Docker Containers Practice Exam

Question 1 Docker Containers

What is a Docker healthcheck and its options?

docker image prune removes dangling images (untagged). docker image prune -a removes all unused images — including tagged images not referenced by any container. Use -a carefully in CI/build hosts. Patterns use Go's filepath.Match plus some extras: * matches any sequence of non-separator chars, ** matches across directories, ? matches a single char, [abc] matches a set, ! negates a pattern. A leading **/ matches at any depth. A HEALTHCHECK instruction in a Dockerfile runs a command periodically to determine the container's health. Options: --interval (default 30s), --timeout (default 30s), --start-period (grace period on first start, default 0s), --retries (default 3). The status appears in docker ps. docker update changes resource limits of a running container without restarting it. Example: docker update --memory=1g --cpus=2 mycontainer. Works for memory, CPU shares, restart policy, and a few other settings.

Question 2 Docker Containers

What is the difference between a container being "running" and "healthy"?

Key security practices:

Run containers as a non-root user (USER instruction)
Use minimal base images (e.g., alpine, distroless)
Scan images for vulnerabilities (docker scout)
Don't store secrets in images; use Docker secrets or env vars
Enable read-only filesystems: --read-only
Drop unnecessary Linux capabilities

A running container's main process is alive (PID 1 is executing). A healthy container additionally has its healthcheck reporting 0. A running-but-unhealthy container still serves traffic unless an orchestrator is checking the healthcheck. Healthy is the correct state to gate dependent services on. docker run --read-only mounts the container's root filesystem as read-only. Combined with tmpfs mounts for /tmp and volumes for data dirs, it prevents the container from persisting unwanted writes — a strong hardening technique. The container's writable layer is the only mutable area. docker rename <old> <new> changes the name of an existing container. Container names must be unique on a host. Useful when reusing names in scripted environments.

Question 3 Docker Containers

What is docker run --rm?

A Docker volume is a persistent storage mechanism managed by Docker, stored outside the container's writable layer.
Types:

Named volumes: docker volume create mydata
Bind mounts: map a host path directly
tmpfs mounts: stored in memory only

--rm automatically removes the container when it exits. Convenient for one-off tasks: docker run --rm alpine echo hello. The container never accumulates in docker ps -a. LABEL adds metadata to an image as key-value pairs.
Example: LABEL maintainer="dev@example.com" version="1.0"
Labels can be inspected with docker inspect and are useful for automation and documentation. docker top <container> displays the running processes inside a container, similar to the host top command. You can pass ps flags to filter output, e.g., docker top mycontainer aux.

Question 4 Docker Containers

What is the --mount=type=cache option in BuildKit?

Use prune commands to reclaim disk space:

docker system prune — remove all unused data
docker image prune — remove dangling images
docker container prune — remove stopped containers
docker volume prune — remove unused volumes

Add -a to remove all unused images, not just dangling ones. The --mount=type=cache BuildKit option mounts a persistent build cache at a path inside the build container. Unlike a normal RUN layer, the cache survives across builds even if subsequent instructions change. Common use: package manager caches like /root/.cache/pip. docker manifest is a low-level subcommand to inspect, create, and annotate multi-platform image manifests. Commands: manifest create, manifest inspect, manifest annotate (to set per-platform os/arch metadata), and manifest push. Most users will use buildx instead. A running container's main process is alive (PID 1 is executing). A healthy container additionally has its healthcheck reporting 0. A running-but-unhealthy container still serves traffic unless an orchestrator is checking the healthcheck. Healthy is the correct state to gate dependent services on.

Question 5 Docker Containers

What does docker ps do?

docker run --link is the legacy way to link containers by injecting environment variables and /etc/hosts entries. It only works on the default bridge. User-defined networks with embedded DNS are the modern, supported replacement. docker ps lists running containers.
Key flags:

-a: show all containers (including stopped)
-q: show only container IDs
--filter: filter output (e.g., --filter status=exited)

A network alias is an extra DNS name a container is reachable by on a specific network. Set with docker run --network-alias db mydb or networks: frontend: aliases: [api] in Compose. Other containers on the same network can resolve that alias. docker top <container> displays the running processes inside a container, similar to the host top command. You can pass ps flags to filter output, e.g., docker top mycontainer aux.

Question 6 Docker Containers

What is the difference between docker run -p and docker run -P?

-p HOST:CONTAINER publishes a specific port (e.g., -p 8080:80). -P (uppercase) publishes all EXPOSEd ports to random host ports; you can find the mapping with docker port. -P is convenient in development but rarely used in production. Exec form (preferred): CMD ["python", "app.py"] — runs directly without a shell, receives signals properly.
Shell form: CMD python app.py — runs via /bin/sh -c, which wraps the process and may not forward signals correctly.
Always use exec form for CMD and ENTRYPOINT. docker wait <container> blocks until the specified container stops, then prints its exit code. Useful in scripts that need to chain commands after a container completes. docker build creates an image from a Dockerfile.
Example: docker build -t myapp:1.0 .
Key flags:

-t: tag the image
-f: specify Dockerfile path
--no-cache: ignore cache
--build-arg: pass build arguments

Question 7 Docker Containers

What does docker wait do?

Distroless images (e.g., gcr.io/distroless/base, distroless/java17) contain only your application and its language runtime — no shell, no package manager, no utilities. This drastically reduces attack surface. They cannot be exec bashed into, which is intentional. docker attach connects your terminal to the container's main process's STDIN/STDOUT. You see the same stream as the application, and signals go to the main process. docker exec runs a new process inside the container. Use exec for side tasks (debugging, inspection). Docker Engine consists of three components: the daemon (dockerd) that manages images, containers, networks, and volumes; a REST API that the daemon exposes; and the CLI client (docker) that talks to the daemon via the API. The daemon and client can run on the same host or on different machines. docker wait <container> blocks until the specified container stops, then prints its exit code. Useful in scripts that need to chain commands after a container completes.

Question 8 Docker Containers

What is the default seccomp profile in Docker?

RUN executes a command during the image build process and commits the result as a new layer.
Example: RUN apt-get update && apt-get install -y curl
Best practice: chain commands with && to reduce layers. docker buildx is an extended build CLI that ships with Docker. It supports BuildKit features, building for multiple platforms in a single command, advanced caching backends (registry, S3, local), and custom builders. It is the recommended way to build today. Docker applies a default seccomp profile that allows ~300 syscalls and blocks the rest. You can run with the unconfined profile (--security-opt seccomp=unconfined) for debugging, or supply a custom JSON profile. Tools like docker run --cap-drop=ALL ... tighten the surface further. docker commit <container> <new-image:tag> creates a new image from a container's current state, including any changes to its filesystem. Anti-pattern: this bypasses Dockerfile reproducibility. Use only for debugging or as a last resort.

Question 9 Docker Containers

How does docker login work?

docker logs fetches the stdout/stderr output of a container.
Key flags:

-f: follow log output in real time
--tail 100: show last 100 lines
--since 1h: logs from the last hour
-t: show timestamps

docker login [registry] authenticates with a registry and stores credentials in ~/.docker/config.json (or the OS keychain on Windows/macOS). After login, docker pull and docker push can access private repos. Use docker logout to clear credentials. FROM scratch creates a Dockerfile with no parent layer — the resulting image contains only what you explicitly add. It is the smallest possible base and is used for statically linked binaries, minimal OS images, and language runtimes that ship their own runtime. With userns-remap enabled in daemon.json, the Docker daemon maps container UIDs to a range of host UIDs (default 65,536 IDs). Container root (UID 0) maps to an unprivileged host user, so a container escape does not yield host root.

Question 10 Docker Containers

What is an official image on Docker Hub?

VOLUME creates a mount point and marks it as holding externally mounted volumes.
Example: VOLUME /data
Data in volumes persists beyond the container lifecycle and is managed by Docker on the host filesystem. Official images are curated and maintained by Docker in partnership with the upstream project (e.g., nginx, postgres, python, node). They live under a single namespace (no user prefix), follow best practices, and are regularly scanned for vulnerabilities. docker stats shows a live stream of resource usage per container: CPU %, memory usage/limit, network I/O, and block I/O. Add --no-stream to print once and exit, or --format to customize output. Docker Content Trust (DCT) uses Notary to sign image tags. With DOCKER_CONTENT_TRUST=1, the daemon only pulls images signed by a trusted publisher. Provides integrity and authenticity guarantees. Often used in production and by Kubernetes admission controllers.

Question 11 Docker Containers

What is a verified publisher on Docker Hub?

A verified publisher is a vendor whose identity has been confirmed by Docker. Their images are listed under a verified namespace, reducing the risk of typosquatting or impersonation compared to random community images. BuildKit is Docker's next-generation build engine, enabled by default in recent Docker versions. Benefits include parallel build steps, better caching, rootless builds, secret mounting, and SSH forwarding. Enable explicitly with DOCKER_BUILDKIT=1 or in /etc/docker/daemon.json. docker stop sends SIGTERM to gracefully shut down a running container, then SIGKILL after a timeout (default 10 seconds). The container still exists in a stopped state.
docker rm permanently deletes a stopped container and its writable layer. Use docker rm -f to force-remove a running container. Control groups (cgroups) limit and account for resource usage (CPU, memory, disk I/O, network) of container processes. Docker uses cgroups to enforce limits set via flags like --memory and --cpus, and to prevent a single container from exhausting host resources.

Question 12 Docker Containers

What does docker port do?

macvlan assigns a container a unique MAC address on the physical network, making it appear as a physical host. Useful for legacy applications that need a real LAN IP, or for low-latency networking. Cannot talk to the host by default — you need a macvlan sub-interface. docker kill sends a signal (default SIGKILL) to a running container's main process, terminating it immediately. docker stop first sends SIGTERM and waits for graceful shutdown before sending SIGKILL. Use docker kill -s SIGTERM ctr to send a specific signal. docker port <container> shows the current port mappings between the host and the container, e.g., 80/tcp -> 0.0.0.0:8080. Handy for quickly verifying what is exposed after a docker run -p. A running container's main process is alive (PID 1 is executing). A healthy container additionally has its healthcheck reporting 0. A running-but-unhealthy container still serves traffic unless an orchestrator is checking the healthcheck. Healthy is the correct state to gate dependent services on.

Question 13 Docker Containers

What is the default ulimit for open files in Docker containers?

Use prune commands to reclaim disk space:

docker system prune — remove all unused data
docker image prune — remove dangling images
docker container prune — remove stopped containers
docker volume prune — remove unused volumes

Add -a to remove all unused images, not just dangling ones. The build context is the set of files and directories sent from the CLI to the daemon when you run docker build. By default it is the current directory (.). Large contexts slow builds; use .dockerignore to exclude unnecessary files. By default, Docker sets ulimit -n to 1024 open file descriptors per container. Many services (databases, web servers) need more. Override with --ulimit nofile=65535:65535 on docker run, or in Compose under ulimits:. docker diff shows changes made to a container's filesystem since it was created: A (added file), C (changed file), D (deleted file). Useful for debugging or for understanding what a process modified at runtime.

Question 14 Docker Containers

What is a scratch image?

tini is a tiny init (a few hundred KB) designed to be container PID 1. It reaps zombie processes and forwards signals correctly. Pass it via --init to docker run, or include it in your image as ENTRYPOINT ["/sbin/tini", "--"]. A tmpfs mount is a volume backed by the host's RAM (and swap). It is extremely fast but non-persistent and limited in size. Use for sensitive data (secrets, keys) or for caches that should not survive a restart. Example: docker run --tmpfs /tmp:size=100m. FROM scratch creates a Dockerfile with no parent layer — the resulting image contains only what you explicitly add. It is the smallest possible base and is used for statically linked binaries, minimal OS images, and language runtimes that ship their own runtime. Bind mount propagation controls how mounts created inside the mount are propagated to the host and vice versa. Options: rprivate (default), private, rshared, shared, slave, rslave. Most users should leave the default.

Question 15 Docker Containers

How do you forward SSH keys to a build with BuildKit?

Named volumes are declared at the top level and mounted in services:

services:
  db:
    volumes:
      - pgdata:/var/lib/postgresql/data
volumes:
  pgdata:

You can also use bind mounts: ./local/path:/container/path Use --mount=type=ssh in a RUN step to make the host's SSH agent available inside the build:
RUN --mount=type=ssh mkdir -p ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts && pip install git+ssh://...
Build with --ssh default=$SSH_AUTH_SOCK. The keys are never written into the image. --privileged gives the container almost all host capabilities, access to all host devices, and disables most security barriers. Useful for nested Docker (DinD), but a major security risk in production. Avoid unless absolutely required. docker login [registry] authenticates with a registry and stores credentials in ~/.docker/config.json (or the OS keychain on Windows/macOS). After login, docker pull and docker push can access private repos. Use docker logout to clear credentials.

Question 16 Docker Containers

What is the difference between EXPOSE and docker run -p?

EXPOSE in a Dockerfile is pure documentation — a hint to humans and tools. It does not actually publish ports. docker run -p 8080:80 (or -P to publish all EXPOSEd ports) creates the real iptables forwarding rule that makes the port reachable from the host. Docker applies a default seccomp profile that allows ~300 syscalls and blocks the rest. You can run with the unconfined profile (--security-opt seccomp=unconfined) for debugging, or supply a custom JSON profile. Tools like docker run --cap-drop=ALL ... tighten the surface further. docker info shows the daemon's configuration: server version, storage driver, cgroup driver, number of images/containers, security options, and registry mirrors. Useful as a first step when debugging "why doesn't this work?". Docker Content Trust (DCT) uses Notary to sign image tags. With DOCKER_CONTENT_TRUST=1, the daemon only pulls images signed by a trusted publisher. Provides integrity and authenticity guarantees. Often used in production and by Kubernetes admission controllers.

Question 17 Docker Containers

What does the USER instruction do?

--privileged gives the container almost all host capabilities, access to all host devices, and disables most security barriers. Useful for nested Docker (DinD), but a major security risk in production. Avoid unless absolutely required. Use docker compose up -d --scale web=3 to run 3 replicas of the web service. For long-running scaling in a Compose file, use the deploy.replicas key (requires docker compose --compatibility / Swarm mode). In modern Compose, scale works directly for non-deploy keys. USER sets the user and optionally the group for running subsequent instructions and the container process.
Example: USER appuser:appgroup
This is a security best practice to avoid running containers as root. docker cp copies files or directories between a container and the host filesystem (in either direction).
Example: docker cp mycontainer:/app/logs ./logs
It works on running or stopped containers and does not require the container to be running.

Question 18 Docker Containers

What is the difference between ENV and ARG in a Dockerfile?

docker rm -v <container> also removes anonymous volumes associated with the container. Named volumes are kept. Useful during development when iterating on data layouts. Key network commands:

docker network ls — list networks
docker network create mynet — create a network
docker network connect mynet container1 — attach a running container
docker network disconnect mynet container1 — detach
docker network inspect mynet — view details
docker network rm mynet — remove

docker kill sends a signal (default SIGKILL) to a running container's main process, terminating it immediately. docker stop first sends SIGTERM and waits for graceful shutdown before sending SIGKILL. Use docker kill -s SIGTERM ctr to send a specific signal. ENV sets environment variables that persist in the running container.
ARG defines build-time variables available only during the build.
Example:
ARG VERSION=1.0
ENV APP_ENV=production

Question 19 Docker Containers

What is a build cache invalidation in Docker?

ENV in a Dockerfile sets defaults baked into the image. Runtime env vars (docker run -e or env_file) override them. If a variable is set in both, the runtime value wins. To inspect inside a running container, use docker exec mycontainer env. docker export produces a tarball of a container's flattened filesystem (no layers, no metadata). docker save produces a tarball of an image with all its layers and metadata. docker export output must be docker imported, losing history. Any change to a Dockerfile instruction or to files referenced by COPY/ADD invalidates the cache from that instruction downward. Earlier instructions and unchanged files keep their cached layers. Use the --cache-from flag to share caches across CI runs. docker cp copies files or directories between a container and the host filesystem (in either direction).
Example: docker cp mycontainer:/app/logs ./logs
It works on running or stopped containers and does not require the container to be running.

Question 20 Docker Containers

What is the difference between a container and a virtual machine?

docker cp copies files or directories between a container and the host filesystem (in either direction).
Example: docker cp mycontainer:/app/logs ./logs
It works on running or stopped containers and does not require the container to be running. By default, Docker sets ulimit -n to 1024 open file descriptors per container. Many services (databases, web servers) need more. Override with --ulimit nofile=65535:65535 on docker run, or in Compose under ulimits:. docker top <container> displays the running processes inside a container, similar to the host top command. You can pass ps flags to filter output, e.g., docker top mycontainer aux. Containers share the host OS kernel and run as isolated processes; VMs include a full guest OS and hypervisor. Containers are measured in MB and start in milliseconds; VMs are measured in GB and boot in seconds/minutes. VMs provide stronger hardware-level isolation; containers provide higher density and faster startup.

Question 21 Docker Containers

How do you use a private Docker registry?

COPY simply copies files/directories from the build context into the image. ADD does the same but also supports:

Automatic extraction of local .tar archives
Fetching files from remote URLs

Best practice: prefer COPY unless you need ADD's extra features. On modern Docker with overlay2-supported filesystems (ext4, xfs), the default is overlay2. It is the recommended driver for production. Older drivers like aufs and devicemapper are deprecated; Docker on Windows defaults to windowsfilter. You can run a private registry with docker run -d -p 5000:5000 registry:2. To push images:
docker tag myapp localhost:5000/myapp
docker push localhost:5000/myapp
For authentication, configure TLS and docker login. A dangling image is an untagged image that is not referenced by any tag, usually created when you rebuild an image with the same tag. The old image becomes <none>:<none> in docker images. Remove with docker image prune.

Question 22 Docker Containers

What is the Docker Engine architecture?

--security-opt configures security profiles. Common uses: --security-opt no-new-privileges (prevents setuid binaries from gaining new privileges), --security-opt seccomp=profile.json (apply custom seccomp), --security-opt apparmor=profile (apply AppArmor). Docker Engine consists of three components: the daemon (dockerd) that manages images, containers, networks, and volumes; a REST API that the daemon exposes; and the CLI client (docker) that talks to the daemon via the API. The daemon and client can run on the same host or on different machines. ENV sets environment variables that persist in the running container.
ARG defines build-time variables available only during the build.
Example:
ARG VERSION=1.0
ENV APP_ENV=production Official images are curated and maintained by Docker in partnership with the upstream project (e.g., nginx, postgres, python, node). They live under a single namespace (no user prefix), follow best practices, and are regularly scanned for vulnerabilities.

Question 23 Docker Containers

What does docker diff do?

SHELL overrides the default shell (["/bin/sh", "-c"]) used for shell-form RUN, CMD, and ENTRYPOINT instructions. Example: SHELL ["powershell", "-command"] on Windows. Does not affect exec-form commands. docker diff shows changes made to a container's filesystem since it was created: A (added file), C (changed file), D (deleted file). Useful for debugging or for understanding what a process modified at runtime. By default, Docker sets ulimit -n to 1024 open file descriptors per container. Many services (databases, web servers) need more. Override with --ulimit nofile=65535:65535 on docker run, or in Compose under ulimits:. CLI plugins are executables named docker-<name> on the PATH; they extend docker with new subcommands. Examples: docker compose, docker buildx, docker scan, docker scout. Install by dropping the binary into ~/.docker/cli-plugins or /usr/local/lib/docker/cli-plugins.

Question 24 Docker Containers

What is a Docker trusted registry?

A Docker Trusted Registry (DTR) is a commercial, on-premises registry product from Mirantis (formerly Docker Enterprise). It adds role-based access control, image signing, scanning, and replication policies on top of a standard OCI distribution registry. Open-source alternatives include Harbor, Quay, and GitLab Container Registry. A stopped container has its main process terminated; memory is freed. A paused container has its processes frozen (cgroup freezer); memory is preserved and CPU usage drops to zero. Resume a paused container instantly with docker unpause. docker login [registry] authenticates with a registry and stores credentials in ~/.docker/config.json (or the OS keychain on Windows/macOS). After login, docker pull and docker push can access private repos. Use docker logout to clear credentials. Networks are declared at the top level and referenced by services:

services:
  web:
    networks:
      - frontend
  api:
    networks:
      - frontend
      - backend
networks:
  frontend:
  backend:

Services on the same network can resolve each other by name.

Question 25 Docker Containers

What are cgroups and what do they do in Docker?

alpine is a ~5 MB base built on musl libc and BusyBox. It yields tiny images and fast pulls, but binary compatibility with glibc-based software can be an issue. Some prebuilt wheels and node-sass binaries fail on musl; use slim Debian-based images when compatibility is critical. Control groups (cgroups) limit and account for resource usage (CPU, memory, disk I/O, network) of container processes. Docker uses cgroups to enforce limits set via flags like --memory and --cpus, and to prevent a single container from exhausting host resources. Use --mount=type=secret in a RUN step to mount a secret (e.g., npm token) without baking it into the image:
RUN --mount=type=secret,id=npmrc,target=/root/.npmrc npm install
Pass the secret at build time with --secret id=npmrc,src=.npmrc. The secret never appears in any image layer. Use prune commands to reclaim disk space:

docker system prune — remove all unused data
docker image prune — remove dangling images
docker container prune — remove stopped containers
docker volume prune — remove unused volumes

Add -a to remove all unused images, not just dangling ones.

Question 26 Docker Containers

How do you pass a different build context to docker build?

Official images are curated and maintained by Docker in partnership with the upstream project (e.g., nginx, postgres, python, node). They live under a single namespace (no user prefix), follow best practices, and are regularly scanned for vulnerabilities. Use the -e flag or --env-file:
docker run -e DB_HOST=localhost -e DB_PORT=5432 myapp
docker run --env-file .env myapp
Variables set with -e override those defined in the Dockerfile's ENV instruction. You can use a named build context with BuildKit: docker build --build-context myrepo=git://github.com/foo/bar.git .. Inside the Dockerfile, COPY --from=myrepo ./some/path refers to that context. Replaces the older "build from URL" syntax. RUN executes a command during the image build process and commits the result as a new layer.
Example: RUN apt-get update && apt-get install -y curl
Best practice: chain commands with && to reduce layers.

Question 27 Docker Containers

What is the container lifecycle in Docker?

docker rm -v <container> also removes anonymous volumes associated with the container. Named volumes are kept. Useful during development when iterating on data layouts. A profile groups services so they only start when explicitly requested. Define with profiles: ["debug"] on a service, then run docker compose --profile debug up. Useful for dev-only services like debuggers, load generators, or admin UIs. A Docker Trusted Registry (DTR) is a commercial, on-premises registry product from Mirantis (formerly Docker Enterprise). It adds role-based access control, image signing, scanning, and replication policies on top of a standard OCI distribution registry. Open-source alternatives include Harbor, Quay, and GitLab Container Registry. A container goes through these states:

Created: docker create
Running: docker start / docker run
Paused: docker pause
Stopped: docker stop (SIGTERM → SIGKILL)
Removed: docker rm

Question 28 Docker Containers

What is docker rm -v?

Use docker compose up -d --scale web=3 to run 3 replicas of the web service. For long-running scaling in a Compose file, use the deploy.replicas key (requires docker compose --compatibility / Swarm mode). In modern Compose, scale works directly for non-deploy keys. docker rm -v <container> also removes anonymous volumes associated with the container. Named volumes are kept. Useful during development when iterating on data layouts. Public images are visible to anyone; pulls do not require authentication. Private images are visible only to users/teams you grant access to, and pulls require a docker login with the right credentials. Docker Hub offers a small number of free private repos per account. EXPOSE documents which ports the container listens on at runtime. It does not actually publish the port.
Example: EXPOSE 8080
To publish ports, use docker run -p 8080:8080 at runtime.

Question 29 Docker Containers

What is the propagation mode in a bind mount?

Distroless images (e.g., gcr.io/distroless/base, distroless/java17) contain only your application and its language runtime — no shell, no package manager, no utilities. This drastically reduces attack surface. They cannot be exec bashed into, which is intentional. By default, Docker sets /dev/shm to 64 MB. Some applications (notably Python with multiprocessing and some ML libraries) fail with shared-memory errors. Workaround: docker run --shm-size=1g ... or mount a tmpfs at /dev/shm. Bind mount propagation controls how mounts created inside the mount are propagated to the host and vice versa. Options: rprivate (default), private, rshared, shared, slave, rslave. Most users should leave the default. docker rename <old> <new> changes the name of an existing container. Container names must be unique on a host. Useful when reusing names in scripted environments.

Question 30 Docker Containers

What is the difference between a bind mount and a named volume?

macvlan assigns a container a unique MAC address on the physical network, making it appear as a physical host. Useful for legacy applications that need a real LAN IP, or for low-latency networking. Cannot talk to the host by default — you need a macvlan sub-interface. A Docker volume is a persistent storage mechanism managed by Docker, stored outside the container's writable layer.
Types:

Named volumes: docker volume create mydata
Bind mounts: map a host path directly
tmpfs mounts: stored in memory only

Bind mounts map an arbitrary host path (-v /host/path:/container/path) — useful for development with live-reload. Named volumes are managed by Docker in /var/lib/docker/volumes/, are portable across hosts, and are the recommended way to persist data in production. On modern Docker with overlay2-supported filesystems (ext4, xfs), the default is overlay2. It is the recommended driver for production. Older drivers like aufs and devicemapper are deprecated; Docker on Windows defaults to windowsfilter.

Question 31 Docker Containers

How does docker compose up -d --build work?

macvlan assigns a container a unique MAC address on the physical network, making it appear as a physical host. Useful for legacy applications that need a real LAN IP, or for low-latency networking. Cannot talk to the host by default — you need a macvlan sub-interface. Capabilities split root's traditional powers into discrete units (e.g., NET_ADMIN, SYS_TIME, SYS_PTRACE). By default, Docker drops most capabilities and keeps a small safe set. Add back with --cap-add, drop more with --cap-drop. docker compose up -d --build builds (or rebuilds) images defined with build: in the Compose file, then starts all services in detached mode. Add --force-recreate to discard existing containers, or --no-deps to skip dependent services. Bind mounts map an arbitrary host path (-v /host/path:/container/path) — useful for development with live-reload. Named volumes are managed by Docker in /var/lib/docker/volumes/, are portable across hosts, and are the recommended way to persist data in production.

Question 32 Docker Containers

What do docker pull and docker push do?

docker stats shows a live stream of resource usage per container: CPU %, memory usage/limit, network I/O, and block I/O. Add --no-stream to print once and exit, or --format to customize output. docker run --entrypoint /bin/sh myimage overrides the image's ENTRYPOINT for that container only. Useful for debugging an image whose ENTRYPOINT is broken. Combine with extra args to run a shell inside. docker build creates an image from a Dockerfile.
Example: docker build -t myapp:1.0 .
Key flags:

-t: tag the image
-f: specify Dockerfile path
--no-cache: ignore cache
--build-arg: pass build arguments

docker pull downloads an image from a registry:
docker pull nginx:latest
docker push uploads a tagged image to a registry:
docker push myrepo/myapp:1.0
You must be logged in via docker login to push to most registries.

Question 33 Docker Containers

How do you manage Docker networks with the CLI?

LABEL adds metadata to an image as key-value pairs.
Example: LABEL maintainer="dev@example.com" version="1.0"
Labels can be inspected with docker inspect and are useful for automation and documentation. Use flags with docker run:

Memory: --memory=512m
CPU: --cpus=1.5
Memory swap: --memory-swap=1g

In Compose:

deploy:
  resources:
    limits:
      memory: 512M
      cpus: "1.5"

Key network commands:

docker network ls — list networks
docker network create mynet — create a network
docker network connect mynet container1 — attach a running container
docker network disconnect mynet container1 — detach
docker network inspect mynet — view details
docker network rm mynet — remove

Public images are visible to anyone; pulls do not require authentication. Private images are visible only to users/teams you grant access to, and pulls require a docker login with the right credentials. Docker Hub offers a small number of free private repos per account.

Question 34 Docker Containers

How does Docker build caching work?

A container goes through these states:

Created: docker create
Running: docker start / docker run
Paused: docker pause
Stopped: docker stop (SIGTERM → SIGKILL)
Removed: docker rm

Docker caches each layer during a build. If an instruction and its context haven't changed, the cached layer is reused.
Best practices:

Put rarely-changing instructions (e.g., RUN apt-get) early
Put frequently-changing files (e.g., COPY . .) late

docker port <container> shows the current port mappings between the host and the container, e.g., 80/tcp -> 0.0.0.0:8080. Handy for quickly verifying what is exposed after a docker run -p. By default, processes inside a container run as root (UID 0) — but this UID maps to a user on the host. If userns-remap is enabled, container root is unprivileged on the host. Otherwise, a container-root process can affect the host's root-owned files if paths are shared.

Question 35 Docker Containers

How do you remove an image?

docker logs fetches the stdout/stderr output of a container.
Key flags:

-f: follow log output in real time
--tail 100: show last 100 lines
--since 1h: logs from the last hour
-t: show timestamps

A verified publisher is a vendor whose identity has been confirmed by Docker. Their images are listed under a verified namespace, reducing the risk of typosquatting or impersonation compared to random community images. Use docker rmi <image> to delete an image by ID or tag. If the image is used by a container, force with -f, but you will lose the image's history. docker image rm is the modern, preferred form. docker run --read-only mounts the container's root filesystem as read-only. Combined with tmpfs mounts for /tmp and volumes for data dirs, it prevents the container from persisting unwanted writes — a strong hardening technique. The container's writable layer is the only mutable area.

Question 36 Docker Containers

What is the OCI image format?

Docker is an open-source platform that automates the deployment of applications inside lightweight, portable containers. Containers package an application with all its dependencies, ensuring it runs consistently across different environments. WORKDIR sets the working directory for subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions.
Example: WORKDIR /app
If the directory doesn't exist, it is created automatically. The Open Container Initiative (OCI) image-spec defines a standard, vendor-neutral format for container images. Docker images are OCI-compliant, which is why images built with Docker can run in Podman, containerd, CRI-O, and other runtimes without conversion. Minimal base images like alpine (5 MB) or distroless images reduce:

Attack surface: fewer packages = fewer vulnerabilities
Image size: faster pulls and deployments
Build time: smaller layers to transfer

Example: FROM python:3.11-slim instead of FROM python:3.11.

Question 37 Docker Containers

What are Docker image layers?

CMD provides default arguments that can be overridden at runtime. ENTRYPOINT sets the main executable that always runs.
When both are used, CMD supplies default arguments to ENTRYPOINT:
ENTRYPOINT ["python"]
CMD ["app.py"] Each instruction in a Dockerfile (FROM, RUN, COPY, etc.) creates a read-only layer. Layers are stacked and cached. When a container runs, a thin writable layer is added on top. Unchanged layers are shared across images to save disk space. SHELL overrides the default shell (["/bin/sh", "-c"]) used for shell-form RUN, CMD, and ENTRYPOINT instructions. Example: SHELL ["powershell", "-command"] on Windows. Does not affect exec-form commands. By default, processes inside a container run as root (UID 0) — but this UID maps to a user on the host. If userns-remap is enabled, container root is unprivileged on the host. Otherwise, a container-root process can affect the host's root-owned files if paths are shared.

Question 38 Docker Containers

What is an inline ignore cache option in BuildKit?

A tmpfs mount is a volume backed by the host's RAM (and swap). It is extremely fast but non-persistent and limited in size. Use for sensitive data (secrets, keys) or for caches that should not survive a restart. Example: docker run --tmpfs /tmp:size=100m. alpine is a ~5 MB base built on musl libc and BusyBox. It yields tiny images and fast pulls, but binary compatibility with glibc-based software can be an issue. Some prebuilt wheels and node-sass binaries fail on musl; use slim Debian-based images when compatibility is critical. With RUN --mount=type=cache,target=/go/pkg/mod, BuildKit mounts a persistent cache directory across builds. Unlike a normal RUN layer, the cache is reused even if the surrounding RUN changes — making Go module downloads and similar workflows fast. CLI plugins are executables named docker-<name> on the PATH; they extend docker with new subcommands. Examples: docker compose, docker buildx, docker scan, docker scout. Install by dropping the binary into ~/.docker/cli-plugins or /usr/local/lib/docker/cli-plugins.

Question 39 Docker Containers

What is the Compose Spec?

docker system df shows Docker's overall disk usage, broken down by images, containers, local volumes, and build cache. Use docker system df -v for per-item details. Helpful before running prune to estimate reclaimable space. RUN executes a command during the image build process and commits the result as a new layer.
Example: RUN apt-get update && apt-get install -y curl
Best practice: chain commands with && to reduce layers. The Compose Specification is an open standard maintained by the Compose community that unifies the docker-compose.yml format across Docker, AWS ECS, Microsoft ACI, Kubernetes (via kompose), and others. A single file is portable to all these platforms. Use flags with docker run:

Memory: --memory=512m
CPU: --cpus=1.5
Memory swap: --memory-swap=1g

In Compose:

deploy:
  resources:
    limits:
      memory: 512M
      cpus: "1.5"

Question 40 Docker Containers

Why should you use minimal base images?

Docker caches each layer during a build. If an instruction and its context haven't changed, the cached layer is reused.
Best practices:

Put rarely-changing instructions (e.g., RUN apt-get) early
Put frequently-changing files (e.g., COPY . .) late

Use prune commands to reclaim disk space:

docker system prune — remove all unused data
docker image prune — remove dangling images
docker container prune — remove stopped containers
docker volume prune — remove unused volumes

Add -a to remove all unused images, not just dangling ones. docker top <container> displays the running processes inside a container, similar to the host top command. You can pass ps flags to filter output, e.g., docker top mycontainer aux. Minimal base images like alpine (5 MB) or distroless images reduce:

Attack surface: fewer packages = fewer vulnerabilities
Image size: faster pulls and deployments
Build time: smaller layers to transfer

Example: FROM python:3.11-slim instead of FROM python:3.11.

Question 41 Docker Containers

What is docker image prune vs docker image prune -a?

docker logs fetches the stdout/stderr output of a container.
Key flags:

-f: follow log output in real time
--tail 100: show last 100 lines
--since 1h: logs from the last hour
-t: show timestamps

docker image prune removes dangling images (untagged). docker image prune -a removes all unused images — including tagged images not referenced by any container. Use -a carefully in CI/build hosts. docker rename <old> <new> changes the name of an existing container. Container names must be unique on a host. Useful when reusing names in scripted environments. Use flags with docker run:

Memory: --memory=512m
CPU: --cpus=1.5
Memory swap: --memory-swap=1g

In Compose:

deploy:
  resources:
    limits:
      memory: 512M
      cpus: "1.5"

Question 42 Docker Containers

What is the bridge network in Docker?

FROM sets the base image for subsequent instructions. It must be the first instruction in a Dockerfile (aside from ARG).
Example: FROM python:3.11-slim
You can also use FROM scratch to start with an empty image. Docker Compose is a tool for defining and running multi-container applications using a YAML file (docker-compose.yml). It manages services, networks, and volumes together.
Key commands:

docker compose up -d
docker compose down
docker compose logs

The bridge network is Docker's default network driver. Containers on the same bridge can communicate by IP. User-defined bridges also support DNS resolution by container name.
Create one with: docker network create mynet
Connect a container: docker run --network mynet myapp By default, the default bridge uses 172.17.0.0/16 with the Docker host at 172.17.0.1. User-defined bridges get the next available 172.x.0.0/16. Override per-network with --subnet and --gateway flags on docker network create.

Question 43 Docker Containers

What is the difference between a Docker image's CMD and a runtime argument?

Control groups (cgroups) limit and account for resource usage (CPU, memory, disk I/O, network) of container processes. Docker uses cgroups to enforce limits set via flags like --memory and --cpus, and to prevent a single container from exhausting host resources. docker export produces a tarball of a container's flattened filesystem (no layers, no metadata). docker save produces a tarball of an image with all its layers and metadata. docker export output must be docker imported, losing history. YAML anchors (&) and aliases (*) let you define a fragment once and reuse it:

x-common: &common
  restart: always
  logging:
    driver: json-file
services:
  web:
    <<: *common

Reduces duplication in large Compose files. When you run docker run myimage echo hi, the argument echo hi overrides the CMD in the Dockerfile. If the Dockerfile has an ENTRYPOINT, the extra arguments are appended to the ENTRYPOINT (in exec form) or replace CMD (in shell form). This is the standard override behavior.

Question 44 Docker Containers

What does docker import do?

A verified publisher is a vendor whose identity has been confirmed by Docker. Their images are listed under a verified namespace, reducing the risk of typosquatting or impersonation compared to random community images. The PID 1 of a container is the main process, and Linux kernel signals default to ignoring SIGTERM/SIGPIPE for PID 1. If your CMD runs a script that doesn't exec the real binary, docker stop may take 10 seconds (the SIGKILL grace period). Use exec form CMD ["app"] to fix. FROM sets the base image for subsequent instructions. It must be the first instruction in a Dockerfile (aside from ARG).
Example: FROM python:3.11-slim
You can also use FROM scratch to start with an empty image. docker import file.tar newimage:tag creates an image from a tarball (typically from docker export). The resulting image has no history or layers — it is a single flat layer. Useful for bootstrapping base images from root filesystems.

Question 45 Docker Containers

What is the host network driver in Docker?

The host network driver removes network isolation and lets the container share the host's network namespace directly.
Usage: docker run --network host myapp
The container uses the host's IP and ports. Useful for performance but reduces isolation. Only works on Linux. STOPSIGNAL sets the system signal sent to the container when docker stop is invoked. Default is SIGTERM. Example: STOPSIGNAL SIGINT for applications that handle SIGINT more gracefully than SIGTERM. A .dockerignore file excludes files and directories from the build context sent to the Docker daemon. This speeds up builds and prevents sensitive files from being included.
Example:

node_modules
.git
*.md
.env

An anonymous volume is created without a name (e.g., -v /data in a Dockerfile). Docker generates a random name; it is hard to reference. Named volumes (myvolume:/data) are explicit, easy to back up, list, and reuse. Prefer named volumes.

Question 46 Docker Containers

What is the difference between COPY and ADD in a Dockerfile?

tini is a tiny init (a few hundred KB) designed to be container PID 1. It reaps zombie processes and forwards signals correctly. Pass it via --init to docker run, or include it in your image as ENTRYPOINT ["/sbin/tini", "--"]. docker network connect mynet mycontainer attaches a running container to an additional network. The container then has an interface on both networks. docker network disconnect mynet mycontainer removes it. COPY simply copies files/directories from the build context into the image. ADD does the same but also supports:

Automatic extraction of local .tar archives
Fetching files from remote URLs

Best practice: prefer COPY unless you need ADD's extra features. Use flags with docker run:

Memory: --memory=512m
CPU: --cpus=1.5
Memory swap: --memory-swap=1g

In Compose:

deploy:
  resources:
    limits:
      memory: 512M
      cpus: "1.5"

Question 47 Docker Containers

What is --read-only filesystem in Docker?

On a user-defined bridge network, Docker's embedded DNS server (127.0.0.11 within containers) resolves container names, network aliases, and service names. On the default bridge, only IPs work — no name resolution. Docker is an open-source platform that automates the deployment of applications inside lightweight, portable containers. Containers package an application with all its dependencies, ensuring it runs consistently across different environments. The overlay network enables communication between containers running on different Docker hosts in a Swarm cluster. It uses VXLAN encapsulation to create a distributed network.
Create with: docker network create --driver overlay myoverlay docker run --read-only mounts the container's root filesystem as read-only. Combined with tmpfs mounts for /tmp and volumes for data dirs, it prevents the container from persisting unwanted writes — a strong hardening technique. The container's writable layer is the only mutable area.

Question 48 Docker Containers

What is the WORKDIR inheritance in a Dockerfile?

A profile groups services so they only start when explicitly requested. Define with profiles: ["debug"] on a service, then run docker compose --profile debug up. Useful for dev-only services like debuggers, load generators, or admin UIs. Each WORKDIR sets the working directory for all following instructions and is inherited by subsequent stages in a multi-stage build (unless overridden). It is created with mkdir -p semantics, so nested paths like WORKDIR /app/src work in one step. Namespaces provide process isolation by giving containers their own views of system resources: PID, network, mount, UTS, IPC, and user namespaces. Each container gets its own set, so processes inside cannot see or interact with resources in other containers or the host (by default). Services are defined under the services key in docker-compose.yml:

services:
  web:
    build: .
    ports:
      - "8080:80"
  db:
    image: postgres:15
    volumes:
      - pgdata:/var/lib/postgresql/data

Question 49 Docker Containers

What is the difference between a Docker image and a Docker layer?

A Docker volume is a persistent storage mechanism managed by Docker, stored outside the container's writable layer.
Types:

Named volumes: docker volume create mydata
Bind mounts: map a host path directly
tmpfs mounts: stored in memory only

The default grace period is 10 seconds. After this, Docker sends SIGKILL. Override with -t or --time: docker stop -t 30 mycontainer gives the process 30 seconds to shut down cleanly. An image is the complete, ready-to-run filesystem blueprint. A layer is an individual read-only diff produced by a Dockerfile instruction. Images are composed by stacking layers in order; layers are shared across images to save space and speed up pulls. Volume labels are key-value metadata attached to a volume, used by the volume driver or external tooling. Set with docker volume create --label env=prod. The local driver reserves opt-prefixed keys for options.

Question 50 Docker Containers

What is the default storage driver for Docker on modern Linux?

On modern Docker with overlay2-supported filesystems (ext4, xfs), the default is overlay2. It is the recommended driver for production. Older drivers like aufs and devicemapper are deprecated; Docker on Windows defaults to windowsfilter. When you run docker run myimage echo hi, the argument echo hi overrides the CMD in the Dockerfile. If the Dockerfile has an ENTRYPOINT, the extra arguments are appended to the ENTRYPOINT (in exec form) or replace CMD (in shell form). This is the standard override behavior. Official images are curated and maintained by Docker in partnership with the upstream project (e.g., nginx, postgres, python, node). They live under a single namespace (no user prefix), follow best practices, and are regularly scanned for vulnerabilities. LABEL adds metadata to an image as key-value pairs.
Example: LABEL maintainer="dev@example.com" version="1.0"
Labels can be inspected with docker inspect and are useful for automation and documentation.