✅ Q1 — How do Docker image layers actually work?

Each Dockerfile instruction creates a read-only layer. Layers are cached and reused across images when unchanged. The final container adds a writable layer on top. Layer reuse is why build ordering matters for performance.

✅ Q2 — Why should frequently changing instructions be lower in Dockerfile?

Because Docker cache is layer-based. If an early layer changes, all later layers rebuild. Put stable steps (OS packages, base deps) first and fast-changing code COPY later. This maximizes cache reuse and speeds builds.

✅ Q3 — What is multi-stage build and why is it important?

Multi-stage builds use multiple FROM blocks to separate build and runtime environments. You compile in builder stage and copy only final artifacts to runtime stage. This reduces image size and removes build tools from production image. It improves security and startup speed.

✅ Q4 — Distroless images — when and why use?

Distroless images contain only app runtime and required libs — no shell or package manager. They reduce attack surface and size. Best for production microservices. Downside: harder to debug interactively.

✅ Q5 — Container vs VM — kernel difference at technical level?

Containers share the host kernel using namespaces and cgroups. VMs run separate guest kernels via hypervisor. Containers are lighter and faster but less isolated. Kernel bugs affect all containers.

✅ Q6 — What are namespaces in containers?

Namespaces isolate process views — PID, network, mount, user, IPC, UTS. Each container sees its own isolated environment. That’s how process and network separation is achieved. It’s a Linux kernel feature.

✅ Q7 — What are cgroups?

Control groups limit and measure resource usage like CPU and memory. Docker uses cgroups to enforce container limits. Without limits, one container can starve the host. Kubernetes limits map to cgroups.

✅ Q8 — Why is running containers as root dangerous?

Root inside container is root on host namespace context (unless user namespaces used). Container escape bugs become host root. Always use non-root USER in Dockerfile. Drop capabilities when possible.

✅ Q9 — Difference between CMD and ENTRYPOINT?

ENTRYPOINT defines main executable. CMD provides default arguments. If both present — CMD is appended to ENTRYPOINT. ENTRYPOINT is harder to override; CMD is easier.

✅ Q10 — Why use exec form instead of shell form in CMD?

Exec form (["app"]) passes signals correctly to process. Shell form runs under /bin/sh -c and can swallow signals. Exec form is required for graceful shutdown in containers.

✅ Q11 — Why do containers exit immediately sometimes?

Main process exits. Container lifecycle = main PID lifecycle. If app runs in background and script ends — container stops. Fix by running foreground process.

✅ Q12 — Docker COPY vs ADD — difference?

COPY only copies files. ADD can also extract archives and fetch URLs. ADD has extra behavior — often discouraged for predictability. Prefer COPY unless extraction needed.

✅ Q13 — How do you reduce Docker image size in real projects?

Use slim base images. Multi-stage builds. Remove package caches. Combine RUN steps. Avoid installing unnecessary tools. Use distroless where possible.

✅ Q14 — Why avoid “latest” tag in production images?

Latest is mutable — not reproducible. Deploys become non-deterministic. Always use versioned or SHA tags. Rollback becomes possible only with fixed tags.

✅ Q15 — How does Docker networking work by default?

Default bridge network with NAT. Containers get private IPs. Port mapping exposes to host. Not recommended for multi-host production — orchestration networking used instead.

✅ Q16 — Host network mode — when used?

Container shares host network namespace. No port mapping needed. Lower latency. Used for monitoring agents or high-performance networking. Reduces isolation.

✅ Q17 — What is Docker overlay filesystem (overlay2)?

OverlayFS merges image layers efficiently. Lower layers read-only, upper writable. It reduces storage duplication. overlay2 is default driver in modern Linux Docker.

✅ Q18 — How do you debug container startup failure?

Check docker logs. Inspect entrypoint and command. Run container interactively overriding entrypoint. Verify env vars and mounts. Most failures are config or path errors.

✅ Q19 — Docker build is slow in CI — optimization steps?

Enable layer caching in CI. Use remote cache or buildkit. Reorder Dockerfile for cache hits. Avoid reinstalling dependencies each build.

✅ Q20 — Biggest Docker mistake seen in production?

Fat images + root user + latest tag + no scan. That combination is extremely common — and dangerous. Production images must be minimal, versioned, scanned, non-root.