Docker Practice Questions & Quiz

For a Node.js app, you want dependencies to be cached in the image while keeping rebuilds fast when source files change. What should the Dockerfile copy first?

Answer: package.json and the lock file

Copying dependency manifests first lets the dependency installation layer be cached. Source-only changes are less likely to force dependency installation again.

In a development environment, you want source changes on the host to appear immediately inside the container. What is the most natural approach?

Answer: Bind-mount the source directory

A bind mount exposes host files directly to the container, which is common for local development.

In a development Compose file, you want to access an app listening on port 3000 from host port 3000. Which setting is appropriate?

Answer: ports: ["3000:3000"]

ports publishes host ports to container ports. 3000:3000 maps host port 3000 to container port 3000.

An app inside a container cannot reach a database on the host by connecting to localhost. What is the best explanation?

Answer: localhost inside the container refers to the container itself

Containers have their own network namespace, so localhost inside the container means the container itself, not the host.

You want development and production to differ only in startup command and mounts. What Compose approach is appropriate?

Answer: Layer a development override file on top of the base Compose file

Compose can merge multiple files. Keeping shared definitions in a base file and overriding development-only commands or mounts is maintainable.

You want to reuse a dependency cache across builds without including it in the final image. Which BuildKit feature is appropriate?

Answer: RUN --mount=type=cache

BuildKit cache mounts can reuse package-manager caches across builds without directly baking them into image layers.

In a hot-reload development container, you want source files from the host but dependencies from inside the container. What setup is common?

Answer: Bind-mount source files and isolate the dependency directory with a named volume

A common pattern is to bind-mount source files while keeping OS-sensitive dependency directories such as node_modules in a named volume managed by the container.

When sharing a Dockerfile across a development team, which style should be avoided for stable OS package installation?

Answer: Putting apt-get upgrade -y in a normal application image build

Application images should install only required packages. Broad upgrades make builds less predictable and blur responsibility with base image maintenance.

You want environment-specific app settings while keeping the image common. What is appropriate?

Answer: Pass them at runtime as environment variables or external configuration

Keeping configuration outside the image and injecting it at runtime through environment variables, files, or secret management makes one image usable across environments.

For local development, you want to start multiple services together and let them communicate by service name. What fits best?

Answer: Docker Compose

Compose defines services, networks, volumes, and environment variables in a file and starts multiple containers together.

You want to list images stored locally. Which command should you use?

Answer: docker image ls

docker image ls lists local images and shows tags, image IDs, sizes, and related information.

You want to start a container in the background and automatically remove it when it stops. Which option combination is appropriate?

Answer: docker run -d --rm ...

-d runs detached, and --rm removes the container after it exits. This is useful for temporary test containers.

You want to list containers including stopped ones. Which command is appropriate?

Answer: docker ps -a

docker ps lists running containers; adding -a includes stopped containers.

You want to follow stdout logs from a running container. Which command should you use?

Answer: docker logs -f <container>

docker logs -f follows container logs. It works well when the application writes logs to stdout/stderr.

You want to open a temporary shell inside a running container for investigation. Which command is appropriate?

Answer: docker exec -it <container> sh

docker exec runs an additional command in a running container. -it enables interactive shell use.

You want to build an image named myapp:dev from a Dockerfile. Which command is appropriate?

Answer: docker build -t myapp:dev .

docker build -t name:tag context builds an image from a Dockerfile and assigns a tag.

You want to clean up stopped containers, unused networks, dangling images, and build cache. Which command is a suitable candidate?

Answer: docker system prune

docker system prune cleans unused resources. Review what will be removed so needed volumes or images are not deleted.

You want to start services defined in a Compose file in the background. Which command is appropriate?

Answer: docker compose up -d

docker compose up -d creates and starts Compose services in detached mode.

You want detailed JSON metadata for a container or image. Which command should you use?

Answer: docker inspect

docker inspect shows detailed JSON metadata such as IP addresses, mounts, environment variables, and settings.

You want to copy a configuration file from a container to the host. Which command is appropriate?

Answer: docker cp <container>:/path/file ./file

docker cp copies files between host and container, which is useful for retrieving configuration during investigation.

Which design best keeps a production image small and avoids including build tools?

Answer: Use a multi-stage build and copy only artifacts into the final stage

Multi-stage builds separate build and runtime stages, allowing the final image to contain only required artifacts.

Why should container images usually avoid packing too many independent long-running processes into one container?

Answer: It makes monitoring, restart, scaling, and log separation harder

Containers are easier to operate when responsibilities are focused. Too many responsibilities make failure isolation and scaling boundaries unclear.

You want production to reuse the exact intended image. Which tagging approach is safer?

Answer: Use version tags or image digests for deployment

Relying only on mutable latest can point to different content over time. Version tags or digests improve traceability.

What is the main purpose of maintaining .dockerignore before using COPY . . in a Dockerfile?

Answer: To exclude unnecessary or sensitive files from the build context

.dockerignore reduces files sent to the build context and helps prevent secrets or large unnecessary files from being included.

Why should database data usually not be stored only in a container writable layer?

Answer: Data can be lost when the container is removed or recreated

A container writable layer is tied to the container lifecycle. Database data should be persisted with volumes or external database services.

In a web app image, what does EXPOSE 8080 mean?

Answer: It documents as metadata that the container intends to listen on port 8080

EXPOSE is metadata about intended listening ports. Host publishing still requires docker run -p or Compose ports.

You tried to change production runtime settings using only Dockerfile ARG and it failed. What is the likely reason?

Answer: ARG is mainly a build-time variable; runtime settings use ENV or external injection

ARG is primarily used during build. Values that change at runtime should be passed through environment variables, configuration files, or secret management.

What is the benefit of copying frequently changed files later in a Dockerfile?

Answer: Stable earlier layer cache is easier to reuse

Dockerfile cache works by instruction order. Placing stable dependency steps earlier and frequently changed source copies later improves efficiency.

Why is writing app logs to stdout often preferred over writing only to files inside production containers?

Answer: Container runtimes and logging platforms can collect them more easily

Writing container logs to stdout/stderr makes integration with Docker and cloud log collectors easier.

Which design helps avoid leaving build-time secrets in an image?

Answer: Use mechanisms such as BuildKit secret mounts that avoid persisting secrets in layers

Secrets handled with Dockerfile ENV or COPY can remain in layer history. BuildKit secret mounts reduce exposure.

In standalone Docker, you want a container to restart automatically after a failure. Which setting is appropriate?

Answer: A restart policy such as --restart=unless-stopped

A restart policy tells the Docker daemon how to handle container exits. It serves a different purpose from --rm.

You want to view container CPU and memory usage in real time. Which command is appropriate?

Answer: docker stats

docker stats displays CPU, memory, network, and block I/O usage per container.

For production operations, what should an image provide to make container health easier to assess?

Answer: HEALTHCHECK or an easy-to-monitor health endpoint

Health checks help determine not only whether a process exists, but whether the application can respond correctly.

You want to inspect a running container's configuration, mounts, and networks. Which command is a good first choice?

Answer: docker inspect <container>

docker inspect returns detailed container information as JSON, making it useful for checking mounts, networks, and environment variables.

The host disk is running low and you want a breakdown of Docker disk usage. Which command should you use?

Answer: docker system df

docker system df shows disk usage summaries for images, containers, volumes, and build cache.

For production-like testing, you want to set a container memory limit in standalone Docker. Which option is representative?

Answer: docker run --memory 512m ...

--memory is a common option for limiting container memory usage.

Why is manually fixing a production container by entering it usually not a good root-cause fix?

Answer: The change is not reproducible and can be lost on recreation or redeploy

Containers are expected to be recreated. Fixes should be reflected in Dockerfiles, configuration, or deployment definitions so they are reproducible.

You want to view logs across services managed by Compose. Which command is appropriate?

Answer: docker compose logs

docker compose logs displays logs for services in a Compose project. -f follows them.

You need to transfer an image to another environment as a file, without using a registry. Which pair is appropriate?

Answer: docker save and docker load

docker save stores an image as a tar archive, and docker load loads it back while preserving tags and layers.

Before deleting unused Docker resources in operations, what deserves special attention?

Answer: Whether named volumes contain required persistent data

Volumes may contain important data such as databases or uploaded files. Confirm purpose and backups before deletion.

Which Dockerfile instruction is commonly used to avoid running the app as root?

Answer: USER

USER sets the user for later instructions and runtime processes. Running as non-root is a basic privilege reduction measure.

You need a private key during build to access a private repository, but you do not want it left in the image. What is appropriate?

Answer: Use BuildKit SSH mounts or secret mounts

BuildKit SSH and secret mounts expose secrets only during build and reduce the risk of leaving them in layers.

To reduce image vulnerability risk, what should you consider when choosing a base image?

Answer: Use a minimal, maintained, trusted base image

A small, maintained, trusted base helps reduce unnecessary packages and known vulnerabilities.

What is the main risk of mounting the host Docker socket /var/run/docker.sock into a container?

Answer: The container may gain powerful control over Docker on the host

The Docker socket controls the host Docker daemon. Mounting it can provide near host-level power and must be handled carefully.

What is the purpose of avoiding unnecessary Linux capabilities in a container?

Answer: To reduce privileges available if the container is compromised

Capabilities split root privileges into smaller units. Dropping unnecessary ones can limit damage after compromise.

You want to reduce the risk of filesystem tampering inside a container. Which runtime setting is a candidate?

Answer: --read-only

--read-only makes the container root filesystem read-only. Required writable paths should be explicitly provided with tmpfs or volumes.

When handling Docker images in CI, which step should be added for vulnerability checking?

Answer: Run image scanning and gate releases based on severity

Image scanning in CI helps detect known vulnerabilities in base images and dependencies before release.

Which approach should be avoided when passing secrets to containers?

Answer: Writing secrets directly into the Dockerfile

Secrets in Dockerfiles can leak through image history or registries. Runtime secret management is the usual approach.

Why should --privileged not be casually used for production containers?

Answer: It grants powerful near-host privileges and weakens isolation

--privileged grants many permissions and device access. Prefer allowing only required capabilities or devices.

Which option is known for running Docker Engine without root privileges to reduce impact if the daemon is compromised?

Answer: Rootless mode

Rootless mode runs the Docker daemon and containers as a non-root user. It has limitations and should be evaluated against requirements.

In a development Compose setup, you want source changes to appear immediately, but you do not want the dependency directory created in the container to be overwritten by the host. Which approach is appropriate?

Answer: Bind-mount the source and assign a separate volume to the dependency directory

A bind mount is useful for live source edits. A separate volume for dependency directories helps avoid hiding container-installed dependencies with an empty or different host directory.

You want to check the exit code of a recently exited container, including stopped containers. Which command is appropriate to start with?

Answer: docker ps -a

docker ps -a lists containers including stopped ones, and the STATUS column can show exited state and exit code. Use docker inspect when deeper details are needed.

For a production image, you need compilers and development tools during build, but do not want them left in the final image. Which Dockerfile design is appropriate?

Answer: Use a multi-stage build and copy only build artifacts into the final stage

A multi-stage build keeps build tools in a builder stage and copies only artifacts into the final stage. This helps keep the runtime image smaller and reduces unnecessary attack surface.

In production, you want container logs to be collected by a centralized logging system. What is an appropriate basic application-side policy?

Answer: Write logs to stdout and stderr, and let the runtime platform collect them

Writing logs to stdout and stderr makes it easier for Docker, orchestrators, and logging drivers to collect them. Keeping logs only inside container files can cause loss or missed collection.

To make image sources easier to trust, CI should pin the base image reference more reproducibly. What is better than relying only on a tag?

Answer: Pin the reference by image digest

A tag can later point to a different image. Pinning by digest identifies the image content more precisely and improves reproducibility and traceability.

Many images have been pulled locally. You first want to list repository names, tags, image IDs, and sizes. Which command is appropriate?

Answer: docker image ls

docker image ls lists images present locally. It is a good first check for pulled image tags, IDs, creation time, and size.

After repeated builds and pulls, dangling images shown as <none> remain. You want to first clean only unreferenced dangling images without removing images needed by containers. Which operation is appropriate?

Answer: Run docker image prune and review the deletion target before proceeding

docker image prune removes dangling images by default. Broader prune options such as -a or volume deletion have larger impact, so choose them only after checking the target.

You pulled nginx:1.27 locally and want to also refer to it as web-proxy:test for internal testing. Which operation adds another reference name without duplicating the image content?

Answer: docker tag nginx:1.27 web-proxy:test

docker tag SOURCE_IMAGE TARGET_IMAGE assigns another repository name or tag to an existing image. It does not duplicate the image content; it adds another reference to the same image ID.

You want to confirm whether a locally pulled image matches the expected digest. Which command is appropriate for checking detailed metadata such as RepoDigests?

Answer: docker image inspect <image>

docker image inspect outputs detailed local image metadata as JSON. It can show RepoDigests, IDs, labels, and creation details, which helps trace pulled images.

You need to move a locally pulled tagged image into an offline test environment as a file. Which pair preserves tags and layers for transport?

Answer: Save with docker save, then load with docker load at the destination

For offline image transport, use docker save to create a tar archive and docker load at the destination. export/import targets a container filesystem and serves a different purpose from preserving image tags and layers.

You want to explain the relationship between an image and a container to a teammate new to Docker. Which explanation is most appropriate?

Answer: An image is a template before execution, and a container is a runtime instance started from that image

A Docker image is a read-only template containing an application and runtime environment. A container is created from that image and runs as a process-oriented runtime unit.

You want to start a container from redis:7, which is not present locally. What is the normal Docker flow?

Answer: If the image is not local, Docker pulls it from a registry, then creates and starts a container

When a command such as docker run redis:7 references an image that is not local, Docker pulls it from the configured registry and then creates and starts the container.

You want to access a web server listening on port 80 inside a container from the host browser at http://localhost:8080. Which port publishing option is appropriate?

Answer: -p 8080:80

The order is -p host_port:container_port. To forward host port 8080 to container port 80, use -p 8080:80.

You want database data to remain even if the container is removed. Which Docker-managed storage resource is generally used?

Answer: named volume

For data such as database files that should outlive the container lifecycle, a Docker-managed named volume is commonly used.

You want a temporary test container to be automatically removed when it exits. Which run option avoids leaving a stopped container behind?

Answer: --rm

docker run --rm ... automatically removes the container when it exits. It is useful for short tests or one-shot commands where you do not want stopped containers left behind.

In Compose, an API must start only after the database is ready to accept connections. Which setting waits for a successful health check rather than only container startup?

Answer: Set the database dependency to condition: service_healthy under depends_on

Define a healthcheck on the database and use condition: service_healthy in the API's depends_on; Compose then waits for the database to become healthy.

An application takes 40 seconds to initialize, but its health check runs every 5 seconds and records early failures. Which field defines an explicit startup grace period?

Answer: start_period

start_period provides initialization time before normal consecutive-failure handling applies, reducing false unhealthy states for slow-starting services.

On a single Docker host, growing json-file logs are filling the disk. Which container setting commonly bounds log usage?

Answer: --log-opt max-size=10m --log-opt max-file=3

For the json-file logging driver, max-size and max-file control rotation size and retained files. Apply the settings when creating or recreating the container.

You want to build amd64 and arm64 images from one Dockerfile and publish them under one tag. Which command approach is appropriate?

Answer: docker buildx build --platform linux/amd64,linux/arm64 --push ...

buildx build with multiple --platform values and --push publishes per-architecture images plus a manifest that groups them under one tag.

You need SIGTERM to reach the application correctly so it can shut down within the grace period. Which Dockerfile startup form is appropriate?

Answer: The exec form ENTRYPOINT ["myapp", "--serve"]

The exec form avoids an unnecessary shell and normally runs the application as PID 1, allowing it to receive Docker stop signals directly. The app must also handle SIGTERM.

An application spawns child processes but does not reap exited children, leaving zombies. Which runtime option is an appropriate mitigation while the app is being fixed?

Answer: docker run --init ...

--init inserts a small init process as PID 1 to help forward signals and reap orphaned or zombie processes. Application process management should still be corrected.

In Compose, API and database services should start normally, while a debug admin UI should start only when requested. Which feature fits?

Answer: Assign profiles: ["debug"] to the admin UI service

Compose profiles let you exclude selected services from normal startup and enable them only when a profile such as --profile debug is requested.

A web process must listen on port 80 without receiving unnecessary Linux capabilities. Which option best follows least privilege?

Answer: --cap-drop ALL --cap-add NET_BIND_SERVICE

Dropping all capabilities and adding back only NET_BIND_SERVICE can satisfy low-port binding while limiting privileges. Verify whether the app or base image needs anything else.

You want to prevent processes in a container from gaining additional privileges through mechanisms such as setuid binaries. Which security option is appropriate?

Answer: --security-opt no-new-privileges=true

no-new-privileges prevents a process and its children from gaining more privileges than they already have. Combine it with non-root execution and capability reduction.

Before startup, you want to inspect the final configuration produced by merging multiple Compose files and environment variables. Which command is appropriate?

Answer: docker compose config

docker compose config renders the Compose model after file merging, variable interpolation, and normalization, making it useful for pre-start validation.

A Compose database network should be reachable only by attached application services and have no direct external connectivity. Which network setting is appropriate?

Answer: internal: true

internal: true creates an externally isolated Compose network. Attach only required services and avoid publishing the database port to the host.

You want copied files owned by a non-root user without adding a separate RUN chown layer. Which Dockerfile instruction is appropriate?

Answer: COPY --chown=app:app ./dist /app

COPY --chown sets ownership while files are copied into the image, avoiding a later RUN chown and making non-root ownership explicit.

A package installed manually in a running container disappeared at the next deployment. What is the appropriate permanent fix?

Answer: Put the change in the Dockerfile, build a new image, and recreate the container

Treat containers as replaceable runtime units and encode package or application changes in the Dockerfile and build process. This makes the environment reproducible and reviewable.

You plan to back up a database named volume by copying files. What is the best basic policy for avoiding an inconsistent backup during writes?

Answer: Stop or quiesce the database, or use its supported backup mechanism

Copying database files during writes can capture different files at inconsistent points in time. Stop or quiesce writes, coordinate snapshots, or use the database's supported logical or physical backup tools.

A production container needs a read-only root filesystem while allowing temporary writes only under /tmp. Which runtime options are appropriate?

Answer: --read-only --tmpfs /tmp

Protect the root filesystem with --read-only and explicitly provide tmpfs only for /tmp. Use volumes for paths that require persistence.