Docker Interview Questions and Answers (2026)

Docker is a standard skill for DevOps, cloud and backend roles. These Docker interview questions and answers cover what interviewers ask most, from basic concepts to Dockerfiles, networking, storage and security. Each answer is short enough to say in an interview, with commands you can try in a lab.

Basics

1. What is Docker?

Docker is a platform for building, shipping and running applications in containers. A container packages an application with its libraries and settings, so it runs the same way on a laptop, a test server or in the cloud.

2. How is a container different from a virtual machine?

A virtual machine includes a full guest operating system on top of a hypervisor. A container, by contrast, shares the host’s kernel and isolates processes with Linux namespaces and cgroups. Therefore, containers start in seconds and use far less memory, while VMs offer stronger isolation.

3. Explain images vs containers.

An image is a read-only template made of layers. A container is a running instance of an image, with a thin writable layer on top. You can start many containers from one image.

4. Name the main components of Docker.

• Docker Engine: the daemon (dockerd), its REST API and the docker CLI.
• containerd and runc: the lower-level runtime that actually starts containers.
• Registries: such as Docker Hub or a private registry, which store images.
• Docker Compose: a tool to run multi-container applications.

5. Which commands do you use most?

docker pull nginx:1.27
docker run -d --name web -p 8080:80 nginx:1.27
docker ps
docker logs -f web
docker exec -it web sh
docker stop web && docker rm web
docker images

Dockerfiles and images

6. What is a Dockerfile?

It is a text file with instructions to build an image, such as FROM, RUN, COPY, ENV, EXPOSE and CMD.

7. CMD vs ENTRYPOINT: what is the difference?

ENTRYPOINT sets the main executable, and it is harder to override. CMD provides default arguments, which users can override at docker run. A common pattern uses both: ENTRYPOINT ["python"] and CMD ["app.py"].

8. COPY vs ADD?

Both copy files into the image. ADD can also extract local tar archives and fetch URLs. Best practice is to use COPY unless you need those extras.

9. How do you keep images small?

• Use slim or distroless base images.
• Use multi-stage builds to leave build tools behind.
• Combine related RUN steps and clean package caches.
• Add a .dockerignore file.

10. Explain layer caching.

Each instruction creates a layer. Docker reuses cached layers until an instruction changes. Therefore, copy dependency files and install packages before copying the rest of the source code.

Storage and networking

11. How does Docker persist data?

Container filesystems disappear when you remove the container. For lasting data, use volumes (managed by Docker) or bind mounts (a host directory). For example: docker run -v pgdata:/var/lib/postgresql/data postgres:17.

12. Describe Docker’s network drivers.

• bridge: the default for containers on one host.
• host: the container shares the host’s network stack.
• none: no networking.
• overlay: connects containers across hosts in Swarm.
• macvlan: gives a container its own MAC address on the LAN.

Containers on the same user-defined bridge network can reach each other by name.

13. What does -p 8080:80 mean?

It publishes container port 80 on host port 8080.

Compose and orchestration

14. Why use Docker Compose?

Compose defines services, networks and volumes in a compose.yaml file. Then docker compose up -d starts the whole application. For a real example, see our guide to self-hosting n8n with Docker Compose.

15. Docker Swarm vs Kubernetes?

Both orchestrate containers across many hosts. Swarm is simpler and built into Docker. Kubernetes is more powerful and is the industry standard for large deployments.

Security and troubleshooting

16. How do you secure containers?

• Run as a non-root user with USER.
• Use trusted, minimal base images and scan them for vulnerabilities.
• Never put secrets in images; use secrets managers or environment injection at runtime.
• Drop Linux capabilities and use read-only filesystems where possible.
• Keep Docker Engine and images patched.

17. Why is the Docker socket sensitive?

Access to /var/run/docker.sock effectively gives root on the host. So never mount it into untrusted containers.

18. A container exits immediately. How do you troubleshoot it?

Check docker ps -a for the exit code, read docker logs, and inspect settings with docker inspect. Often, the main process finished or crashed, because a container lives only as long as its main process.

19. What is the difference between docker stop and docker kill?

stop sends SIGTERM and waits, then sends SIGKILL. kill sends SIGKILL immediately by default.

20. How do you clean up unused resources?

Use docker system prune, and add -a --volumes with care, because it also removes unused images and volumes.

Keep preparing

Practise each answer out loud, and run the commands in a lab rather than memorising them. Interviewers often ask follow-up questions, so make sure you understand why each answer is true.

Sources

• Docker documentation

Preparing for an interview? Browse more questions in our interview preparation hub. For businesses, we also offer security services such as VAPT, server hardening and ISO 27001 readiness.