Docker and CI/CD Senior interview questions and answers

75 questions for a Docker and CI/CD (Senior) interview - with correct answers, explanations and links to the docs.

Take this quiz
  1. 1.Which kernel features do containers rely on for isolation and resource limits?
  2. 2.How do Docker, containerd and runc relate?
  3. 3.What does an OCI image consist of?
  4. 4.Why can appending one line to a 2 GB file in a container be slow?
  5. 5.What does --cap-drop ALL --cap-add NET_BIND_SERVICE do?
  6. 6.What does Docker's default seccomp profile do?
  7. 7.Why is --privileged dangerous?
  8. 8.What does rootless mode or user namespace remapping protect against?
  9. 9.When are standard containers not enough isolation?
  10. 10.What do image signing tools like Sigstore cosign add to a pipeline?
  11. 11.What is an SBOM good for?
  12. 12.What does SLSA build provenance describe?
  13. 13.What helps make a Docker build reproducible?
  14. 14.Why rebuild images regularly even when your code hasn't changed?
  15. 15.How does one tag like node:22 serve both amd64 and arm64 hosts?
  16. 16.Why can a multi-platform build be very slow on CI, and what helps?
  17. 17.What is the difference between --cache-to ...,mode=min and mode=max?
  18. 18.In a monorepo, why might changing one package rebuild every app's Docker image?
  19. 19.Why are environment variables not ideal for highly sensitive secrets?
  20. 20.A Node service has a CPU limit of 0.5 and shows latency spikes under load. Why?
  21. 21.Why can a container's memory usage appear high even when the app's heap is small?
  22. 22.A Node app spawns headless Chrome and the container fills up with zombie processes. Why?
  23. 23.Why do Kubernetes pods sometimes drop requests during a rolling update despite SIGTERM handling?
  24. 24.What does terminationGracePeriodSeconds control?
  25. 25.What is a startup probe for?
  26. 26.Why is it risky for a readiness probe to check a shared downstream database?
  27. 27.Why can CPU-based autoscaling work poorly for an I/O-bound Node service?
  28. 28.What does a PodDisruptionBudget protect against?
  29. 29.You redeploy my-app:latest but some nodes still run old code. Why?
  30. 30.You update a ConfigMap, but the pods still use the old values. Why?
  31. 31.Why is pull_request_target with a checkout of the PR's code dangerous?
  32. 32.What is wrong with run: echo "${{ github.event.pull_request.title }}"?
  33. 33.How can CI cache poisoning happen?
  34. 34.An OIDC trust policy allows any workflow in the org to assume the production role. What's the risk?
  35. 35.Why should changes to .github/workflows get stricter review?
  36. 36.How do you speed up a large test suite that has to run on every PR?
  37. 37.What is the risk of automatically retrying failed tests in CI?
  38. 38.In a promotion pipeline, what changes between staging and production?
  39. 39.What does progressive delivery with automated analysis add to a canary?
  40. 40.Why compare a canary against a baseline running the old version at the same time?
  41. 41.What is the hard part of blue-green deployment for a stateful app?
  42. 42.What is the right order for renaming a column with zero downtime?
  43. 43.Why run heavy data migrations separately from the deploy?
  44. 44.What is a kill switch in feature-flag terms?
  45. 45.What is shadow traffic (dark launching) used for?
  46. 46.When is rolling forward preferred over rolling back?
  47. 47.How does a GitOps controller handle someone changing the cluster by hand?
  48. 48.How are secrets usually handled in a GitOps repository?
  49. 49.Why does a Terraform state file need care?
  50. 50.Why post terraform plan output on infrastructure PRs?
  51. 51.What is the idea behind immutable servers?
  52. 52.What does dev/prod parity mean in twelve-factor terms?
  53. 53.What are ephemeral preview environments?
  54. 54.A team's change failure rate is near zero, but they deploy once a quarter. What does that suggest?
  55. 55.Why do mature teams focus on time to restore more than on avoiding every failure?
  56. 56.Why do small batches reduce deployment risk?
  57. 57.When do release trains make more sense than continuous deployment?
  58. 58.Why prefer ephemeral self-hosted runners that take a single job?
  59. 59.Why avoid Docker-in-Docker with --privileged for building images in CI?
  60. 60.Why do registries need retention policies?
  61. 61.Your scanner reports 40 CVEs, 30 with no fix available. What's a sensible policy?
  62. 62.What is dependency confusion?
  63. 63.A secret was printed in a public CI log. What must happen?
  64. 64.What are the main limits of Docker Compose for production?
  65. 65.What does start_period in a Docker healthcheck do?
  66. 66.Why should frequently changing layers come last and shared base layers stay stable?
  67. 67.What's the risk of running migrations in an init container of a Deployment with several replicas?
  68. 68.What must change to scale a web app that keeps sessions in process memory?
  69. 69.Why add deploy markers to monitoring dashboards?
  70. 70.How can SLO error budgets govern releases?
  71. 71.What do BuildKit's --secret and --ssh have in common?
  72. 72.Why might COPY . . invalidate the cache on every CI run even if no code changed?
  73. 73.What does the --platform=$BUILDPLATFORM trick in a builder stage achieve?
  74. 74.Why should a deploy job use a concurrency group without cancelling runs in progress?
  75. 75.What does docker buildx build attestation (--provenance, --sbom) attach?