78 Docker & Kubernetes interview questions with answers (2026)

All Docker & Kubernetes interview questions

What is Docker? Why is it useful in development and deployment?

What is a Dockerfile? What are its basic instructions?

What are multi-stage builds in Docker? What are the benefits?

What is Docker? What does a frontend developer need to know about it?

What problem does Docker solve?

How are a Docker image and a container different?

How does Dockerfile layer cache work?

How are `CMD` and `ENTRYPOINT` different?

How are `COPY` and `ADD` different?

When should you use Docker multi-stage builds?

How important is `.dockerignore`?

What should you understand about Docker port publishing and container networking?

How should environment variables and secrets be handled in Docker/Compose?

When should Docker `HEALTHCHECK` be used?

How should a production Docker image be hardened?

How are Docker tags and digests different?

How should containers handle logs and state?

How are Deployment, ReplicaSet, StatefulSet and DaemonSet different?

How are Kubernetes Service types different?

What is Ingress used for in Kubernetes?

How are readiness, liveness and startup probes different?

What are CPU/memory requests and limits used for in Kubernetes?

What should be configured for low-downtime Kubernetes rolling updates?

How important are labels and selectors in Kubernetes?

How are PersistentVolume, PersistentVolumeClaim and StorageClass different?

What workloads should use StatefulSet?

When should init containers be used?

When should sidecar containers be used in Kubernetes?

What should be configured in Pod/container SecurityContext?

What should you understand about `imagePullPolicy` and registry strategy?

How are Helm and Kustomize different?

Which commands are commonly used to debug a failing Pod?

What is NetworkPolicy used for in Kubernetes?

How do you debug CrashLoopBackOff, ImagePullBackOff and Pending?

Where should Docker Compose and Kubernetes be used?

What is a service mesh and what problem does it solve for microservices?

How is a container different from a virtual machine?

Which Linux mechanisms let containers stay isolated from each other?

What states does a container move through in its lifecycle?

How do Docker restart policies differ?

How do you limit a container's CPU and memory?

How do taints and tolerations work?

What are node affinity and pod affinity/anti-affinity for?

How does the kube-scheduler decide which node to place a Pod on?

What are Custom Resources (CRDs) and the Operator pattern?

How do Pods on different nodes communicate with each other?

What is Infrastructure as Code, and how does Terraform differ from Ansible?

Why should a Dockerfile `COPY package.json` and install dependencies before copying the whole source tree?

How do you choose between `alpine`, `slim`, and `distroless` base images? What problems does Alpine cause with Node/Python?

The build machine ran out of disk because of Docker. How do you clean up safely, and what does `docker system prune` actually remove?

In Docker Compose, what host does the `api` service use to reach `db`? Why does `localhost` not work?

How does `CMD npm start` differ from `CMD ["npm", "start"]`? How do exec form and shell form affect `ENTRYPOINT`?

`docker stop` hangs for exactly 10 seconds before the container dies, and in-flight requests are cut off. Why, and how do you fix it?

My Node image is 1.2 GB. How do I use a multi-stage build to shrink it?

I pass a private registry token via `ARG` at build time. Why does that leak the secret, and what should I use instead?

Why should containers not run as root, and how do you handle permission errors after switching to a non-root user?

A container shows `unhealthy` but Docker never restarts it even with `restart: always`. Why?

Mounting source code into the container for hot reload makes `node_modules` disappear. Why, and how do bind mounts differ from named volumes?

CI builds always miss the cache even when the Dockerfile is unchanged. Why, and how do you exploit BuildKit caching?

An image built on an M1 MacBook fails with `exec format error` on the server. What happened and how do you fix it?

A container dies abruptly with exit code 137. How do you diagnose and fix it?

I `RUN rm -rf` a large file on the next line but the image size does not drop. Why? How do layers work?

`kubectl get pod` shows STATUS `Running` but READY is `0/1` — what does that mean?

I applied an Ingress but the domain returns nothing. Why?

Why create a Deployment instead of a Pod directly?

How do you call a Service running inside the cluster from your local machine?

How can a misconfigured liveness probe cause a restart loop? How do you design probes correctly?

How is a Pod QoS class determined? Which Pods get evicted first when a node runs out of memory?

A Pod is `OOMKilled` — how do you diagnose and fix it?

If I edit a ConfigMap/Secret, do running Pods pick up the new values?

An in-cluster Service call returns 503 / connection refused while Pods are Running — what is your debug order?

How does cluster DNS work, and why are external domain lookups from a Pod slow?

How do ResourceQuota and LimitRange differ, and what are they for?

A service shows high p99 latency but CPU graphs sit around 30%. How is the CPU limit involved?

Rolling updates still produce 502s even with a readiness probe configured. Why, and how do you fix it?

What is a PodDisruptionBudget for, and what does it not protect against?

HPA reacts slowly to traffic spikes, or scales up and down repeatedly. Why, and how do you tune it?

How does operating a StatefulSet differ from a Deployment? Does scaling down lose data?

All Docker & Kubernetes interview questions

What is Docker? Why is it useful in development and deployment?
What is a Dockerfile? What are its basic instructions?
What are multi-stage builds in Docker? What are the benefits?
What is Docker? What does a frontend developer need to know about it?
What problem does Docker solve?
How are a Docker image and a container different?
How does Dockerfile layer cache work?
How are `CMD` and `ENTRYPOINT` different?
How are `COPY` and `ADD` different?
When should you use Docker multi-stage builds?
How important is `.dockerignore`?
What should you understand about Docker port publishing and container networking?
How should environment variables and secrets be handled in Docker/Compose?
When should Docker `HEALTHCHECK` be used?
How should a production Docker image be hardened?
How are Docker tags and digests different?
How should containers handle logs and state?
How are Deployment, ReplicaSet, StatefulSet and DaemonSet different?
How are Kubernetes Service types different?
What is Ingress used for in Kubernetes?
How are readiness, liveness and startup probes different?
What are CPU/memory requests and limits used for in Kubernetes?
What should be configured for low-downtime Kubernetes rolling updates?
How important are labels and selectors in Kubernetes?
How are PersistentVolume, PersistentVolumeClaim and StorageClass different?
What workloads should use StatefulSet?
When should init containers be used?
When should sidecar containers be used in Kubernetes?
What should be configured in Pod/container SecurityContext?
What should you understand about `imagePullPolicy` and registry strategy?
How are Helm and Kustomize different?
Which commands are commonly used to debug a failing Pod?
What is NetworkPolicy used for in Kubernetes?
How do you debug CrashLoopBackOff, ImagePullBackOff and Pending?
Where should Docker Compose and Kubernetes be used?
What is a service mesh and what problem does it solve for microservices?
How is a container different from a virtual machine?
Which Linux mechanisms let containers stay isolated from each other?
What states does a container move through in its lifecycle?
How do Docker restart policies differ?
How do you limit a container's CPU and memory?
How do taints and tolerations work?
What are node affinity and pod affinity/anti-affinity for?
How does the kube-scheduler decide which node to place a Pod on?
What are Custom Resources (CRDs) and the Operator pattern?
How do Pods on different nodes communicate with each other?
What is Infrastructure as Code, and how does Terraform differ from Ansible?
Why should a Dockerfile `COPY package.json` and install dependencies before copying the whole source tree?
How do you choose between `alpine`, `slim`, and `distroless` base images? What problems does Alpine cause with Node/Python?
The build machine ran out of disk because of Docker. How do you clean up safely, and what does `docker system prune` actually remove?
In Docker Compose, what host does the `api` service use to reach `db`? Why does `localhost` not work?
How does `CMD npm start` differ from `CMD ["npm", "start"]`? How do exec form and shell form affect `ENTRYPOINT`?
`docker stop` hangs for exactly 10 seconds before the container dies, and in-flight requests are cut off. Why, and how do you fix it?
My Node image is 1.2 GB. How do I use a multi-stage build to shrink it?
I pass a private registry token via `ARG` at build time. Why does that leak the secret, and what should I use instead?
Why should containers not run as root, and how do you handle permission errors after switching to a non-root user?
A container shows `unhealthy` but Docker never restarts it even with `restart: always`. Why?
Mounting source code into the container for hot reload makes `node_modules` disappear. Why, and how do bind mounts differ from named volumes?
CI builds always miss the cache even when the Dockerfile is unchanged. Why, and how do you exploit BuildKit caching?
An image built on an M1 MacBook fails with `exec format error` on the server. What happened and how do you fix it?
A container dies abruptly with exit code 137. How do you diagnose and fix it?
I `RUN rm -rf` a large file on the next line but the image size does not drop. Why? How do layers work?
`kubectl get pod` shows STATUS `Running` but READY is `0/1` — what does that mean?
I applied an Ingress but the domain returns nothing. Why?
Why create a Deployment instead of a Pod directly?
How do you call a Service running inside the cluster from your local machine?
How can a misconfigured liveness probe cause a restart loop? How do you design probes correctly?
How is a Pod QoS class determined? Which Pods get evicted first when a node runs out of memory?
A Pod is `OOMKilled` — how do you diagnose and fix it?
If I edit a ConfigMap/Secret, do running Pods pick up the new values?
An in-cluster Service call returns 503 / connection refused while Pods are Running — what is your debug order?
How does cluster DNS work, and why are external domain lookups from a Pod slow?
How do ResourceQuota and LimitRange differ, and what are they for?
A service shows high p99 latency but CPU graphs sit around 30%. How is the CPU limit involved?
Rolling updates still produce 502s even with a readiness probe configured. Why, and how do you fix it?
What is a PodDisruptionBudget for, and what does it not protect against?
HPA reacts slowly to traffic spikes, or scales up and down repeatedly. Why, and how do you tune it?
How does operating a StatefulSet differ from a Deployment? Does scaling down lose data?