Docker &amp; Kubernetes

What is a container vs a VM?

Containers share the host kernel and isolate via namespaces and cgroups; VMs run a full guest OS on a hypervisor; containers are lighter and faster.

easy2 min read

How do Docker images and containers differ and relate?

This tests your grasp of the immutable template versus mutable runtime boundary. A good answer: an image is a read-only layered template with code and dependencies; a container is a runnable instance with a writable layer on top.

Name three Linux namespaces and explain what each one isolates.

Name three of PID, Network, Mount, UTS, IPC, User, Cgroup, Time; say what each hides; cite CLONE_NEW* or /proc/pid/ns.

How do containers enforce CPU and memory limits via cgroups?

Cover CPU CFS quota and shares, memory limits and OOM, and runtime cgroup config.

Describe the relationship between containerd and runc in starting a container.

Tests the OCI runtime split and lifecycle ownership. A great answer states containerd handles image pull, storage, and API lifecycle, then invokes runC to spawn the isolated process.

Explain layered filesystems like OverlayFS and their efficiency vs monolithic models

This tests copy-on-write layering and deduplication in container storage. A strong answer covers lowerdir/upperdir/merged mounts, layer reuse across images, and why diff-based distribution beats monolithic blobs.

What is the OCI and why do its specs matter?

OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.

Trace a container process's syscalls from the host

Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.

Build, tag, and run a container with port mapping

Docker build -t my-app:1.0 . to build and tag; docker run -d -p 8080:80 my-app:1.0 to run detached with host:container port mapping.

Dockerfile COPY versus ADD

COPY just copies local files; ADD also auto-extracts local tarballs and can fetch remote URLs; prefer COPY for predictability, use ADD for local archive extraction.

Dockerfile CMD versus ENTRYPOINT

ENTRYPOINT sets the fixed executable; CMD sets default args or the default command; run-time args override CMD but append to ENTRYPOINT. Use together to make a fixed binary with overridable defaults.

Optimize Dockerfile layer caching for npm install

Copying all source first invalidates the npm install layer on any code change; instead copy package.json and lockfile, run npm install, then copy the rest.

Multi-stage builds for compiled languages

Build in a stage with the full toolchain, then COPY --from only the artifact into a tiny final base, shrinking image size and attack surface.

Debug a running container with the Docker CLI

Docker inspect for full state and config, docker logs -f to follow output live, docker exec -it <id> sh or bash for an interactive shell.

What is a dangling image and how to prune it

A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.

Run a container as a non-root user

Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.

Pass build-time secrets securely with BuildKit

Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.

Distroless images: benefits and trade-offs

Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.

Start Compose services detached and view one service's logs

Docker compose up -d starts everything detached; docker compose logs -f web follows only the web service's logs.