Docker & Kubernetes practice questions with answers

Practise Docker and Kubernetes questions at your own pace: images, containers, Dockerfiles, volumes, networking, compose and Kubernetes basics. Pick an answer to see whether you are right and why. Nothing is timed or ranked here; for that, play the Daily Quiz at 4 PM IST.

1. What is the difference between a Docker image and a container?

   easy

   1. They are the same
   2. An image is a read-only template; a container is a running instance of an image
   3. A container is stored in a registry
   4. Images run, containers are files

   Answer: B. An image is a read-only template; a container is a running instance of an image

   Explanation: You build an image once and can start many containers from it.

2. Which file describes how to build an image?

   easy

   1. docker-compose.yml
   2. Dockerfile
   3. package.json
   4. .dockerignore

   Answer: B. Dockerfile

   Explanation: A Dockerfile lists instructions such as FROM, COPY, RUN and CMD. Compose files describe multi-container setups.

3. What does docker run -p 8080:3000 my-app do?

   easy

   1. Runs the app on port 8080 inside the container
   2. Maps port 8080 on the host to port 3000 in the container
   3. Limits memory to 8080 MB
   4. Opens 3000 ports

   Answer: B. Maps port 8080 on the host to port 3000 in the container

   Explanation: The format is host:container. Visiting localhost:8080 reaches the app listening on 3000 inside.

4. Why use a volume?

   easy

   1. To speed up builds
   2. To keep data (such as a database's files) outside the container so it survives restarts and removal
   3. To expose ports
   4. To shrink images

   Answer: B. To keep data (such as a database's files) outside the container so it survives restarts and removal

   Explanation: A container's own file system disappears when the container is removed.

5. Why copy package.json and install dependencies before copying the rest of the source in a Dockerfile?

   medium

   1. It is required by Docker
   2. Layer caching: if only source files change, the dependency layer is reused and builds are much faster
   3. It makes the image smaller
   4. For security

   Answer: B. Layer caching: if only source files change, the dependency layer is reused and builds are much faster

   Explanation: Each instruction creates a layer that is cached until its inputs change. Put rarely changing steps first.

6. What is a multi-stage build for?

   medium

   1. Running several containers
   2. Building in one stage with full tools, then copying only the output into a small runtime image
   3. Deploying to many clouds
   4. Parallel tests

   Answer: B. Building in one stage with full tools, then copying only the output into a small runtime image

   Explanation: Compilers and dev dependencies stay out of the final image, which makes it smaller and safer.

7. What is the difference between CMD and ENTRYPOINT?

   medium

   1. None
   2. ENTRYPOINT sets the executable that always runs; CMD gives default arguments that docker run can override
   3. CMD runs at build time
   4. ENTRYPOINT only works on Linux

   Answer: B. ENTRYPOINT sets the executable that always runs; CMD gives default arguments that docker run can override

   Explanation: With ENTRYPOINT ["python", "app.py"] and CMD ["--port", "80"], docker run image --port 90 replaces only the CMD part.

8. In docker compose, how does a web service reach a db service?

   medium

   1. Through localhost
   2. By the service name as host name, e.g. postgres://db:5432, on the network compose creates
   3. Only through published ports
   4. They cannot talk

   Answer: B. By the service name as host name, e.g. postgres://db:5432, on the network compose creates

   Explanation: Each container has its own localhost. Compose puts services on a shared network with DNS names.

9. How do containers differ from virtual machines?

   hard

   1. Containers include a full guest OS
   2. Containers share the host kernel and isolate processes with namespaces and cgroups; VMs run a separate kernel on a hypervisor
   3. VMs start faster
   4. There is no difference

   Answer: B. Containers share the host kernel and isolate processes with namespaces and cgroups; VMs run a separate kernel on a hypervisor

   Explanation: That is why containers start in seconds and are lighter, but the isolation is weaker than a VM's.

10. Why should a container not run as root?

    hard

    1. It is slower
    2. If the app is compromised, root in the container makes escaping to the host and damaging mounted files easier
    3. Root cannot use the network
    4. Docker forbids it

    Answer: B. If the app is compromised, root in the container makes escaping to the host and damaging mounted files easier

    Explanation: Add a USER instruction with an unprivileged user, and drop capabilities you do not need.

11. In Kubernetes, what is a Deployment responsible for?

    hard

    1. Storing images
    2. Keeping a desired number of identical pods running and rolling out new versions gradually
    3. Routing external traffic
    4. Running database migrations

    Answer: B. Keeping a desired number of identical pods running and rolling out new versions gradually

    Explanation: A Service gives the pods a stable address; an Ingress routes external HTTP traffic to Services.

12. Which are good Dockerfile practices? (Select all that apply)

    hard

    1. Use a .dockerignore to keep node_modules and .git out of the build context
    2. Pin base image versions instead of using latest
    3. Bake secrets such as API keys into the image
    4. Use multi-stage builds for compiled apps

    Answer: A. Use a .dockerignore to keep node_modules and .git out of the build context; B. Pin base image versions instead of using latest; D. Use multi-stage builds for compiled apps

    Explanation: Secrets in an image can be read by anyone who can pull it, even if a later layer deletes them. Pass them at run time instead.

Play the Daily Quiz at 4 PM IST