Docker &amp; Kubernetes

Bind mounts versus named volumes

A bind mount maps a host path into the container (great for live source in dev); a named volume is Docker-managed storage decoupled from the host layout (ideal for database data).

Compose image directive versus build directive

Image pulls a prebuilt image from a registry; build builds from a local Dockerfile and context; use build for your own custom application code.

Manage startup order and readiness in Compose

Depends_on only orders start, not readiness; add a healthcheck to the DB and use depends_on with condition: service_healthy so the web app waits until the DB passes its health check.

Docker Compose default networking

Compose creates one default user-defined bridge network for the project; all services join it and reach each other by service name via embedded DNS, isolated from other projects.

How Compose services reach each other by name

Services share a default network and the web app uses the database's service name as the hostname; Docker's embedded DNS resolves it to the container IP.

Persist PostgreSQL data across compose down

Define a named volume and mount it at the database's data directory (/var/lib/postgresql/data); named volumes survive compose down.

Start Compose services detached and view one service's logs

Docker compose up -d starts everything detached; docker compose logs -f web follows only the web service's logs.

Distroless images: benefits and trade-offs

Distroless ships only the app and runtime deps, no shell or package manager; smaller and a smaller attack surface than Alpine; trade-off is harder debugging with no shell.

Pass build-time secrets securely with BuildKit

Use BuildKit RUN --mount=type=secret (or type=ssh) so the secret is mounted only during that step and never written to a layer; pass it with --secret at build time.

Run a container as a non-root user

Create a dedicated group and user, chown app files to them, then USER to drop privileges before the process runs.

What is a dangling image and how to prune it

A dangling image is an untagged layer (<none>:<none>) orphaned when a tag moves to a rebuilt image; list with docker images -f dangling=true, remove with docker image prune.

Debug a running container with the Docker CLI

Docker inspect for full state and config, docker logs -f to follow output live, docker exec -it <id> sh or bash for an interactive shell.

Multi-stage builds for compiled languages

Build in a stage with the full toolchain, then COPY --from only the artifact into a tiny final base, shrinking image size and attack surface.

Optimize Dockerfile layer caching for npm install

Copying all source first invalidates the npm install layer on any code change; instead copy package.json and lockfile, run npm install, then copy the rest.

Dockerfile CMD versus ENTRYPOINT

ENTRYPOINT sets the fixed executable; CMD sets default args or the default command; run-time args override CMD but append to ENTRYPOINT. Use together to make a fixed binary with overridable defaults.

Dockerfile COPY versus ADD

COPY just copies local files; ADD also auto-extracts local tarballs and can fetch remote URLs; prefer COPY for predictability, use ADD for local archive extraction.

Build, tag, and run a container with port mapping

Docker build -t my-app:1.0 . to build and tag; docker run -d -p 8080:80 my-app:1.0 to run detached with host:container port mapping.

Trace a container process's syscalls from the host

Find the host PID via docker inspect or ps, then strace -p that PID from the host, since the container shares the host kernel.

What is the OCI and why do its specs matter?

OCI defines vendor-neutral specs for image format and runtime so any compliant tool interoperates; runc implements the runtime spec; this prevents lock-in.