Easy interview questions in Docker & Kubernetes
What is a container vs a VM?
Containers share the host kernel and isolate via namespaces and cgroups; VMs run a full guest OS on a hypervisor; containers are lighter and faster.
How do Docker images and containers differ and relate?
This tests your grasp of the immutable template versus mutable runtime boundary. A good answer: an image is a read-only layered template with code and dependencies; a container is a runnable instance with a writable layer on top.
Build, tag, and run a container with port mapping
Docker build -t my-app:1.0 . to build and tag; docker run -d -p 8080:80 my-app:1.0 to run detached with host:container port mapping.
Dockerfile COPY versus ADD
COPY just copies local files; ADD also auto-extracts local tarballs and can fetch remote URLs; prefer COPY for predictability, use ADD for local archive extraction.
Dockerfile CMD versus ENTRYPOINT
ENTRYPOINT sets the fixed executable; CMD sets default args or the default command; run-time args override CMD but append to ENTRYPOINT. Use together to make a fixed binary with overridable defaults.
Start Compose services detached and view one service's logs
Docker compose up -d starts everything detached; docker compose logs -f web follows only the web service's logs.
Persist PostgreSQL data across compose down
Define a named volume and mount it at the database's data directory (/var/lib/postgresql/data); named volumes survive compose down.
How Compose services reach each other by name
Services share a default network and the web app uses the database's service name as the hostname; Docker's embedded DNS resolves it to the container IP.
Tag and push an image to a private registry
Authenticate with docker login, retag the image to include the registry host and repo path, then docker push that full reference.
Why :latest is a production anti-pattern
Latest is mutable so pods run different code, rollbacks and pull policy break, and you should use immutable version tags or digests.
Node, Pod, and Container relationship
A Node is a machine, a Pod is the smallest deployable unit wrapping one or more containers that share network and storage, and the Pod abstraction enables co-location and lifecycle management.
Core control plane components
Api-server as the front door, etcd as state store, scheduler placing pods, and controller-manager running reconciliation loops, plus cloud-controller-manager.
Minimal objects to expose a stateless app
A Deployment to run and self-heal replicas plus a Service to give a stable endpoint, exposed externally via type LoadBalancer or NodePort, or an Ingress.
Deployment, ReplicaSet, and Pod hierarchy
A Deployment manages ReplicaSets, each ReplicaSet keeps a set of identical Pods, and Deployments add rolling updates, rollback, and self-healing.
Create a Deployment with 3 replicas via kubectl
Kubectl create deployment webapp --image=my-app:1.0, then kubectl scale to 3 replicas, or use --replicas if supported.
Debugging a Pod in CrashLoopBackOff
Kubectl describe pod for events, restarts, and last state; kubectl logs (with --previous) for the crashed container's output.
Why Kubernetes Services exist
Pod IPs are ephemeral and change on reschedule; a Service gives a stable virtual IP and DNS name plus load balancing across healthy Pods via label selectors.
ClusterIP vs NodePort vs LoadBalancer
ClusterIP for internal-only access; NodePort opens a port on every node for basic external reach; LoadBalancer provisions a cloud load balancer for production external traffic.
ConfigMap vs Secret
ConfigMaps hold non-sensitive plain config; Secrets hold sensitive data, base64-encoded and treated specially (RBAC, optional encryption at rest).
Two ways to consume a ConfigMap in a Pod
Inject keys as environment variables (good for a few simple settings), or mount the ConfigMap as a volume of files (good for config files and live updates).
We are hiring for this. Every open role lists the topics its interview covers, so you can prepare for the real thing rather than guessing.
See open roles