI.
Read the full bite: Restricting Pod ingress with a NetworkPolicy
Question 18 of 30
What is the relationship between an Ingress resource and an Ingress controller?
Show the answer
Answer: d · The resource holds declarative routing rules; the controller is the running proxy that reads and enforces them
The Ingress resource is inert configuration; the controller is the live proxy that watches those rules and routes traffic. The roles are not interchangeable, and Ingress provides layer-7 routing a LoadBalancer alone does not.
Question 19 of 30
An external-secrets design must keep plaintext out of etcd. Which approach satisfies that requirement?
Show the answer
Answer: b · Mount secrets via a CSI driver onto in-memory tmpfs at runtime
Fetching secrets at runtime and mounting them on tmpfs keeps them only in Pod memory, never in etcd. Syncing into Kubernetes Secrets or using a ConfigMap persists plaintext to etcd, violating the policy.
Read the full bite: How do you inject secrets from an external store at runtime?
Question 20 of 30
Beyond preventing accidental edits, what is the main scaling benefit of marking a Secret immutable?
Show the answer
Answer: c · The kubelet can stop watching it, cutting API server load
Because immutable objects can never change, kubelets skip the per-object watch they normally maintain, removing significant API server and etcd load in large clusters. Immutability does not encrypt data or enable in-place updates.
Read the full bite: What do immutable ConfigMaps and Secrets solve?
Question 21 of 30
Why is committing a SealedSecret to a public Git repo considered safe?
Show the answer
Answer: c · It is encrypted with a public key only the cluster's private key can decrypt
kubeseal encrypts with the controller's public key, and only the in-cluster private key can decrypt, so the committed SealedSecret reveals nothing. Base64 is not encryption, and the values are encrypted, not stripped.
Read the full bite: How do Sealed Secrets enable GitOps for secrets?
Question 22 of 30
A Pod is Pending due to an unbound PVC. What is the most informative first diagnostic step?
Show the answer
Answer: d · Run kubectl describe pvc and read its Events
kubectl describe pvc surfaces Events that usually name the exact binding failure, such as a missing StorageClass or no matching PV. Recreating the Pod, adjusting CPU, or changing networking does not address a storage-binding problem.
Question 23 of 30
Why does a StatefulSet not immediately recreate a Pod on a node that became NotReady?
Show the answer
Answer: a · Running two Pods of the same ordinal could cause concurrent writers and corruption
A StatefulSet enforces at most one Pod per ordinal; recreating while the old Pod's state is unknown risks two writers on the same volume and data corruption, so it waits for confirmation. The PVC is reused, not regenerated, and autoscaling is unrelated.
Read the full bite: How does a StatefulSet recover a Pod after node failure?
Question 24 of 30
What must be true to expand a live PVC-backed volume without recreating the Pod?
Show the answer
Answer: d · The StorageClass allows expansion and the CSI driver supports online expansion
Online expansion requires allowVolumeExpansion true on the StorageClass and a CSI driver that supports in-use expansion; you raise the PVC request, not the PV. Shrinking is never allowed, and expansion is not enabled by default.
Read the full bite: How do you resize a live PersistentVolume?
Question 25 of 30
With the kubelet static CPU Manager policy enabled, which pod configuration receives exclusively pinned CPU cores?
Show the answer
Answer: b · A Guaranteed pod with cpu requests and limits both set to 2
Exclusive cores require Guaranteed QoS with integer CPU requests equal to limits. Burstable pods and fractional millicore values stay in the shared pool and never get pinned cores.
Question 26 of 30
A pod tolerates a NoExecute taint with tolerationSeconds 120 and has terminationGracePeriodSeconds 30. How do these timers relate when the taint is applied?
Show the answer
Answer: d · The pod stays 120s, then gets 30s to shut down after SIGTERM
The timers are sequential: tolerationSeconds delays eviction start by 120s, then terminationGracePeriodSeconds gives 30s for graceful shutdown. They are not concurrent and neither overrides the other.
Read the full bite: tolerationSeconds and graceful eviction on NoExecute
Question 27 of 30
Why might requiredDuringScheduling pod anti-affinity with topologyKey hostname be a poor fit for spreading 9 replicas across 3 nodes?
Show the answer
Answer: d · It permits at most one pod per node, leaving 6 Pending
Hard hostname anti-affinity forbids two matching pods on the same node, capping placement at one per node, so 6 replicas stay Pending. Topology spread constraints instead balance counts proportionally via maxSkew.
Read the full bite: Topology spread constraints versus pod anti-affinity
Question 28 of 30
A RoleBinding in namespace team-a references the built-in view ClusterRole and names group team-a-devs. What can that group do?
Show the answer
Answer: b · Read resources only within namespace team-a
A RoleBinding confines a referenced ClusterRole to its own namespace, so the group gets read access only in team-a. Cluster-wide access would require a ClusterRoleBinding, and view grants read-only, not edit.
Read the full bite: Binding a ClusterRole with a RoleBinding
Question 29 of 30
How do you let a Prometheus pod in a monitoring namespace scrape all tenants while keeping tenants isolated from each other?
Show the answer
Answer: d · Default-deny per tenant, then allow ingress from the monitoring namespaceSelector on the metrics port
Default-deny plus a targeted namespaceSelector rule for monitoring preserves tenant isolation while permitting scrapes. Allowing all cross-namespace traffic breaks isolation, and pod IPs change so IP whitelisting is fragile.
Read the full bite: Multi-tenant isolation with a monitoring exception
Question 30 of 30
In Prometheus, what most directly drives the memory and query cost that a cardinality explosion inflates?
Show the answer
Answer: a · The number of distinct active time series, one per unique label-set
Each unique metric-name-plus-label combination is a separate series held in the head block, so unbounded labels multiply series and cost. Scrape interval and dashboards affect load but are not what an unbounded-label explosion attacks.
Read the full bite: Diagnose a Prometheus cardinality explosion
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.