Knowing how to build an image is only the first step. Interviewers for DevOps and backend roles want to know how your containers talk to each other, how you lock them down, and how they behave when something goes wrong in production. This fifth set goes past the basics into Docker networking, container security, resource limits and the settings that keep containers healthy in real deployments.
How to practise: read each question and tap the option you think is correct. You will see right away whether you got it, along with a short explanation, and your score is tracked at the bottom of the screen. This set has 15 questions.
Topics covered in this set
- Bridge, host, overlay and none network drivers
- DNS between containers on user-defined networks
- Non-root users, capabilities and read-only filesystems
- Namespaces, cgroups and memory limits
- Image tags vs digests, minimal images and scanning
- Healthchecks, restart policies, build secrets and logging
Docker MCQs with answers and explanations
Q1. If you start a container with docker run and do not pass any --network option, which network driver does it use?
a) host
b) bridge
c) overlay
d) none
Q2. Two containers are on the same user-defined bridge network called app-net. What can the api container do that it could not do on the default bridge network?
a) Use more than one CPU core
b) Share the host's IP address
c) Reach the other container by its container name, because Docker provides built-in DNS on user-defined networks
d) Skip the need for any ports inside the container
Q3. What happens when you run a container with --network host on a Linux machine?
a) The container uses the host's network stack directly, so it has no separate IP and any -p port mappings are ignored
b) The container gets two IP addresses, one private and one public
c) The container can only talk to other containers, not to the internet
d) Docker creates an encrypted tunnel to the host
Q4. Which Docker network driver is meant for containers running on different hosts that need to talk to each other, for example in a Docker Swarm cluster?
a) bridge
b) none
c) macvlan only
d) overlay
Q5. Why is it recommended to add a USER instruction so the container process does not run as root?
a) Non-root containers start faster
b) Root inside a container is, by default, the same UID 0 as root on the host, so a container escape or a bug in the app gives an attacker much more power
c) Docker refuses to publish ports for root processes
d) It reduces the size of the image
Q6. Which pair of Linux kernel features does Docker rely on for isolation and for limiting resources?
a) Namespaces for isolation (PID, network, mount and so on) and cgroups for limits on CPU, memory and I/O
b) SELinux for isolation and iptables for limits
c) chroot for isolation and nice for limits
d) Hypervisors for isolation and swap for limits
Q7. A container started with --memory=512m keeps using more memory until it goes past the limit. What usually happens?
a) Docker moves the container to another host
b) The memory limit is raised automatically
c) The kernel's OOM killer stops the main process and the container exits, often with exit code 137
d) The container keeps running but slows down forever
Q8. Why do some teams deploy images by digest (for example myapp@sha256:3f9a...) instead of by a tag like myapp:1.4?
a) Digests download faster
b) Digests are required for private registries
c) Tags cannot contain version numbers
d) A digest always points to exactly the same image content, while a tag can be moved to a different image later
Q9. What is the main security benefit of using a minimal or distroless base image for production?
a) The container gets more CPU
b) There are far fewer packages, often not even a shell, so there is less for attackers to use and fewer known vulnerabilities to patch
c) It encrypts all files in the image
d) It removes the need for a Dockerfile
Q10. A container has a HEALTHCHECK and is started with plain docker run --restart=always. The check fails several times in a row. What does Docker do?
a) It marks the container as unhealthy but does not restart it, because restart policies react only to the process exiting
b) It restarts the container immediately
c) It deletes the container and pulls the image again
d) It stops the Docker daemon
Q11. What is the difference between the restart policies always and unless-stopped?
a) always never restarts after a crash
b) unless-stopped only works in Kubernetes
c) If you stop the container by hand, always will start it again when the Docker daemon restarts, while unless-stopped will leave it stopped
d) There is no difference
Q12. You need a private npm token while building an image, but it must not end up in the final image or its history. What is the right approach?
a) Pass it with ARG and delete it in the last RUN step
b) Set it with ENV and unset it later
c) COPY the token file in and delete it in the next layer
d) Use a BuildKit secret mount, for example RUN --mount=type=secret,id=npmrc, so the secret is available only during that step
Q13. What does running a container with the --read-only flag do?
a) It makes the container's root filesystem read-only, so you add tmpfs or volumes only for paths that really need writing
b) It stops the container from reading environment variables
c) It blocks all network traffic
d) It makes the image impossible to delete
Q14. What do tools like Trivy or Docker Scout do when you run them against an image?
a) They make the image smaller
b) They check the packages and libraries inside the image against databases of known vulnerabilities (CVEs)
c) They convert the image to a virtual machine
d) They sign the image with your private key
Q15. Why should an app running in a container write its logs to stdout and stderr instead of to a log file inside the container?
a) Files cannot be created inside containers
b) stdout is faster than any disk
c) Docker's logging driver collects stdout and stderr, so docker logs and central log tools can read them, while files inside the container are hard to reach and are lost when it is removed
d) Log files are not allowed by Linux
Quick revision notes
- Default network is bridge; user-defined bridges add DNS by container name; host mode shares the host's network; overlay spans hosts.
- Run as a non-root USER, drop capabilities you don't need and use --read-only with tmpfs for writable paths.
- Namespaces isolate, cgroups limit. Going over --memory gets the process OOM-killed (exit code 137).
- Pin images by digest for repeatable deploys; prefer slim or distroless bases and scan images in CI.
- HEALTHCHECK only reports status in plain Docker; restart policies react to the process exiting. Use BuildKit secret mounts, never ARG/ENV, for build secrets.
Frequently asked questions
Is Docker still worth learning when companies use Kubernetes?
Yes. Kubernetes runs container images, and you still need to write good Dockerfiles, understand layers, networking and security, and debug containers locally. Docker knowledge transfers directly to Kubernetes work.
What is the most common Docker security mistake?
Running containers as root with a large base image full of tools, and putting secrets in ARG or ENV. Fixing these three things removes a big part of the risk.
What does exit code 137 mean for a container?
It means the process was killed with SIGKILL. The most common cause is going over the memory limit and being stopped by the OOM killer. Check docker inspect for OOMKilled.
Comments
Post a Comment