- Beginner (1-20)
- Intermediate (21-40)
- Advanced (41-60)
Answer:
Docker is a containerization platform that allows developers to package applications along with their dependencies into a single unit called a container.
- Why use Docker?
✅ Ensures consistent environments across different machines.
✅ Lightweight & faster than virtual machines.
✅ Easy scaling of applications in microservices architectures.
Answer:
| Feature | Docker | Virtual Machine |
|---|---|---|
| Isolation | Uses containers to isolate apps | Uses hypervisor to run separate OS instances |
| Performance | Faster, lightweight | Slower, resource-intensive |
| Startup Time | Milliseconds | Minutes |
| Use Case | Ideal for microservices | Best for full OS emulation |
Answer:
A Docker image is a read-only template containing everything needed to run an application, including:
- Source code
- Libraries & dependencies
- Configuration files
A container is created from a Docker image using the docker run command.
Answer:
A Docker container is a running instance of a Docker image. It is:
✅ Lightweight (shares OS kernel)
✅ Isolated (has its own filesystem, network, and process space)
✅ Portable (can run on any system with Docker installed)
Answer:
To run a container from an image:
docker run -d --name myapp nginx-d: Run in detached mode (background).--name myapp: Name the containermyapp.nginx: Use the nginx image.
Answer:
A Dockerfile is a script that contains instructions to build a Docker image.
Example Dockerfile:
FROM node:16
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "app.js"]FROM: Base image.WORKDIR: Set working directory.COPY: Copy files.RUN: Execute commands (install dependencies).CMD: Define the default command to run.
Answer:
Docker volumes store persistent data outside a container's filesystem.
- Types:
- Anonymous Volumes:
docker run -v /data nginx - Named Volumes:
docker volume create mydata - Bind Mounts:
docker run -v /host/path:/container/path nginx
- Anonymous Volumes:
Answer:
Use the command:
docker psTo list all containers (including stopped ones):
docker ps -aAnswer:
Docker Compose is a tool for defining and running multi-container applications.
-
Example
docker-compose.yml:version: "3" services: web: image: nginx ports: - "80:80" db: image: mysql environment: MYSQL_ROOT_PASSWORD: root
-
Start with:
docker-compose up -d -
Stop with:
docker-compose down
Answer:
| Feature | CMD | ENTRYPOINT |
|---|---|---|
| Purpose | Default command | Fixed executable command |
| Overridable? | Yes | No (unless --entrypoint is used) |
| Example | CMD ["python", "app.py"] |
ENTRYPOINT ["nginx", "-g", "daemon off;"] |
Answer:
Kubernetes (K8s) is an orchestration platform for managing containerized applications.
- Features:
✅ Automated scaling
✅ Self-healing (restarts failed containers)
✅ Load balancing
✅ Rolling updates
Answer:
A Pod is the smallest unit in Kubernetes. It groups one or more containers that share the same network and storage.
Answer:
A Deployment manages Pod creation and updates.
Example YAML:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
spec:
replicas: 3
selector:
matchLabels:
app: my-app
template:
metadata:
labels:
app: my-app
spec:
containers:
- name: app
image: nginxreplicas: 3→ Runs 3 instances.matchLabels→ Ensures the correct Pods are managed.
Answer:
A Service exposes a set of Pods over a network.
- Types:
- ClusterIP (default)
- NodePort (exposes on a fixed port)
- LoadBalancer (uses cloud provider's load balancer)
Example YAML:
apiVersion: v1
kind: Service
metadata:
name: my-service
spec:
type: NodePort
selector:
app: my-app
ports:
- port: 80
targetPort: 8080
nodePort: 30007Answer:
- ConfigMaps store non-sensitive configuration data.
- Secrets store sensitive data (passwords, API keys).
Example Secret:
apiVersion: v1
kind: Secret
metadata:
name: my-secret
data:
password: bXlwYXNzd29yZA==Answer:
Namespaces logically separate resources within a cluster.
kubectl create namespace dev
kubectl get namespacesAnswer:
A StatefulSet is used for stateful applications like databases. Unlike Deployments, it maintains:
✅ Stable pod identity
✅ Persistent storage
Answer:
Manually scale using:
kubectl scale deployment my-app --replicas=5Answer:
A DaemonSet ensures that one Pod runs on every node (e.g., logging agents, monitoring).
Answer:
Update the image and apply changes:
kubectl set image deployment/my-app my-container=nginx:latestAnswer:
| Feature | ADD | COPY |
|---|---|---|
| Function | Copies files & extracts compressed files | Copies files only |
| Supports URLs? | Yes | No |
| Best Practice | Use for archives (.tar.gz) |
Use for simple file copies |
Example:
COPY config.json /app/config.json
ADD myapp.tar.gz /app/Answer:
-
Use smaller base images (e.g.,
alpineinstead ofubuntu). -
Multi-stage builds to reduce image size:
FROM node:16 AS build WORKDIR /app COPY . . RUN npm install && npm run build FROM nginx:alpine COPY --from=build /app/dist /usr/share/nginx/html
-
Use
.dockerignoreto avoid unnecessary files.
Answer:
ENTRYPOINTis not overridden by command-line arguments, whileCMDcan be.- Best practice: Use
ENTRYPOINTfor fixed commands.
Example:
ENTRYPOINT ["nginx", "-g", "daemon off;"]
CMD ["-p", "80"]Answer:
- Get container logs:
docker logs my-container - Attach to a running container:
docker exec -it my-container /bin/sh - Inspect container details:
docker inspect my-container
Answer:
A multi-stage build reduces image size by using multiple FROM statements.
FROM golang:1.17 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM alpine
COPY --from=builder /app/myapp /myapp
ENTRYPOINT ["/myapp"]The final image only contains the built binary.
Answer:
- Bridge network (default): Containers communicate via virtual network.
- Host network: Container shares the host’s networking stack.
- Overlay network: Used in Docker Swarm for multi-host networking.
Example:
docker network create mynetwork
docker run --network=mynetwork nginxAnswer:
| Feature | Docker Swarm | Kubernetes |
|---|---|---|
| Orchestration | Lightweight, built into Docker | Advanced, feature-rich |
| Scaling | Manual | Auto-scaling |
| Service Discovery | Built-in | Needs external setup (DNS, Ingress) |
Answer:
docker system prune -aThis removes stopped containers, unused networks, and dangling images.
Answer:
Docker BuildKit improves build speed and caching.
Enable it with:
DOCKER_BUILDKIT=1 docker build .Benefits:
✅ Faster builds
✅ Parallel execution
✅ Improved caching
Answer:
Use --memory and --cpus:
docker run --memory=512m --cpus=1 nginxThis limits memory to 512MB and CPU usage to 1 core.
Answer:
- Uses multiple master nodes to avoid single points of failure.
- Deployments use replica sets to keep applications running.
- Load balancing & failover mechanisms ensure availability.
Answer:
Kubelet runs on each node and:
✅ Communicates with the master node
✅ Ensures containers are running
✅ Monitors container health
Answer:
kubectl logs my-pod
kubectl logs -f my-pod # Stream logs in real-timeAnswer:
Labels identify resources, while selectors filter resources.
Example:
metadata:
labels:
app: my-appTo filter pods by label:
kubectl get pods -l app=my-appAnswer:
An Ingress manages external access to services.
Example:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: my-ingress
spec:
rules:
- host: myapp.com
http:
paths:
- path: /
backend:
service:
name: my-service
port:
number: 80Use Ingress controllers (NGINX, Traefik) to manage Ingress resources.
36. What is the difference between Horizontal Pod Autoscaler (HPA) and Vertical Pod Autoscaler (VPA)?
Answer:
| Feature | HPA | VPA |
|---|---|---|
| Scaling Type | Adds/removes pods | Adjusts CPU/memory of existing pods |
| Use Case | High traffic apps | Resource optimization |
Example of HPA:
kubectl autoscale deployment my-app --cpu-percent=50 --min=2 --max=10Answer:
A Persistent Volume (PV) is a storage resource, and a Persistent Volume Claim (PVC) requests storage.
Example:
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: my-pvc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1GiAnswer:
Modify the image and apply the deployment:
kubectl set image deployment/my-app my-container=nginx:1.20
kubectl rollout status deployment my-appAnswer:
- Job: Runs once and exits.
- CronJob: Runs on a schedule (like a Linux cron).
Example:
apiVersion: batch/v1
kind: CronJob
metadata:
name: my-cronjob
spec:
schedule: "0 * * * *"
jobTemplate:
spec:
template:
spec:
containers:
- name: hello
image: busybox
command: ["echo", "Hello from Kubernetes"]
restartPolicy: OnFailureAnswer:
-
Check pod logs:
kubectl logs my-pod
-
Describe the pod for errors:
kubectl describe pod my-pod
-
Exec into the container:
kubectl exec -it my-pod -- /bin/sh
Answer:
- Namespaces isolate resources (PID, network, mount points, etc.) for each container.
- Cgroups (Control Groups) limit CPU, memory, and disk usage.
- Together, they ensure process isolation and resource allocation.
Example:
cat /proc/self/cgroupAnswer:
| Type | Persistent? | Use Case |
|---|---|---|
| Volumes | Yes | Best for data persistence |
| Bind Mounts | Yes | Direct host file access |
| tmpfs | No | In-memory storage for performance |
Example (Volume):
docker run -v myvolume:/data nginxAnswer:
- Parallel execution speeds up builds.
- Efficient caching reduces rebuild time.
- Security improvements via secret mounts.
Enable BuildKit:
DOCKER_BUILDKIT=1 docker build .Answer:
- Use minimal base images (e.g.,
alpine). - Run as non-root user.
- Limit container capabilities (
--cap-drop=ALL). - Use read-only filesystems (
--read-only).
Example:
docker run --user 1001 --read-only nginxAnswer:
- Keeps sensitive files out of the final image.
- Reduces attack surface by discarding unnecessary dependencies.
Example:
FROM golang AS build
COPY . .
RUN go build -o myapp
FROM alpine
COPY --from=build /myapp /myapp
ENTRYPOINT ["/myapp"]Answer:
- Containers should be replaced, not modified.
- Use image versioning instead of patching live containers.
- Example: Deploy new image versions instead of updating running containers.
Answer:
-
Ensures image integrity with digital signatures.
-
Enable DCT:
export DOCKER_CONTENT_TRUST=1
Answer:
- Check logs:
journalctl -u docker.service - Restart service:
systemctl restart docker - Debug mode:
dockerd --debug
Answer:
- Docker Compose is for single-host deployments.
- Docker Stack is for multi-node Swarm clusters.
Answer:
-
Overlay networks span multiple hosts.
-
Example:
docker network create -d overlay mynetwork
Answer:
- Uses StatefulSets instead of Deployments.
- Provides stable network identities and persistent storage.
Example:
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: mysql
spec:
serviceName: "mysql"
replicas: 3Answer:
-
Ensures minimum availability during voluntary disruptions.
-
Example:
apiVersion: policy/v1 kind: PodDisruptionBudget metadata: name: my-pdb spec: minAvailable: 2 selector: matchLabels: app: my-app
Answer:
-
Use encryption at rest.
-
Store secrets in external vaults (e.g., HashiCorp Vault).
-
Example:
kubectl create secret generic db-secret --from-literal=password=mysecurepassword
Answer:
- They intercept API requests before they reach the cluster.
- Example:
PodSecurityPolicies,ValidatingWebhookConfiguration.
Answer:
- Kubelet marks node as NotReady.
- Pods are rescheduled onto healthy nodes.
- Node auto-repair triggers in cloud-managed clusters.
Answer:
- Modifies requests dynamically before they reach the cluster.
- Example: Injecting sidecars into Pods.
Answer:
-
Check Pod-to-Pod connectivity:
kubectl exec -it pod1 -- ping pod2 -
Inspect network policies:
kubectl get networkpolicy
-
Validate DNS resolution:
kubectl exec -it pod -- nslookup my-service
Answer:
-
Uses metrics API (CPU/memory usage).
-
Adjusts replica count dynamically.
-
Example:
kubectl autoscale deployment my-app --cpu-percent=50 --min=2 --max=10
Answer:
-
Use Namespaces to isolate workloads.
-
Apply RBAC (Role-Based Access Control).
-
Example:
apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: team-a name: team-a-role rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "list", "watch"]
Answer:
- Manages multiple clusters as a single entity.
- Benefits: Cross-region high availability, policy consistency.
- Example tool:
kubefed
💡 Want to contribute?
We welcome contributions! If you have insights, new tools, or improvements, feel free to submit a pull request.
📌 How to Contribute?
- Read the CONTRIBUTING.md guide.
- Fix errors, add missing topics, or suggest improvements.
- Submit a pull request with your updates.
📢 Stay Updated:
⭐ Star the repository to get notified about new updates and additions.
💬 Join discussions in GitHub Issues to suggest improvements.
🔗 GitHub: @NotHarshhaa
📝 Blog: ProDevOpsGuy
💬 Telegram Community: Join Here
