DEV Community: Manish Kumar

40 Docker & Kubernetes Interview Questions You Can't Afford to Skip

Manish Kumar — Mon, 13 Oct 2025 12:51:06 +0000

From Basic to Advanced: Your Complete Guide to Acing Container Orchestration Interviews

Containerization has revolutionized how we build, ship, and run applications. Whether you're a DevOps engineer, a backend developer, or a cloud architect, mastering Docker and Kubernetes is no longer optional—it's essential. This comprehensive guide covers 40 interview questions that will help you prepare for your next role, from foundational concepts to advanced production scenarios.

Part 1: Docker Fundamentals (Questions 1-15)

1. What is Docker, and how does it differ from virtual machines?

Docker is a containerization platform that packages applications and their dependencies into isolated containers. Unlike virtual machines, containers share the host OS kernel, making them lightweight and fast to start. VMs include a full OS copy, consuming more resources and taking longer to boot.

Key differences:

• Containers are process-level isolation; VMs are hardware-level isolation

• Containers start in seconds; VMs take minutes

• Containers use MBs of space; VMs use GBs

• Containers have near-native performance; VMs have overhead

2. Explain the Docker architecture and its main components.

Docker uses a client-server architecture with three main components:

Docker Client: The interface users interact with (docker CLI)

Docker Daemon: The background service that manages containers, images, networks, and volumes

Docker Registry: A repository for Docker images (like Docker Hub)

The client communicates with the daemon via REST API, which then pulls images from registries and manages container lifecycle.

3. What is a Docker image and how is it different from a container?

A Docker image is a read-only template containing the application code, runtime, libraries, and dependencies. It's built from a Dockerfile and serves as a blueprint. A container is a running instance of an image—a live, isolated process with its own filesystem, networking, and resources.

Think of it this way: an image is like a class in programming, while a container is an instance of that class.

4. What is a Dockerfile and what are its key instructions?

A Dockerfile is a text file containing instructions to build a Docker image. Key instructions include:

FROM: Specifies the base image

RUN: Executes commands during build

COPY/ADD: Adds files to the image

WORKDIR: Sets the working directory

ENV: Sets environment variables

EXPOSE: Documents which ports the container listens on

CMD: Default command to run when container starts

ENTRYPOINT: Configures container as an executable

5. What's the difference between CMD and ENTRYPOINT?

Both define what runs when a container starts, but with key differences:

• CMD provides default arguments that can be overridden at runtime

• ENTRYPOINT defines the main command that always runs, with CMD providing default arguments

• You can combine them: ENTRYPOINT defines the executable, CMD provides default parameters

• Best practice: use ENTRYPOINT for the main command and CMD for default flags

6. Explain Docker layers and the layer caching mechanism.

Docker images are built in layers, where each Dockerfile instruction creates a new layer. Layers are cached and reused when possible, speeding up builds. Only changed layers and subsequent layers are rebuilt.

Best practices for layer optimization:

• Order instructions from least to most frequently changing

• Combine related commands with && to reduce layers

• Use .dockerignore to exclude unnecessary files

• Leverage multi-stage builds to minimize final image size

7. What is a multi-stage Docker build?

Multi-stage builds use multiple FROM statements in one Dockerfile, allowing you to copy artifacts between stages while leaving build tools behind. This dramatically reduces final image size.

Example: compile code in a build stage with all development tools, then copy only the binary to a minimal runtime stage. This results in smaller, more secure production images.

8. How do you manage persistent data in Docker?

Docker provides three ways to persist data:

Volumes: Managed by Docker, stored in Docker's storage area, best for production

Bind mounts: Map host directories to container paths, useful for development

tmpfs mounts: Stored in host memory, lost when container stops

Volumes are preferred because they're portable, can be backed up easily, and work across platforms.

9. Explain Docker networking modes.

Docker offers several networking modes:

Bridge (default): Private internal network, containers can communicate within the network

Host: Container uses host's network directly, no isolation

None: No networking, complete isolation

Overlay: Enables communication between containers across multiple Docker hosts

Macvlan: Assigns MAC addresses to containers, making them appear as physical devices

10. What is Docker Compose and when would you use it?

Docker Compose is a tool for defining and running multi-container applications using a YAML file. It simplifies development environments by:

• Defining all services, networks, and volumes in one file

• Starting/stopping the entire stack with single commands

• Enabling service dependencies and startup order

• Managing environment-specific configurations

It's ideal for local development and testing, not typically used in production orchestration.

11. How do you optimize Docker image size?

Key strategies include:

• Use minimal base images (Alpine Linux, distroless images)

• Implement multi-stage builds

• Combine RUN commands to reduce layers

• Clean up package manager caches in the same layer

• Use .dockerignore to exclude unnecessary files

• Remove temporary files and build dependencies

• Choose appropriate base images for your use case

12. What is Docker Registry and Docker Hub?

A Docker Registry is a storage and distribution system for Docker images. Docker Hub is the default public registry, but you can run private registries too. Registries enable:

• Centralized image storage

• Version control with tags

• Access control and security scanning

• Distribution across teams and environments

13. Explain the difference between COPY and ADD in Dockerfile.

Both copy files into the image, but ADD has additional features:

• COPY simply copies files/directories

• ADD can extract tar archives and download from URLs

Best practice: use COPY unless you specifically need ADD's features, as COPY is more explicit and predictable.

14. How do you handle secrets in Docker?

Security best practices for secrets:

• Use Docker secrets (in Swarm mode) or Kubernetes secrets

• Never hardcode secrets in Dockerfiles or images

• Use environment variables at runtime (not build time)

• Employ secret management tools (Vault, AWS Secrets Manager)

• Use multi-stage builds to avoid leaking build-time secrets

• Scan images for exposed secrets with tools like GitGuardian

15. What is the difference between docker stop and docker kill?

• docker stop sends SIGTERM, allowing graceful shutdown (10-second timeout), then SIGKILL

• docker kill immediately sends SIGKILL, forcefully terminating the container

• Use stop for normal shutdowns to allow cleanup

• Use kill only when a container is unresponsive

Part 2: Advanced Docker Concepts (Questions 16-25)

16. How do you troubleshoot a failing container?

Systematic debugging approach:

• Check container logs: docker logs <container>

• Inspect container details: docker inspect <container>

• Execute commands inside: docker exec -it <container> sh

• Review exit codes and status

• Check resource constraints and limits

• Verify network connectivity and port mappings

• Examine volume mounts and permissions

17. What are Docker health checks and why are they important?

Health checks monitor container health beyond just process existence. They:

• Determine if a container is functioning correctly

• Enable automatic container restart on failure

• Integrate with orchestrators for better load balancing

• Help detect issues like deadlocks or unresponsive services

Defined with the HEALTHCHECK instruction in Dockerfile or container configuration.

18. Explain Docker's security best practices.

Key security measures:

• Run containers as non-root users

• Use official and verified base images

• Scan images for vulnerabilities regularly

• Implement resource limits (CPU, memory)

• Use read-only filesystems when possible

• Apply the principle of least privilege

• Keep Docker and images updated

• Use secrets management properly

• Enable Docker Content Trust for image signing

19. What is Docker Swarm and how does it compare to Kubernetes?

Docker Swarm is Docker's native clustering and orchestration tool. Comparisons:

Swarm advantages:

• Simpler to set up and learn

• Integrated with Docker CLI

• Lightweight and fast

Kubernetes advantages:

• More features and flexibility

• Larger ecosystem and community

• Better for complex, large-scale deployments

• More robust autoscaling and self-healing

Most organizations now prefer Kubernetes for production workloads.

20. How do you implement logging in Docker?

Docker provides multiple logging drivers:

json-file (default): Stores logs as JSON

syslog: Sends to syslog daemon

journald: Sends to systemd journal

gelf: Graylog Extended Log Format

fluentd: Forwards to Fluentd

awslogs: AWS CloudWatch Logs

Configure logging driver at daemon or container level based on centralized logging infrastructure.

21. What are the resource constraints you can set on containers?

Critical resource limits:

Memory: --memory and --memory-swap

CPU: --cpus or --cpu-shares

Block IO: --blkio-weight

PIDs: --pids-limit

These prevent resource exhaustion and ensure fair resource distribution among containers.

22. Explain the concept of Docker namespaces and cgroups.

Docker uses Linux kernel features for isolation:

Namespaces provide process isolation:

• PID: Process isolation

• NET: Network isolation

• IPC: Inter-process communication

• MNT: Filesystem mount points

• UTS: Kernel and version identifiers

Cgroups limit and account for resources:

• CPU, memory, disk I/O, network

• Enforce resource constraints

Together, they enable lightweight containerization.

23. How do you handle container networking in production?

Production networking considerations:

• Use overlay networks for multi-host communication

• Implement service mesh for advanced traffic management

• Use ingress controllers for external access

• Configure DNS for service discovery

• Apply network policies for security

• Implement load balancing strategies

• Monitor network performance and bottlenecks

24. What is the purpose of .dockerignore?

Similar to .gitignore, .dockerignore excludes files from the build context, preventing them from being copied into images. Benefits:

• Reduces build context size

• Speeds up build time

• Prevents sensitive files from entering images

• Excludes unnecessary files (logs, caches, .git)

25. How do you implement blue-green deployments with Docker?

Blue-green deployment strategy:

Run current version (blue) in production
Deploy new version (green) alongside blue
Test green environment thoroughly
Switch traffic from blue to green
Keep blue running as rollback option
Decommission blue after validation

Implement using load balancer configuration changes or orchestrator rolling updates with quick rollback capabilities.

Part 3: Kubernetes Fundamentals (Questions 26-35)

26. What is Kubernetes and why do we need it?

Kubernetes (K8s) is an open-source container orchestration platform that automates deployment, scaling, and management of containerized applications. We need it because:

• Manual container management at scale is impractical

• Provides automatic scaling and self-healing

• Handles load balancing and service discovery

• Manages configuration and secrets

• Enables declarative infrastructure

• Offers rolling updates and rollbacks

27. Explain the Kubernetes architecture and its components.

Kubernetes uses a master-worker architecture:

Control Plane (Master) components:

API Server: Central management point, processes REST requests

etcd: Distributed key-value store for cluster state

Scheduler: Assigns pods to nodes based on resources

Controller Manager: Runs controller processes for desired state

Cloud Controller Manager: Interfaces with cloud providers

Worker Node components:

Kubelet: Agent ensuring containers run in pods

Kube-proxy: Maintains network rules

Container Runtime: Runs containers (Docker, containerd, CRI-O)

28. What is a Pod and why is it the smallest deployable unit?

A Pod is a group of one or more containers sharing network namespace, storage, and specifications. It's the smallest unit because:

• Containers in a pod share the same IP and port space

• They can communicate via localhost

• They share volumes for data exchange

• They're scheduled together on the same node

• They represent a single instance of an application

Pods are ephemeral and should be managed by controllers, not created directly.

29. Explain different types of Kubernetes Services.

Services provide stable networking for pods:

ClusterIP (default): Internal cluster access only, virtual IP for pod set

NodePort: Exposes service on each node's IP at a static port

LoadBalancer: Creates external load balancer (cloud provider dependent)

ExternalName: Maps service to DNS name, returns CNAME record

Headless: No cluster IP, direct DNS records for pods

30. What are Deployments and how do they work?

Deployments are controllers that manage ReplicaSets and Pods declaratively. They provide:

Declarative updates: Define desired state, K8s makes it happen

Rollout management: Controlled updates with history

Rollback capability: Revert to previous versions

Scaling: Adjust replica count easily

Self-healing: Replace failed pods automatically

Deployments use ReplicaSets to maintain the specified number of pod replicas.

31. What is the difference between a Deployment, StatefulSet, and DaemonSet?

Each controller serves different use cases:

Deployment:

• For stateless applications

• Pods are interchangeable

• Random pod names and creation order

StatefulSet:

• For stateful applications (databases)

• Stable network identities

• Ordered, predictable pod names

• Persistent storage per pod

DaemonSet:

• Runs one pod per node

• For node-level services (monitoring, logging)

• Automatically scales with cluster

32. Explain Kubernetes ConfigMaps and Secrets.

Both manage configuration data:

ConfigMaps:

• Store non-sensitive configuration

• Key-value pairs or configuration files

• Mounted as volumes or environment variables

• Can be updated without rebuilding images

Secrets:

• Store sensitive data (passwords, tokens, keys)

• Base64 encoded (not encrypted by default)

• Should be encrypted at rest with provider support

• More access controls than ConfigMaps

33. What are Namespaces and when should you use them?

Namespaces provide virtual clusters within a physical cluster. Use them to:

• Separate environments (dev, staging, prod)

• Isolate teams or projects

• Apply different resource quotas

• Implement access controls

• Organize resources logically

Default namespaces: default, kube-system, kube-public, kube-node-lease.

34. How does Kubernetes handle service discovery?

Kubernetes provides two service discovery methods:

Environment Variables:

• Injected into pods at creation

• Contains service host and port

• Limited to services existing at pod creation

DNS (preferred):

• Cluster DNS server (CoreDNS)

• Automatic DNS records for services

• Format: <service-name>.<namespace>.svc.cluster.local

• Works for services created after pods

35. What are Kubernetes Ingress and Ingress Controllers?

Ingress is an API object that manages external HTTP/HTTPS access to services. It provides:

• URL-based routing

• Virtual hosting

• SSL/TLS termination

• Load balancing

Ingress Controller is the actual implementation (nginx, Traefik, HAProxy) that fulfills Ingress rules. The Ingress object alone does nothing without a controller.

Part 4: Advanced Kubernetes (Questions 36-40)

36. Explain Kubernetes resource management with requests and limits.

Resource specifications control container resources:

Requests:

• Minimum guaranteed resources

• Used by scheduler for placement

• Container always gets requested amount

Limits:

• Maximum resources allowed

• Prevents resource hogging

• Container throttled or killed if exceeded

Best practice: set requests based on actual usage, limits as safety guards. QoS classes (Guaranteed, Burstable, BestEffort) depend on these settings.

37. How does Kubernetes implement self-healing?

Kubernetes maintains desired state through multiple mechanisms:

• ReplicaSets: Replace failed pods automatically

• Liveness probes: Restart containers that fail health checks

• Readiness probes: Remove unhealthy pods from service endpoints

• Node failure: Reschedule pods from failed nodes

• Controller reconciliation loops: Continuously compare actual vs desired state

38. What are Init Containers and when would you use them?

Init containers run before app containers and must complete successfully. Use cases:

• Setup scripts that shouldn't be in app image

• Wait for dependent services to be ready

• Clone repositories or download data

• Set permissions or configure files

• Security tasks requiring different tools

They run sequentially and must succeed before app containers start.

39. Explain Kubernetes persistent storage with PV and PVC.

Persistent volume management separates storage from pod lifecycle:

PersistentVolume (PV):

• Cluster-level storage resource

• Provisioned by admin or dynamically

• Has lifecycle independent of pods

PersistentVolumeClaim (PVC):

• User's storage request

• Binds to available PV matching requirements

• Used by pods to access storage

StorageClass:

• Defines storage types

• Enables dynamic provisioning

• Specifies provisioner and parameters

40. How do you implement zero-downtime deployments in Kubernetes?

Strategies for seamless updates:

Rolling Updates (default):

• Gradually replace old pods with new ones

• Configure maxUnavailable and maxSurge

• Automatic rollout and rollback

Blue-Green Deployment:

• Full new environment alongside old

• Switch traffic instantly

• Easy rollback

Canary Deployment:

• Route small traffic percentage to new version

• Gradually increase if successful

• Use service mesh or Ingress for traffic splitting

Combine with readiness probes, pod disruption budgets, and proper health checks for true zero-downtime deployments.

Conclusion

Mastering Docker and Kubernetes is a journey from understanding basic concepts to implementing complex production systems. These 40 questions cover the essential knowledge you need to succeed in interviews and, more importantly, in real-world scenarios.

Remember that interview success isn't just about memorizing answers—it's about understanding the underlying concepts, trade-offs, and best practices. Practice deploying applications, experiment with different configurations, and learn from production challenges.

The container ecosystem evolves rapidly, so continue learning about new features, security practices, and cloud-native patterns. Whether you're deploying microservices, managing infrastructure, or building CI/CD pipelines, these technologies are fundamental to modern software delivery.

What's your experience with Docker and Kubernetes? Share your toughest interview question in the comments below!

Ready to level up your DevOS skills? Subscribe for more in-depth guides on cloud-native technologies and modern infrastructure practices.

5 Best GitHub AI Repos to Master AI Like a Pro

Manish Kumar — Sat, 23 Aug 2025 12:06:58 +0000

I Wasted 100 Hours on GitHub's "Awesome" AI Repos So You Don't Have To

The 5 repositories that actually help you ship production AI code

The GitHub Rabbit Hole 🐰

After spending 100 hours methodically testing repositories, here's what I discovered:

95% of popular AI repos are tutorial hell disguised as practical resources.

They suffer from:

⭐ Star inflation — 40k stars but code from the GPT-3 era
📚 Tutorial syndrome — Great for following along, useless for real projects
🚫 Missing deployment — Shows model training, abandons you at production
💥 Dependency nightmares — Conflicts with everything in your stack

But that remaining 5%? Pure gold.

The 5 AI Repos That Actually Ship Code

1️⃣ Hands-On LLMs

Repo: HandsOnLLM/Hands-On-Large-Language-Models

# What actually works:
git clone https://github.com/HandsOnLLM/Hands-On-Large-Language-Models
cd Hands-On-Large-Language-Models
# Their notebooks actually run without modification 🎉

Why it's different:

✅ Jupyter notebooks that actually execute
✅ Real deployment scenarios (Chapter 7 saved my AWS costs)
✅ Production-ready patterns for LLM applications

Skip the book, clone the repo. Their approach to model versioning is worth its weight in GPU credits.

Best for: Building LLM applications that real users will touch

2️⃣ AI Agents for Beginners by Microsoft

Repo: microsoft/ai-agents-for-beginners

# Their memory pattern implementation (Lesson 8):
class ConversationMemory:
    def __init__(self, redis_client):
        self.redis = redis_client
        self.max_context_length = 4000

    def add_message(self, conversation_id, message):
        # Actual working code, not pseudocode
        pass

Misleading name alert: This is intermediate-level content. Microsoft's docs team knows their audience.

The killer feature: Lesson 8 on memory patterns. I've deployed their Redis-based conversation memory with minimal changes for three different clients.

Best for: Building conversational AI and multi-step workflows

3️⃣ GenAI Agents by Nir Diamant

Repo: NirDiamant/GenAI_Agents

Honest take: 90% theory, 10% working code. But that 10% is gold when you need to debug why your agent is hallucinating.

# Their agent debugging toolkit:
from genai_agents import AgentTracer

tracer = AgentTracer()
# Finally understand WHY your agent made that weird decision

Best for: Complex agents that need decision-making capabilities

4️⃣ Made with ML by Goku Mohandas

Repo: GokuMohandas/Made-With-ML

The section everyone ignores: MLOps. Data versioning. Model monitoring.

Why that's where the money is: Every AI project that reaches production needs this boring infrastructure. There are maybe 10 engineers worldwide who understand it well.

# Their CI/CD pipeline for ML:
name: ML Pipeline
on:
  push:
    paths: ['src/**', 'data/**']
jobs:
  train-and-deploy:
    # Actually deployable configurations

Best for: Moving beyond proof-of-concept to production systems

5️⃣ Prompt Engineering Guide by Elvis S.

Repo: dair-ai/Prompt-Engineering-Guide

Embarrassing admission: Everyone stars this. 90% never read past basic examples.

Pro tip: Jump straight to "Advanced Techniques." Their constitutional AI section isn't academic theory — it's practical techniques for predictable AI behavior.

# Chain-of-thought prompting pattern:
prompt = """
Think step by step:
1. What is the user asking?
2. What information do I need?
3. How should I structure my response?

User question: {question}
"""

Best for: AI applications where prompt quality = user experience

The Hidden Strategies That Work

After 100 hours of repo testing, here are the meta-strategies:

🔍 Check Issues Tab First

Look for recent activity (last 30 days)
Check maintainer responses to bugs
Spot common implementation challenges

Red flags:

Hundreds of open issues, no responses
Same bugs reported repeatedly
"How do I deploy this?" questions everywhere

📊 Ignore Stars, Check Commits

# Better than star count:
git log --since="30 days ago" --oneline | wc -l
# Consistent commits > viral moments

🚀 Look for Deployment Stories

Most tutorials end at model training. Valuable repos continue through:

Docker configs that work
Cloud deployment examples
Monitoring implementations
Error handling patterns

The One-Repository Rule

Controversial advice: Pick ONE repo and master it completely.

I spent months collecting repositories like trading cards. Illusion of progress without actual learning.

Better approach:

Choose based on your current project
Run every single example
Break things intentionally
Fix what you broke
Ship something

My Recommendations

Choose your adventure:

const recommendation = {
  'building_llm_apps': 'Hands-On LLMs',
  'creating_ai_agents': 'Microsoft AI Agents', 
  'moving_to_production': 'Made with ML',
  'optimizing_prompts': 'Prompt Engineering Guide',
  'understanding_architecture': 'GenAI Agents'
}

Bonus: The $60 Book Alternative

Pro tip: Chip Huyen's machine-learning-systems-design repo contains:

System design patterns for ML
Real case studies from big tech
Scaling strategies that work
ML interview prep

It's the book content without filler chapters.

What Actually Leveled Me Up

Truth: It wasn't any single repo. It was:

Building real systems (not tutorials)
Failing fast and learning from broken deployments
Focusing on production concerns early
Contributing back to helpful repositories

Your Next Steps

Stop collecting. Start building.

# The developer's workflow:
git clone [chosen_repo]
cd [chosen_repo] 
# Run every example
# Break something
# Fix it
# Deploy it
# Document learnings

Discussion

What repository actually leveled up your AI skills?

Drop your experience in the comments. I'm always hunting for the next hidden gem that ships production code.

Found this helpful? Give it a ❤️ and follow for more practical AI insights that skip the hype.

Tags: #ai #github #machinelearning #webdev #productivity #opensource #coding #tutorial