Containers interview questions
5 questions across 2 sections, in the order you would learn them. Every answer here is one that works — but an answer you have read is not an answer you can give, so use Test yourself and say it out loud first.
Containers and deployment
Read the section that teaches thisIf this comes up in an interview
Why does Dockerfile layer order matter?
Each instruction is a cached layer, and a change invalidates every layer after it. Copying dependency files and installing before copying source means a code change does not reinstall dependencies, which is the difference between a fast build and a slow one.
What is the difference between a liveness and a readiness check?
Liveness asks whether the process is functioning at all; failing it triggers a restart. Readiness asks whether it can serve traffic yet; failing it removes it from the load balancer. Conflating them causes restarts during a slow startup, such as loading a model.
How do you configure the same image across environments?
Environment variables at runtime, with secrets from the platform's secret store. Required secrets get no default so a misconfigured deploy fails immediately. Baking configuration into the image means one image per environment, which removes the point of containers.
A Dockerfile that builds fast and runs safely
Read the section that teaches thisIf this comes up in an interview
Your Docker build takes eight minutes on every code change. Why, and how do you fix it?
The code is probably copied before dependencies are installed, so every change invalidates the install layer. Copy the requirements file and install first, then copy the code. Add a .dockerignore so unrelated files do not bust the cache.
Then they push further
It is still slow in CI. Why?
CI machines often start with an empty cache. Use your CI's Docker layer caching, or push and pull a cache image from the registry.
What gets marked up. Marked up for explaining layer caching and ordering, not just 'use a smaller image'.
Why should a container not run as root?
If the application is compromised, root inside the container makes it easier to damage mounted data or exploit a container escape. A normal user limits what an attacker gets.
These are the questions for one topic. The whole question bank covers every topic on the site.