Question 1

What is Docker?

Accepted Answer

Keep it short and mention the mechanism rather than the marketing: a way to package an application with its dependencies into an image, and run it as an isolated process using kernel features — namespaces for what it can see, cgroups for what it can use. Two sentences is plenty; the interviewer wants to move on.

Question 2

So how is that different from a virtual machine?

Accepted Answer

The shared kernel is the whole answer, and everything else follows from it: no guest OS to boot, so start-up is milliseconds; much higher density; but a weaker isolation boundary, because the boundary is the system call interface rather than a hypervisor. Naming that trade-off unprompted is the strong signal.

Question 3

What happens to data written inside a container when it exits?

Accepted Answer

Distinguish restart from replacement, because that distinction is the practical one. A container gets a thin writable layer on top of the image's read-only layers; `docker restart` keeps it, removing and recreating the container does not. So data survives a restart and not a deploy, which is exactly the confusing symptom people hit.

Question 4

So how would you persist data?

Accepted Answer

Volumes, and then say why it is not merely a nicer bind mount: a volume has a lifecycle independent of any container, which is the property you need. Mentioning that this is the point where a single-host answer stops working — and orchestration introduces PersistentVolumeClaims and storage classes — shows you know where the boundary is.

Question 5

What security concerns would you have about a container in production?

Accepted Answer

Pick two or three concrete ones and explain the mechanism, rather than listing ten. Running as root is the highest-value one: the container's root is the host's uid 0, so a namespace escape starts from a strong position. A read-only root filesystem removes persistence. Dropping capabilities removes powers nothing uses. And the base image drives most of what a scanner will report.

Question 6

You add a HEALTHCHECK and the container still takes 10 seconds to stop. Why?

Accepted Answer

This is the question that separates people who have shipped containers. It is almost always shell-form ENTRYPOINT: `/bin/sh -c` becomes PID 1, does not forward SIGTERM, so the application never receives the signal and Docker eventually SIGKILLs it after the grace period. Exec form fixes it. Being able to name exit code 137 as the fingerprint is the finishing touch.