Docker
99 bites tagged Docker — interview questions with model answers, and 60-second explainers.
FastAPI Container Build and Deploy Pipeline
Treat the Docker image as the immutable artifact: one build runs everywhere. Deploy FastAPI workers behind a load balancer, one process per container. The footgun is baking secrets into the image or running multiple processes; that breaks horizontal scaling.
How do you configure Docker for host GPU access and CUDA libraries?
This tests GPU passthrough via the NVIDIA Container Toolkit. Strong answers use nvidia/cuda base images matching the host driver, pass GPUs with --gpus all, and avoid installing drivers inside the container.
Why avoid global Python dependencies for ML, and how do containers help?
This probes environment isolation and reproducibility in ML. A strong answer cites global dependency conflicts, system library skew, and brittle environments; then notes containers freeze the full stack for deterministic deployment.
How do you containerize a Python training script for GPU cloud VMs?
This tests reproducible GPU containerization. A strong answer uses an NVIDIA CUDA base image, installs Python dependencies at build time, copies the training script, and runs with --gpus.
Strategies to reduce a 5GB ML Docker image size
Tests multi-stage build hygiene and ML bloat reduction. Strong answers use multi-stage builds, strip CUDA dev libs, use slim bases, and collapse cache cleanup into one RUN. Red flag: rm -rf in a separate RUN step, which still bloats the layer.
Describe two secure methods for providing secrets to a running container
Mention runtime mounts like Docker secrets, orchestrator secret injection, and cloud IAM patterns. Containerized ML security, avoiding baked-in credentials. Proposing .env files baked into layers or committed to git.
How do you version and distribute Docker dev environments consistently?
Tests immutable dev environment distribution. Strong answers cover: versioned Dockerfiles in Git, immutable image tags pushed to a registry, and enforcing identical pulls for CI and developers. Red flag: using the "latest" tag or local Dockerfile rebuilds.
How do you build dev and production Docker images from one source?
Mastery of Docker multi-stage builds for isolating dev and production dependencies. Use a base stage, a dev target with linters and tests, and a lean production target copying only the build artifact. Separate Dockerfiles or dev tools in production.
How do you persist notebooks and artifacts in Docker?
Tests Docker storage abstractions. A strong answer distinguishes bind mounts for live notebook editing from named volumes for datasets and artifacts, and warns against docker commit for persistence. Red flag: treating containers as stateful VMs.
How do you structure a Dockerfile to leverage layer caching for dependencies?
Tests Docker layer invalidation and cache-aware instruction ordering. Copy requirements.txt and run pip install before source code so deps cache independently. Red flag: copying everything at once or installing deps after code, busting cache every build.
Walk me through essential Dockerfile commands for a reproducible Python ML environment
Tests your ability to containerize Python ML scripts reproducibly. A strong answer covers FROM with a pinned slim image, WORKDIR, COPY for requirements and code, RUN pip install, and CMD or ENTRYPOINT.
Docker Image vs. Container: Blueprint vs. Runtime
A Docker image is a read-only blueprint; a container is a live instance with a writable layer. You build an image once in CI and run many containers from it in production. The footgun is mutating a running container without updating the image recipe.
Explain layered filesystems like OverlayFS and their efficiency vs monolithic models
This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.
How do containers enforce CPU and memory limits via cgroups?
Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config. Knowledge that cgroups enforce limits in the kernel, not Docker. Confusing cgroups with namespaces or saying Docker throttles.
Name three Linux namespaces and explain what each one isolates.
Name three of PID, Network, Mount, UTS, IPC, User, Cgroup, Time; say what each hides; cite CLONE_NEW* or /proc/pid/ns. Kernel primitives behind container isolation.
How do Docker images and containers differ and relate?
This tests your grasp of the immutable template versus mutable runtime boundary. A good answer: an image is a read-only layered template with code and dependencies; a container is a runnable instance with a writable layer on top.
Docker Content Trust: Signed Image Verification
Docker Content Trust is a cryptographic tamper-evident seal for image tags. It lets you verify who published an image before pulling from any registry. The footgun is that without DOCKER_CONTENT_TRUST=1, unsigned tags pull silently with no warning.
Container Images Are Stacked Deltas
Images stack read-only layers like transparent sheets, one per Dockerfile step, topped by a thin writable layer. This enables cache reuse and fast pulls. The footgun: removing a file in a later layer hides but does not delete it; those bytes still ship.
OCI: The USB-C of Containers
OCI is the USB-C of containers: open standards that let any compliant runtime execute any image. It prevents vendor lock-in by decoupling image format from runtime. The footgun is treating "Docker image" as proprietary rather than an OCI-compliant bundle.
Design a Docker artifact system for cost, traceability, and speed
Tests cost-speed-auditability tradeoffs for artifacts at scale. Strong answers cover tiered storage with lifecycle policies,immutable build provenance,regional caching, and automated garbage collection. Red flag: infinite mutable storage with no cleanup rules.
How ensure Kubernetes pulls correct new image and why avoid :latest?
Tests immutable tagging and Kubernetes image pull behavior. Strong answers demand unique tags like git SHA, explicit deployment spec updates, and explain :latest's reproducibility failures across nodes.
Walk me through a production-ready Dockerfile for a web app
Tests multi-stage builds, layer caching, and security hardening. A strong answer covers a pinned slim FROM, multi-stage separation of build and runtime, ordered COPY for cache, and a non-root USER.
How do you manage multi-arch container images under a single tag?
This tests image distribution and registry semantics. A strong answer covers manifest lists pointing to per-arch digests, Buildx as the builder driver, and the registry serving correct layer blobs.
How do you version Docker images: Git SHA or SemVer?
Your grasp of immutable artifacts and traceability versus human-readable releases. Tag every build with Git SHA for immutability, then apply SemVer aliases only on promoted images. Treating floating tags like latest or v1 as safe production targets.
Get Docker bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.