Containers
76 bites tagged Containers — interview questions with model answers, and 60-second explainers.
What is a container vs a VM?
Containers share the host kernel and isolate via namespaces and cgroups; VMs run a full guest OS on a hypervisor; containers are lighter and faster. understanding of OS-level virtualization.
Multi-stage Docker builds
A build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface. separating build tooling from runtime. shipping compilers and source.
Writing a Dockerfile for a web app
FROM a base, set WORKDIR, install dependencies before app code for cache reuse, EXPOSE the port, CMD the start command. core Dockerfile instructions and layering. copying everything before installing deps, or root.
Image signing with Cosign vs trusting a digest
A digest proves content has not changed but not who produced it; Cosign cryptographically signs the digest so a verified key proves provenance, and policies enforce it at admission. integrity vs authenticity.
Container registries: public vs private
A registry stores and serves versioned image layers by digest; public registries are open and rate-limited, private ones add access control, scanning, signing and network isolation. image distribution and governance.
What makes a process a container to the kernel
Namespaces isolate and cgroups limit, but also capabilities, seccomp filters, mount/pivot_root for the rootfs, and SELinux/AppArmor labels. container internals beyond the basics.
Node, Pod, and Container relationship
A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management. the core scheduling unit hierarchy.
Cloudflare Sandboxes Cut Container Heartbeat Plumbing
Kent C. Dodds replaced Cloudflare Containers with Sandboxes, deleting heartbeat and shutdown logic for his FFmpeg pipeline. PR #729 uses one-shot exec() inside the existing queue worker, cutting deploy surface and eliminating long-lived service orchestration.
Explain multi-stage Docker builds for Python and builder vs runtime
Tests separation of build-time and runtime concerns. A strong answer contrasts the builder stage (gcc, headers, wheels) with the runtime stage (slim base, copied artifacts, no compiler). Red flag: citing size alone while ignoring security and caching.
Walk me through a basic Dockerfile for a FastAPI app
Slim base, install deps before app code to cache layers, expose port, exec-form CMD for Uvicorn. Docker layering and build cache for Python containers. Shell-form CMD or code-before-requirements, killing cache.
FastAPI Container Build and Deploy Pipeline
Treat the Docker image as the immutable artifact: one build runs everywhere. Deploy FastAPI workers behind a load balancer, one process per container. The footgun is baking secrets into the image or running multiple processes; that breaks horizontal scaling.
Deploy a trained model as a containerized REST API
This tests practical MLOps fluency. A strong answer covers loading the artifact, wrapping it in a web server, building a Dockerfile, and exposing health and predict endpoints. Red flag: conflating training with serving or omitting resource limits.
Walk me through essential Dockerfile commands for a reproducible Python ML environment
Tests your ability to containerize Python ML scripts reproducibly. A strong answer covers FROM with a pinned slim image, WORKDIR, COPY for requirements and code, RUN pip install, and CMD or ENTRYPOINT.
Docker Image vs. Container: Blueprint vs. Runtime
A Docker image is a read-only blueprint; a container is a live instance with a writable layer. You build an image once in CI and run many containers from it in production. The footgun is mutating a running container without updating the image recipe.
Explain layered filesystems like OverlayFS and their efficiency vs monolithic models
This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.
How do containers enforce CPU and memory limits via cgroups?
Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config. Knowledge that cgroups enforce limits in the kernel, not Docker. Confusing cgroups with namespaces or saying Docker throttles.
Name three Linux namespaces and explain what each one isolates.
Name three of PID, Network, Mount, UTS, IPC, User, Cgroup, Time; say what each hides; cite CLONE_NEW* or /proc/pid/ns. Kernel primitives behind container isolation.
How do Docker images and containers differ and relate?
This tests your grasp of the immutable template versus mutable runtime boundary. A good answer: an image is a read-only layered template with code and dependencies; a container is a runnable instance with a writable layer on top.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
Container Images Are Stacked Deltas
Images stack read-only layers like transparent sheets, one per Dockerfile step, topped by a thin writable layer. This enables cache reuse and fast pulls. The footgun: removing a file in a later layer hides but does not delete it; those bytes still ship.
ConfigMap decouples config from container images
A ConfigMap is a key-value store that injects configuration into pods without rebuilding the image. Use it for feature flags, database hostnames, or any non-secret settings. Editing one does not restart existing pods, so stale config is the common footgun.
OCI: The USB-C of Containers
OCI is the USB-C of containers: open standards that let any compliant runtime execute any image. It prevents vendor lock-in by decoupling image format from runtime. The footgun is treating "Docker image" as proprietary rather than an OCI-compliant bundle.
Explain the concept of a sidecar container in Kubernetes
Tests Pod multi-container patterns. A strong answer defines sidecars as co-located helpers sharing network and storage, cites service mesh or log forwarding, and argues for reuse and separate lifecycles. Red flag: calling it another Pod or legacy workaround.
How do you manage multi-arch container images under a single tag?
This tests image distribution and registry semantics. A strong answer covers manifest lists pointing to per-arch digests, Buildx as the builder driver, and the registry serving correct layer blobs.
Get Containers bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.