- How does Docker use Linux namespaces and cgroups under the hood?
- What happens internally when you run docker run nginx? Walk through every step.
- How does the Docker layered filesystem (UnionFS) work, and how can it cause performance issues?
- What’s the difference between an overlay2 and AUFS storage driver, and when would you choose one over the other?
- How do you handle disk I/O bottlenecks caused by container layer writes?
- How do you minimize Docker image size for production workloads?
- Why is order of layers important in Dockerfiles, and how does caching affect builds?
- How do you troubleshoot “Docker build cache not being used” issues?
- Have you used multi-stage builds? Show a real example where it reduced build time or image size.
- How do you manage base image updates across hundreds of dependent images?
- How do you benchmark container resource consumption (CPU, I/O, memory)?
- How do you isolate “noisy neighbour” containers in shared hosts?
- How do you troubleshoot high CPU or memory leaks inside running containers?
- How do you handle long-running containers that gradually consume disk space?
- What’s the difference between --cpus, --memory, and cgroup-level throttling — and how do they interact?
- Explain how Docker’s default bridge network works behind the scenes.
- How do you debug intermittent network drops between containers on different hosts?
- How do overlay networks differ between Docker Swarm and Kubernetes CNI?
- What’s your strategy for securing container-to-container and host-to-container communication?
- How do you expose multiple services from the same container safely (and why might that be a bad idea)?
- How do you persist and back up container data reliably?
- What’s the difference between bind mounts, volumes, and tmpfs?
- How do you handle stale or orphaned volumes after container removal?
- How do you troubleshoot “device or resource busy” errors when removing Docker volumes?
- How do you manage shared volumes across multiple containers in different nodes?
- How do you scan Docker images for vulnerabilities automatically?
- How do you ensure non-root containers run securely in production?
- How do you prevent sensitive data (keys, configs) from being baked into images?
- How do you handle Docker socket exposure securely when CI/CD systems use it?
- Have you implemented runtime container security (Falco, Aqua, Prisma Cloud)? Describe the setup.
- A container keeps restarting — walk me through your debugging process.
- You have intermittent “image pull backoff” errors in production — how do you approach it?
- Docker daemon is unresponsive — what logs or commands do you check first?
- A containerized app behaves differently from running locally — what’s your investigation path?
- Jenkins builds are failing randomly with “no space left on device” — what are your immediate steps?
- How do you roll out Docker updates to thousands of hosts without downtime?
- How do you manage and monitor Docker across multiple environments (cloud + on-prem)?
- Have you used Docker-in-Docker (dind)? What problems can it cause?
- How do you implement multi-arch builds (e.g., ARM + AMD64) for modern CI/CD?
- How do you design a caching layer for Docker registries in air-gapped environments?
- How do you debug image corruption or digest mismatches in registries?
- How do you enforce image provenance and prevent unverified images from running?
- How do you monitor Docker metrics (API latency, container health) using Prometheus or Datadog ?
- How do you handle container sprawl — too many containers consuming resources silently?
- What’s your process to perform zero-downtime upgrades of Docker hosts in production?