Docker Interview Questions for 5 Years Experience

Multi-stage builds use multiple FROM statements — early stages compile/build, the final stage only copies what's needed. For AI apps: Stage 1 installs all build dependencies (gcc, wheel compilers for numpy/scipy) → Stage 2 copies only the installed packages. Result: image size goes from 2GB to 500MB. Smaller images: faster pulls, less attack surface, lower cloud storage costs.

Never hardcode secrets in Dockerfiles or images. Methods in order of security: (1) Environment variables via --env-file (OK for development), (2) Docker secrets (for Swarm), (3) Kubernetes secrets with external secret management (AWS Secrets Manager, HashiCorp Vault) injected at runtime. For AI apps with multiple API keys (OpenAI, Pinecone, AWS), use a secrets manager that rotates keys automatically.

ENTRYPOINT defines the main executable that always runs. CMD provides default arguments that can be overridden. Best practice: ENTRYPOINT ["uvicorn"] CMD ["main:app", "--host", "0.0.0.0"]. Running docker run image main:app --reload overrides CMD but not ENTRYPOINT. For AI model serving containers, ENTRYPOINT is the server, CMD configures it — allows flexible runtime configuration.

Layer caching is key. Order Dockerfile instructions from least to most frequently changing: (1) Base image, (2) System dependencies (apt install), (3) Python dependencies (COPY requirements.txt, RUN pip install), (4) Application code (COPY . .). This way, changing your code doesn't invalidate the cached Python dependencies layer. Use .dockerignore to exclude __pycache__, .env, and model weight files.

Use NVIDIA Container Toolkit: install nvidia-docker2, then use --gpus all flag or in docker-compose: deploy: resources: reservations: devices: - capabilities: [gpu]. Base image: use nvidia/cuda:12.0-runtime-ubuntu22.04 instead of plain python. For AI inference, PyTorch detects GPU automatically. Monitor GPU usage inside container with nvidia-smi. For production, use dedicated GPU instances (AWS p3, g4 families).

Add HEALTHCHECK in Dockerfile: HEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD curl -f http://localhost:8000/health || exit 1. In FastAPI, create a /health endpoint that checks: DB connection, vector store availability, LLM API reachability. Docker marks container unhealthy if checks fail, and orchestrators (ECS, Kubernetes) restart unhealthy containers automatically.

Debug steps: (1) docker logs <container_id> to see output, (2) docker run --rm -it image bash to get a shell, (3) Override ENTRYPOINT: docker run --entrypoint bash image, (4) Add --restart=no to prevent restart loop, (5) Check exit codes: 137 = OOM killed (increase memory limit), 1 = application error, 127 = command not found. For AI services crashing on startup: often missing env vars or failed model loading.