Docker and CI/CD Interview Questions and Answers

Sample questions

A few questions from each level with the correct answer and an explanation.

Docker and CI/CD · Junior

1. How does a container differ from a virtual machine?

   Correct answer: It shares the host kernel instead of running its own OS

   Containers are isolated processes on the host kernel (namespaces and cgroups), so they start in milliseconds and use little memory. A VM boots a whole guest OS on virtual hardware.

2. What is the difference between an image and a container?

   Correct answer: An image is a read-only template; a container is a running instance of it

   Like a class and its objects: one image can start many containers. Each container adds its own thin writable layer on top of the image.

3. What is a Dockerfile?

   Correct answer: A text file with the steps to build an image

   Each instruction (FROM, COPY, RUN, CMD...) describes a build step. docker build executes them and produces an image.

4. What does FROM node:22-alpine do in a Dockerfile?

   Correct answer: Sets the base image that the build starts from

   Every build starts from a base image, here the official Node.js 22 image on Alpine Linux. Your instructions add layers on top of it.

Docker and CI/CD · Middle

1. What is the main benefit of a multi-stage build?

   Correct answer: Build tools stay in earlier stages; the final image has only runtime files

   A builder stage installs dev dependencies and compiles; the final stage copies only the output with COPY --from=builder. Images get smaller and safer.

2. Why does this Dockerfile reinstall all dependencies on every code change? ``dockerfile COPY . . RUN npm ci

   Correct answer: Any file change invalidates COPY . ., so npm ci reruns too

   Cache invalidation cascades: once a layer changes, every later layer is rebuilt. Copy package.json and the lockfile, run npm ci, then copy the rest.

3. Why combine apt-get update and apt-get install in one RUN?

   Correct answer: A cached update layer would install packages from a stale index

   If update is its own cached layer, a later change to the install line reuses an old package index. Also clean /var/lib/apt/lists in the same RUN.

4. Why does RUN rm -rf /tmp/build in a later layer not shrink the image?

   Correct answer: Earlier layers still contain the files; deletion only hides them

   Layers are additive. Clean up in the same RUN that created the files, or use a multi-stage build so temporary files never reach the final image.

Docker and CI/CD · Senior

1. Which kernel features do containers rely on for isolation and resource limits?

   Correct answer: Namespaces for isolation and cgroups for resource limits

   PID, network, mount, user and other namespaces give each container its own view; cgroups cap CPU, memory and I/O. There's no separate kernel, which is why kernel bugs matter.

2. How do Docker, containerd and runc relate?

   Correct answer: Docker uses containerd to manage containers; runc starts them

   runc implements the OCI runtime spec and creates the process with namespaces and cgroups. containerd manages images and lifecycles; Kubernetes talks to containerd directly without Docker.

3. What does an OCI image consist of?

   Correct answer: A manifest pointing to a config and a list of layer tarballs

   Everything is content-addressed by digest. A multi-platform image adds an index that points to one manifest per OS and architecture.

4. Why can appending one line to a 2 GB file in a container be slow?

   Correct answer: Overlay storage copies the whole file up to the writable layer first

   Copy-up happens on the first write to a file from a lower layer. Write-heavy data (databases, logs) belongs in volumes, which bypass the storage driver.