Containers & Docker interview questions

Namespaces and cgroups, image layering, multi-stage builds, and container security basics.

4 questions in DevOps & Cloud.

DevOps and CloudA 24-minute read on how the topic fits together, before the questions.DevOps and cloud fundamentals57 short answers on one page, for revising rather than studying.

medium3

mediumScenarioConceptDesign

Your source control stores every version of a 200MB binary and the repository is now 40GB. What is being stored, and why can you not delete it?

Roughly 200 near-full copies, because delta compression works on text and a relinked binary differs throughout, so each version costs almost its own size. Deleting the file changes nothing: history is content-addressed and every past commit still reaches the blob. The design fix is that build outputs belong in a registry that can expire them, because version control is built never to forget.

6 minmid, senior, staff

mediumConceptScenario

What happens when a container hits its CPU limit, and what happens when it hits its memory limit?

Container CPU and memory limits fail differently: CPU limits throttle work, while memory limits can trigger OOMKilled restarts. Debug by comparing requests, limits, actual usage and runtime-specific memory settings. Use this containers answer to show the decision, trade-off, and evidence rather than a memorised definition. It also connects cgroups to the point an interviewer is testing.

5 minmid, senior, staff

mediumConcept

What is a container image, and why is a container not a virtual machine?

A container image is layered filesystem content plus runtime config, while a container is a host process isolated by namespaces and cgroups. A virtual machine boots its own guest kernel, so the isolation boundary and startup model are different.

5 minentry, mid, senior

hard1

hardScenarioDesign

Two replicas of the same deployment are running different code, and both were started from the same image tag. How did that happen and what do you change?

A tag is a mutable pointer in the registry, so re-pushing it makes the same reference resolve to different content over time. Nodes that already cached the old digest keep serving it, so the fix is to deploy by digest and let the tag be a human label rather than the deployed identity.

6 minmid, senior, staff