Docker
101 bites tagged Docker: interview questions with model answers, and 60-second explainers.
Test yourself: Top 30 Docker interview questions →Multiple choice, with the correct answer and why it is correct on every question. Free, no sign-in.Docker publishes Sandbox Kit Specification v3
Docker published an open-source Kit Specification v3 for packaging an agent’s runtime, tools, permissions, and network policy with its environment.
Docker introduces Cloud Sandboxes for long-running agents
Docker announced Cloud Sandboxes on 24 September: the same microVM isolation model as local Sandboxes, running on Docker-managed compute.
Multi-stage Docker builds for lean production images?
Build stage compiles/installs, runtime stage copies artifacts only, discards build tools.
What are key Dockerfile steps for Node.js Express apps?
Use lightweight base image, copy app, install deps, expose port, set NODE_ENV, run.
Bind mounts vs named volumes for persisting Docker data?
Persist data outside the writable container layer via a bind mount (a host path you control) or a named volume (Docker-managed under its data dir, portable and the recommended default).
Bind mounts versus named volumes
A bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).
What is a dangling image and how to prune it
A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.
Debug a running container with the Docker CLI
Docker inspect for full state and config, docker logs -f to follow output live, docker exec -it <id> sh or bash for an interactive shell.
Build, tag, and run a container with port mapping
Docker build -t my-app:1.0 . to build and tag; docker run -d -p 8080:80 my-app:1.0 to run detached with host:container port mapping.
What is a container vs a VM?
Containers share the host kernel and isolate via namespaces and cgroups; VMs run a full guest OS on a hypervisor; containers are lighter and faster.
Deploy a saved model as a REST prediction service
Load the artifact, wrap it in a predict API, containerize, host with autoscaling, add monitoring.
Multi-stage Docker builds
A build stage compiles with the toolchain, the final stage uses a minimal base and copies only the artifact, cutting size and attack surface.
Writing a Dockerfile for a web app
FROM a base, set WORKDIR, install dependencies before app code for cache reuse, EXPOSE the port, CMD the start command.
CI/CD pipeline for a container PaaS
Run tests, build the image, push the tag to a registry, then deploy it to Cloud Run. The registry is the build-to-deploy handoff.
Docker layers and build cache efficiency
Each instruction makes a content-addressed read-only layer stacked by a union FS; shared layers are pushed/pulled once, and ordering the Dockerfile so volatile steps come last maximizes cache reuse.
Create a Deployment with 3 replicas via kubectl
Kubectl create deployment webapp --image=my-app:1.0, then kubectl scale to 3 replicas, or use --replicas if supported.
Manifest lists and multi-arch images
A manifest list maps platform descriptors to per-arch image manifests, the client picks by os and architecture, and pulls only that variant.
Three techniques to shrink a Docker image
Multi-stage builds to drop build tooling, smaller base images like slim or distroless, and fewer or cleaner layers plus dockerignore.
Tag and push an image to a private registry
Authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.
Docker Compose profiles for optional services
Profiles tag services so they stay off by default, activate via --profile or COMPOSE_PROFILES, and unprofiled services always run.
Optimizing Dockerfile layer caching
Order instructions least-to-most volatile, copy dependency manifests and install before copying source, and understand any changed layer busts all later layers.
Structuring Compose files across environments
A base compose.yaml plus override files, the default override auto-merge, and explicit -f flags or extends per environment.
Explain multi-stage Docker builds for Python and builder vs runtime
Tests separation of build-time and runtime concerns. A strong answer contrasts the builder stage (gcc, headers, wheels) with the runtime stage (slim base, copied artifacts, no compiler). Red flag: citing size alone while ignoring security and caching.
How do you manage configuration and secrets for a containerized FastAPI app?
Tests 12-factor config separation and Docker secret hygiene. A strong answer uses pydantic-settings with runtime env vars, lru_cache, and keeps .env out of the image. Red flag: baking credentials into Dockerfile layers or committing .env files.
Get Docker bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.