Docker and CI/CD Middle interview questions and answers

75 questions for a Docker and CI/CD (Middle) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.What is the main benefit of a multi-stage build?
  2. 2.Why does this Dockerfile reinstall all dependencies on every code change? ``dockerfile COPY . . RUN npm ci
  3. 3.Why combine apt-get update and apt-get install in one RUN?
  4. 4.Why does RUN rm -rf /tmp/build in a later layer not shrink the image?
  5. 5.What is the difference between CMD ["node", "server.js"] and CMD node server.js?
  6. 6.Why can a process running as PID 1 in a container misbehave?
  7. 7.What should a Node.js server do on SIGTERM?
  8. 8.Why is CMD ["npm", "start"] discouraged in production images?
  9. 9.After USER node, the app can't write to /app. What's a common fix?
  10. 10.How do you use an npm token during a build without leaving it in the image?
  11. 11.What does RUN --mount=type=cache,target=/root/.npm npm ci give you?
  12. 12.What does BuildKit do with independent stages of a multi-stage build?
  13. 13.How is an image digest different from a tag?
  14. 14.What are <none>:<none> (dangling) images?
  15. 15.What is compose.override.yaml used for?
  16. 16.What are Compose profiles for?
  17. 17.You bind-mount the project into a Node container and the app can't find its modules. Why?
  18. 18.In Compose, what is the difference between the .env file and env_file:?
  19. 19.A container stops with exit code 137. What is the likely cause?
  20. 20.Why may Node.js ignore a container's memory limit and get OOM-killed?
  21. 21.What does --network host do?
  22. 22.Why should containers log to stdout and stderr?
  23. 23.What prevents Docker's default json-file logs from filling the disk?
  24. 24.What does running with --read-only achieve?
  25. 25.What is a distroless image?
  26. 26.Why install only production dependencies in the final image?
  27. 27.What does an image scanner such as Trivy check?
  28. 28.Why is mounting /var/run/docker.sock into a container risky?
  29. 29.An image built on an Apple Silicon Mac fails on an x86 server with exec format error. Why?
  30. 30.What does exec "$@" do at the end of an entrypoint script?
  31. 31.Does Kubernetes use the Dockerfile HEALTHCHECK?
  32. 32.What makes a good cache key for node_modules or the npm cache in CI?
  33. 33.Cache vs artifacts in CI: what's the difference?
  34. 34.What does this do? ``yaml concurrency: group: deploy-${{ github.ref }} cancel-in-progress: true
  35. 35.In a monorepo, how can you avoid running the backend pipeline when only the frontend changed?
  36. 36.What is workflow_dispatch for?
  37. 37.Why set permissions: explicitly for GITHUB_TOKEN?
  38. 38.Why don't workflows triggered by pull_request from forks get repository secrets?
  39. 39.What do deployment environments with required reviewers add?
  40. 40.What is a reusable workflow?
  41. 41.What is a composite action?
  42. 42.Why pin third-party actions to a full commit SHA rather than @v3?
  43. 43.What does OIDC give a CI pipeline that deploys to a cloud provider?
  44. 44.How does one job pass a value, such as an image tag, to another?
  45. 45.How do you run a deploy step only for pushes to main?
  46. 46.What does fail-fast: false change in a matrix?
  47. 47.Why are self-hosted runners risky for public repositories?
  48. 48.Why are Docker builds on fresh CI runners often slow, and what helps?
  49. 49.Why tag images with the commit SHA?
  50. 50.How do you speed up a slow pipeline without dropping checks?
  51. 51.How can integration tests in GitHub Actions get a real PostgreSQL?
  52. 52.What does Testcontainers do?
  53. 53.Why should database migrations stay backward compatible during a deploy?
  54. 54.What is a canary release?
  55. 55.What does a rolling update do?
  56. 56.How do feature flags change the relationship between deploy and release?
  57. 57.What are smoke tests after a deploy for?
  58. 58.Which are the classic DORA metrics?
  59. 59.What does "lead time for changes" measure?
  60. 60.Why do CI and long-lived feature branches work against each other?
  61. 61.What is infrastructure as code?
  62. 62.What is the core idea of GitOps?
  63. 63.Readiness vs liveness probe in Kubernetes: what's the difference?
  64. 64.Why do you usually create a Deployment rather than Pods directly?
  65. 65.Are Kubernetes Secrets encrypted by default?
  66. 66.Resource requests vs limits in Kubernetes: what do they do?
  67. 67.What do maxSurge and maxUnavailable control?
  68. 68.What do Dependabot or Renovate do?
  69. 69.Why shouldn't you overwrite an existing image tag like 1.4.0?
  70. 70.What does needs: change in a GitLab CI job?
  71. 71.CI masks secret values in logs. Why can a secret still leak?
  72. 72.Why should every production deploy go through the pipeline, not a manual docker push from a laptop?
  73. 73.What does docker history my-app help you find?
  74. 74.What does docker compose config print?
  75. 75.What does restore-keys add to a cache step?