Backend interview prep

Start

Docker Advanced - Complete Interview Guide

Learn advanced Docker concepts including Docker internals, OCI, containerd, runc, namespaces, cgroups, Docker Compose, BuildKit, storage drivers, security, networking, monitoring, CI/CD integration, and enterprise best practices.

Introduction

Docker Fundamentals teaches you how to build and run containers. In enterprise environments, engineers need a much deeper understanding of how Docker works internally, how containers are isolated, how storage and networking function, and how Docker integrates with CI/CD pipelines and Kubernetes.

This chapter focuses on advanced Docker concepts commonly discussed in senior software engineering, DevOps, platform engineering, and cloud interviews.

Learning Objectives

After completing this chapter, you should understand:

  • Docker Internals
  • OCI (Open Container Initiative)
  • containerd
  • runc
  • Linux Namespaces
  • cgroups
  • Storage Drivers
  • OverlayFS
  • Docker Compose
  • Multi-stage Builds
  • BuildKit
  • Resource Limits
  • Health Checks
  • Logging Drivers
  • Security
  • Docker Networking
  • Private Registries
  • CI/CD Integration
  • Image Optimization
  • Enterprise Best Practices

Why Advanced Docker?

Enterprise applications require:

  • Faster image builds
  • Smaller image sizes
  • Secure containers
  • Persistent storage
  • Efficient networking
  • Automated deployments
  • Monitoring
  • High availability
  • Resource optimization

Docker Internals

Docker is built on several Linux technologies.

Core components:

  • Docker CLI
  • Docker Engine
  • Docker Daemon
  • Docker REST API
  • containerd
  • runc
  • Linux Kernel

Docker Internal Architecture

Developer
      │
Docker CLI
      │
Docker Engine
      │
Docker Daemon
      │
containerd
      │
runc
      │
Linux Kernel
      │
Container

Open Container Initiative (OCI)

OCI defines open standards for:

  • Container Images
  • Container Runtime
  • Image Specifications
  • Runtime Specifications

Benefits:

  • Vendor neutrality
  • Portability
  • Compatibility
  • Standardization

containerd

containerd is the container runtime responsible for:

  • Pulling Images
  • Managing Containers
  • Image Storage
  • Snapshot Management
  • Container Lifecycle

It is used by:

  • Docker
  • Kubernetes
  • Amazon ECS
  • Azure AKS
  • Google GKE

runc

runc is a lightweight runtime that creates and starts containers.

Responsibilities:

  • Create Containers
  • Execute Processes
  • Configure Namespaces
  • Configure cgroups

Linux Namespaces

Namespaces isolate container resources.

Types:

  • PID Namespace
  • Network Namespace
  • Mount Namespace
  • IPC Namespace
  • UTS Namespace
  • User Namespace
  • cgroup Namespace

Benefits:

  • Isolation
  • Security
  • Independent Processes

Namespace Isolation

Container A
   │
Namespaces
   │
Linux Kernel
   │
Container B

Each container sees its own isolated environment.

Control Groups (cgroups)

cgroups manage and limit resource usage.

They control:

  • CPU
  • Memory
  • Disk I/O
  • Network
  • Processes

Example use cases:

  • Limit CPU usage
  • Restrict memory
  • Prevent noisy neighbors

Storage Drivers

Docker stores image layers using storage drivers.

Common drivers:

  • OverlayFS
  • AUFS
  • Btrfs
  • ZFS
  • Device Mapper

OverlayFS is the default on most Linux distributions.

OverlayFS

OverlayFS combines multiple read-only image layers into a single writable container layer.

Application Layer
        │
Dependency Layer
        │
JDK Layer
        │
Base Image

Benefits:

  • Small images
  • Layer reuse
  • Faster downloads
  • Efficient storage

Multi-stage Builds

Multi-stage builds create optimized production images.

Benefits:

  • Smaller image size
  • Better security
  • Faster deployment
  • Cleaner runtime image

Typical stages:

  • Build Stage
  • Test Stage
  • Runtime Stage

BuildKit

BuildKit is Docker's modern build engine.

Features:

  • Faster builds
  • Parallel execution
  • Layer caching
  • Secret management
  • SSH forwarding

Docker Compose

Docker Compose manages multi-container applications.

Typical services:

  • Application
  • Database
  • Redis
  • Kafka
  • RabbitMQ
  • Nginx

Docker Compose Architecture

compose.yaml
      │
Docker Compose
      │
Application
Database
Redis
Kafka

Docker Networking

Advanced network drivers:

  • Bridge
  • Host
  • Overlay
  • Macvlan
  • None

Overlay networks are commonly used in Docker Swarm and Kubernetes.

Resource Management

Containers can be limited using:

  • CPU Limits
  • Memory Limits
  • Restart Policies
  • Ulimits
  • PID Limits

Benefits:

  • Stability
  • Fair resource allocation
  • Predictable performance

Health Checks

Health checks verify whether a container is functioning correctly.

Typical checks:

  • HTTP endpoint
  • TCP connection
  • Process status
  • Database connectivity

Benefits:

  • Automatic restart
  • Better monitoring
  • Faster recovery

Logging Drivers

Docker supports multiple logging drivers.

Examples:

  • json-file
  • syslog
  • journald
  • fluentd
  • awslogs
  • gelf

Enterprise logging solutions:

  • Splunk
  • ELK Stack
  • Datadog
  • Grafana Loki

Docker Security

Security best practices:

  • Run as non-root user
  • Use trusted base images
  • Scan images
  • Keep images updated
  • Use secrets management
  • Limit Linux capabilities
  • Enable read-only filesystem
  • Remove unnecessary packages

Rootless Containers

Rootless mode allows Docker to run without root privileges.

Advantages:

  • Improved security
  • Reduced attack surface
  • Better isolation

Image Optimization

Best practices:

  • Use Alpine images when appropriate
  • Use Distroless images
  • Remove temporary files
  • Minimize layers
  • Combine RUN commands
  • Use multi-stage builds

Private Registries

Enterprise organizations use private registries to store container images.

Examples:

  • Harbor
  • JFrog Artifactory
  • Amazon ECR
  • Azure Container Registry (ACR)
  • Google Artifact Registry (GAR)

Benefits:

  • Security
  • Access control
  • Version management
  • Internal image sharing

Image Scanning

Images should be scanned for vulnerabilities before deployment.

Common tools:

  • Docker Scout
  • Trivy
  • Snyk
  • Clair
  • Grype

CI/CD Integration

Typical pipeline:

Developer
      │
Git Repository
      │
CI Pipeline
      │
Build Image
      │
Run Tests
      │
Scan Image
      │
Push Registry
      │
Deploy

Enterprise Docker Workflow

Developer
      │
Git
      │
Jenkins / GitHub Actions
      │
Docker Build
      │
Image Scan
      │
Artifact Registry
      │
Kubernetes
      │
Production

Performance Optimization

Improve Docker performance by:

  • Using BuildKit
  • Enabling layer caching
  • Reducing image size
  • Using .dockerignore
  • Avoiding unnecessary dependencies
  • Limiting container resources
  • Monitoring container metrics

Monitoring Containers

Monitor:

  • CPU Usage
  • Memory Usage
  • Disk Usage
  • Network Traffic
  • Restart Count
  • Health Status

Common tools:

  • Prometheus
  • Grafana
  • cAdvisor
  • Datadog
  • New Relic

Common Production Issues

  • Container Crash
  • OOM Kill
  • High CPU Usage
  • Image Pull Failure
  • Registry Authentication Failure
  • Disk Space Exhausted
  • Permission Issues
  • Network Connectivity Problems
  • Slow Startup
  • Health Check Failure

Production Troubleshooting

Typical troubleshooting steps:

  1. Check container status.
  2. Review container logs.
  3. Inspect container configuration.
  4. Verify image version.
  5. Check resource utilization.
  6. Validate network connectivity.
  7. Verify mounted volumes.
  8. Confirm registry accessibility.
  9. Restart or recreate the container if required.

Enterprise Best Practices

  • Build immutable images.
  • Use versioned image tags.
  • Never use latest in production.
  • Use multi-stage builds.
  • Store secrets outside images.
  • Run as non-root users.
  • Scan images regularly.
  • Keep images lightweight.
  • Monitor container health.
  • Integrate Docker with CI/CD pipelines.
  • Store images in private registries.
  • Apply resource limits for every container.

Interview Summary

After completing this chapter, you should understand:

  • Docker Internals
  • OCI
  • containerd
  • runc
  • Linux Namespaces
  • cgroups
  • Storage Drivers
  • OverlayFS
  • Multi-stage Builds
  • Docker Compose
  • BuildKit
  • Resource Limits
  • Health Checks
  • Logging Drivers
  • Docker Security
  • Rootless Containers
  • Image Optimization
  • Private Registries
  • CI/CD Integration
  • Container Monitoring
  • Enterprise Docker Workflow
  • Production Troubleshooting

Next Chapter

➡️ Docker Interview Questions

Topics include:

  • 100+ Docker Interview Questions
  • Docker Architecture
  • Dockerfile Scenarios
  • Container Lifecycle
  • Docker Compose
  • Storage & Networking
  • Security Best Practices
  • Multi-stage Build Questions
  • Production Troubleshooting
  • Kubernetes Integration
  • Enterprise Deployment Scenarios