Top 25 Docker Interview Questions and Answers for Freshers in 2026
Docker is a widely used platform for packaging and running applications in containers. It helps developers and operations teams create consistent environments for development, testing, and deployment.
Docker knowledge is valuable for candidates applying for DevOps Engineer, Cloud Engineer, Software Engineer, Infrastructure Engineer, and Platform Engineer roles.
If you are preparing for a Docker interview in 2026, this guide covers 25 important questions and answers, from basic container concepts to Dockerfiles, networking, storage, security, and troubleshooting.
1. What Is Docker?
Docker is a platform for building, distributing, and running applications in containers.
Containers package an application and its required dependencies into an isolated execution environment.
Docker is commonly used for:
Application development and testing
Consistent development environments
Microservices deployment
CI/CD pipelines
Cloud application deployment
Container-based application management
Docker helps reduce differences between development and deployment environments, although operating system, architecture, configuration, and external dependencies can still affect application behavior.
2. What Is a Container?
A container is an isolated process or group of processes that runs using the host operating system's kernel.
Containers package applications with their dependencies and configuration, helping them run consistently across supported environments.
Containers generally start faster and use fewer resources than full virtual machines because they do not each require a separate guest operating system kernel.
However, containers still require suitable resource allocation, security controls, and monitoring.
3. What Is a Docker Image?
A Docker image is a read-only template used to create containers.
An image contains the application files, dependencies, metadata, and configuration needed to start a container.
Images are commonly built using a Dockerfile and stored in container registries.
Example:
docker pull nginx:stable
docker imagesThe first command downloads the specified NGINX image if needed. The second lists locally available images.
For production workloads, use trusted images and manage versions carefully.
4. What Is the Difference Between a Docker Image and a Container?
A Docker image is the template. A container is a running or stopped instance created from an image.
For example, one NGINX image can be used to create multiple containers.
The image provides the application files and defaults, while each container has its own writable container layer and runtime configuration.
Persistent application data should normally be stored in volumes or other appropriate storage systems rather than relying on the container's writable layer.
5. What Is a Dockerfile?
A Dockerfile is a text file containing instructions used to build a Docker image.
Common instructions include:
FROM— selects a base imageWORKDIR— sets the working directoryCOPY— copies files into the imageRUN— executes commands during the buildENV— defines environment variablesEXPOSE— documents an intended container portCMD— specifies the default commandENTRYPOINT— defines the executable to run
Example:
FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
CMD ["python", "app.py"]This is a basic example. A production Dockerfile should also consider dependency pinning, non-root execution, build context exclusions, image size, and security.
6. What Is the Difference Between CMD and ENTRYPOINT?
Both instructions influence the command executed when a container starts, but they have different purposes.
CMD provides a default command or default arguments.
ENTRYPOINT defines the executable that the container is intended to run.
Example:
FROM alpine:3.21
ENTRYPOINT ["echo"]
CMD ["Hello from Docker"]Running the image without extra arguments prints the default message. Supplying a replacement command-line argument can change the text passed to echo.
Using the exec form, shown with JSON-style arrays, is generally preferred for predictable signal handling.
7. What Is a Docker Registry?
A Docker registry stores and distributes container images.
Developers can push images to registries and pull them onto machines where containers need to run.
Examples include:
Docker Hub
Amazon Elastic Container Registry (Amazon ECR)
Azure Container Registry
Google Artifact Registry
Self-hosted container registries
Organizations should use suitable authentication, access permissions, image scanning, and image-version management when operating registries.
8. What Is Docker Hub?
Docker Hub is a hosted container registry used to store and distribute images.
It provides public and private repositories, subject to the applicable account and service limits.
Common commands include:
docker login
docker pull nginx:stable
docker tag myapp:latest username/myapp:v1
docker push username/myapp:v1Authenticate securely before pushing images. Avoid including passwords, tokens, or other credentials in Dockerfiles or source code.
9. What Is a Docker Volume?
A Docker volume provides persistent storage that can exist independently of a container's lifecycle.
Volumes are useful for application data that must remain available when a container is recreated.
Example:
docker volume create app-data
docker run -d \
--name web-app \
-v app-data:/data \
nginx:stableThis creates a volume and mounts it at /data inside the container.
Volumes are commonly used for persistent files, application data, and supported database storage configurations. Production data still requires appropriate backup, access-control, and recovery planning.
10. What Is the Difference Between a Volume and a Bind Mount?
Both volumes and bind mounts connect storage to a container, but they are managed differently.
Volumes:
Managed by Docker.
Stored in Docker-managed storage locations by default.
Useful for persistent application data.
Bind mounts:
Connect a specific host file or directory to a container path.
Depend on a host path.
Commonly used for local development and access to specific host files.
Example bind mount:
docker run --rm \
-v "$PWD:/app" \
-w /app \
python:3.12-slim \
python --versionBind mounts can expose sensitive host files, so mount only the directories the application actually needs.
11. What Is Docker Networking?
Docker networking allows containers to communicate with one another, the host, and external systems according to the network configuration.
Common network drivers include:
Bridge: Commonly used for communication between containers on a single Docker host.
Host: Uses the host's network namespace on supported platforms.
None: Disables normal container networking.
Overlay: Supports communication across multiple Docker hosts in supported configurations.
For many applications using Docker Compose, a user-defined bridge network provides service-name-based communication between containers.
12. What Is Port Mapping in Docker?
Port mapping makes a container's network port accessible through a port on the Docker host.
Example:
docker run -d \
--name web-server \
-p 8080:80 \
nginx:stableIn this example, traffic to host port 8080 is forwarded to container port 80.
Port mapping is useful when accessing web applications or APIs running inside containers.
Be careful when binding ports on public interfaces. Use appropriate firewall rules, authentication, and network restrictions.
13. What Is Docker Compose?
Docker Compose is a tool for defining and managing multi-container applications using a YAML configuration file.
It is useful for applications that need multiple services, such as:
A frontend
A backend API
A database
A cache
Supporting development services
Example:
services:
web:
image: nginx:stable
ports:
- "8080:80"Save this as compose.yaml and run:
docker compose up -d
docker compose ps
docker compose downCompose simplifies local development and suitable single-host deployments. It is not the same as a multi-node orchestrator such as Kubernetes.
14. What Is the Difference Between Docker and a Virtual Machine?
Docker containers and virtual machines provide different forms of isolation.
Containers:
Share the host kernel.
Commonly start quickly.
Package application dependencies.
Often have relatively low overhead.
Virtual machines:
Run a guest operating system on virtualized hardware.
Can use different guest kernels from the host.
Provide a different isolation boundary.
Commonly require more resources than an equivalent containerized process.
Neither technology is automatically secure in every configuration. The right choice depends on workload requirements, isolation needs, compatibility, and operational constraints.
15. What Is a Multi-Stage Docker Build?
A multi-stage build uses multiple FROM instructions in a Dockerfile.
One stage can compile or build an application, while a later stage contains only the runtime files needed to execute it.
Example:
FROM golang:1.24 AS builder
WORKDIR /src
COPY . .
RUN go build -o app .
FROM debian:stable-slim
WORKDIR /app
COPY --from=builder /src/app ./app
CMD ["./app"]This pattern can reduce the final image size by leaving compilers and other build tools out of the runtime image.
The final image still needs all runtime dependencies, and the base images should be selected and maintained carefully.
16. What Is a Docker Layer?
Docker images are built from layers that represent filesystem changes and related image metadata.
Build instructions can create reusable layers. Docker can cache layers to avoid repeating unchanged build steps.
For better caching:
Copy dependency manifests before frequently changing source files.
Install dependencies in a separate build step.
Use
.dockerignoreto exclude unnecessary files.Avoid copying large temporary directories into the image.
Use multi-stage builds when appropriate.
Efficient layer design can reduce build time, image transfer time, and storage consumption.
17. What Is a .dockerignore File?
A .dockerignore file specifies files and directories that should be excluded from the Docker build context.
Example:
.git
node_modules
.env
__pycache__
*.log
distThe entries should match the actual application and build requirements.
Excluding unnecessary files can reduce build time and prevent sensitive or irrelevant content from being copied into images.
Do not rely on .dockerignore alone to protect secrets. Never deliberately copy credentials into a container image.
18. How Do You Check Docker Container Logs?
Use the docker logs command to view a container's standard output and standard error.
Examples:
docker logs web-server
docker logs --tail 100 web-server
docker logs -f web-server
docker logs --since 10m web-serverThese commands show all available logs, the latest 100 lines, continuously follow new output, or show recent logs from the specified period.
For troubleshooting, inspect timestamps, error messages, application configuration, and relevant events. Applications must write useful output to streams or configure appropriate logging for their logs to appear here.
19. How Do You Troubleshoot a Container That Exits Immediately?
First, inspect the container's state and exit code.
Useful commands include:
docker ps -a
docker logs <container-name>
docker inspect <container-name>
docker start -a <container-name>Common causes include:
The main process completed normally.
The application encountered an error.
The command or entrypoint is incorrect.
Required environment variables are missing.
A dependency is unavailable.
File permissions are incorrect.
The container ran out of memory.
A container normally remains running only while its main process remains active. A container that exits is not necessarily broken; it may have completed its intended task.
20. What Is the Difference Between docker stop and docker kill?
docker stop asks a running container to stop gracefully. Docker sends a stop signal and waits for a configured grace period before forcibly terminating the process if necessary.
docker kill sends a signal to the container's main process, using SIGKILL by default unless another signal is specified.
Graceful shutdown is usually preferable for applications that need to finish requests, flush data, or release resources.
Use forced termination when necessary, but understand the risk of interrupting work.
21. What Is a Docker Health Check?
A Docker health check evaluates whether a container's application is functioning according to a defined command.
Example:
FROM nginx:stable
HEALTHCHECK --interval=30s \
--timeout=5s \
--start-period=10s \
--retries=3 \
CMD ["curl", "-f", "http://localhost/"]This example illustrates the syntax, but the selected image must contain the command used for the check. Some minimal images do not include curl.
A health check can report a container as healthy or unhealthy. By itself, a Docker health check does not automatically restart an unhealthy container in every deployment setup; recovery behavior depends on the surrounding tooling and configuration.
22. How Do You Limit CPU and Memory for a Docker Container?
Docker supports resource constraints that help prevent one container from consuming excessive host resources.
Example:
docker run -d \
--name limited-app \
--memory=512m \
--cpus=1.0 \
nginx:stableThis example sets a memory limit of 512 MB and a CPU limit equivalent to one CPU.
Resource limits should be chosen according to workload requirements. A limit that is too low can cause poor performance or memory-related termination.
23. How Do You Secure Docker Containers?
Container security involves image management, runtime configuration, access control, and host security.
Recommended practices include:
Use trusted, maintained base images.
Scan images for known vulnerabilities.
Run applications as non-root users when possible.
Avoid storing secrets inside images.
Keep Docker and the host operating system updated.
Restrict privileged containers and unnecessary capabilities.
Mount only the host paths required by the application.
Limit network exposure and published ports.
Apply resource limits where appropriate.
Review image provenance and dependencies.
Containers should be treated as part of the application's security boundary, not as a substitute for security controls.
24. What Is the Difference Between docker exec and docker run?
docker run creates and starts a new container from an image.
docker exec runs an additional command inside an already-running container.
Examples:
docker run -d --name test-nginx nginx:stable
docker exec -it test-nginx shThe first command creates a new container. The second starts a shell inside that running container if the image provides a suitable shell.
docker exec is useful for debugging and inspecting a container, but production troubleshooting should also rely on logs, metrics, and reproducible diagnostic procedures.
25. How Do You Push a Docker Image to a Registry?
A typical workflow is:
Build the image.
Tag it with the target registry and repository.
Authenticate securely.
Push the image.
Verify that the expected tag is available.
Example:
docker build -t myapp:1.0 .
docker tag myapp:1.0 username/myapp:1.0
docker login
docker push username/myapp:1.0Replace username with the appropriate registry namespace.
For automated deployments, use a suitable registry such as Amazon ECR or another approved registry, secure authentication, controlled image tags, and a deployment pipeline.
Avoid relying only on the latest tag for production releases because it can change over time.
Practical Docker Projects for Beginners
Building small projects can help you apply Docker concepts instead of relying only on memorized answers.
Project 1: Containerize a Static Website
Run an NGINX container and serve a simple website.
Learn about images, port mapping, container logs, and container lifecycle management.
Project 2: Build a Python Application Image
Create a small Python application and write a Dockerfile.
Learn about dependency installation, working directories, environment variables, and build context exclusions.
Project 3: Run a Multi-Container Application
Use Docker Compose to run a frontend and backend together.
Practise service discovery, environment configuration, port mapping, and container logs.
Project 4: Add Persistent Storage
Create a Docker volume and use it to persist application data beyond the lifecycle of a container.
Test what happens when the container is removed and recreated.
Project 5: Build a CI/CD Pipeline
Create a pipeline that builds an image, runs basic tests, and publishes the image to a registry.
Use protected credentials and avoid publishing untested images to production repositories.
For learning projects, keep resource usage small and remove containers, networks, and volumes that you no longer need.
Docker Interview Preparation Tips
Understand the fundamentals
Be ready to explain images, containers, volumes, networks, registries, and Dockerfiles in your own words.
Practise common commands
Learn how to list containers, inspect images, view logs, copy files, execute commands, and clean up unused resources.
Learn image optimization
Understand build caching, .dockerignore, dependency layers, multi-stage builds, and the benefits of small runtime images.
Prepare for troubleshooting questions
Practise diagnosing containers that exit, applications that cannot connect, port conflicts, missing files, and memory problems.
Understand security
Learn why running as root can be risky, how to manage secrets, and how to minimize container privileges.
Connect Docker with DevOps tools
Explore how Docker integrates with GitHub Actions, Jenkins, container registries, cloud services, and Kubernetes.
Find Docker and DevOps Jobs on Expectin
Docker skills can be useful for several career paths, including:
DevOps Engineer
Cloud Engineer
Platform Engineer
Site Reliability Engineer
Infrastructure Engineer
Backend Developer
Build and Release Engineer
Job requirements vary by employer. Some entry-level positions focus on Docker fundamentals and basic Linux commands, while more advanced roles may require CI/CD pipelines, Kubernetes, cloud platforms, networking, and production troubleshooting.
Visit https://expectin.com to explore available job opportunities and check each vacancy's experience requirements, technical skills, location, and application instructions.
Frequently Asked Questions
Is Docker suitable for freshers?
Yes. Docker is a useful skill for freshers applying for software development, cloud, and DevOps positions. Build small projects and practise the commands used to inspect and troubleshoot containers.
What should I learn before Docker?
Basic Linux commands, networking, application development fundamentals, and command-line usage are helpful starting points.
Is Docker required for DevOps jobs?
Many DevOps positions use containers, but requirements differ. Some jobs focus on cloud infrastructure, automation, and CI/CD, while others expect Docker and Kubernetes expertise.
What is the difference between Docker and Kubernetes?
Docker is commonly used to build and run containers. Kubernetes orchestrates containerized workloads across a cluster, providing scheduling, service discovery, scaling, and workload management.
Can Docker run databases?
Yes. Databases can run in containers, but persistent storage, backups, upgrades, security, and recovery must be planned carefully. A container's writable layer should not be treated as durable database storage.
Where can I find Docker-related jobs?
Visit https://expectin.com to explore current job listings and review the required skills and experience for each vacancy.
About Expectin
Expectin helps job seekers explore career opportunities and access career-related resources. Keep practising, build containerized projects, and take the next step in your software development or DevOps career.