Learning roadmap
Learn each topic from scratch, then practice the interview questions on it — in order.
1
1. Learn
Docker Architecture, Engine, Daemon, Client & RegistryImages, Layers, Caching & Container LifecycleDockerfile Instructions & Multi-Stage BuildsStorage: Volumes, Bind Mounts & tmpfsDocker Networking: Bridge, Host, Overlay, DNS & Port MappingDocker Compose: Services, Networks, Volumes, Scaling & Health ChecksContainer Security: Non-Root, Secrets, Image Scanning & DistrolessMonitoring: Logs, Metrics, Prometheus & GrafanaSpring Boot Integration: Dockerizing, PostgreSQL, Redis, Kafka & MicroservicesCI/CD with Docker: Jenkins, GitHub Actions & GitLab CIKubernetes Fundamentals: Docker vs K8s, Runtime, Pods & DeploymentsPerformance Optimization: Layer Caching, Multi-Stage Builds & AlpineProduction Best Practices: Logging, Monitoring, Scaling, HA & Disaster RecoveryDocker Registry & Image Distribution: Tagging, Versioning, Push & PullContainerized System Design: Microservices, API Gateway, Event-Driven & Deployment Architectures
2. Practice interview questions
What is containerd and how does it relate to Docker?What is runc?How does the Docker CLI communicate with the daemon?What happens internally when you run `docker run nginx`?Is a container a lightweight VM?What is a Docker Registry, and how is it different from Docker Hub?What is the OCI and why does it matter?Why was dockershim removed from Kubernetes, and does that mean Docker images stopped working?How would you secure access to the Docker daemon in production?CI runner can't reach the Docker daemonA teammate mounted the Docker socket into a web app containerHow does Docker's layer caching work during a build?Why does file order matter in a Dockerfile for caching?What happens to a container's writable layer when you delete the container?Explain the container lifecycle states.What is copy-up, and why does it matter for performance?How would you reduce the size of a Docker image?What does `docker commit` do, and why is it discouraged for production image builds?If a container's main process forks a background daemon and then the main process exits, does the container keep running?Image keeps growing across rebuilds despite removing filesCache never hits in CI even though source code didn't changeWhat is the difference between COPY and ADD?What is the difference between ARG and ENV?Does EXPOSE actually publish a port?Why should you use exec form instead of shell form for ENTRYPOINT/CMD?What happens if both CMD and ENTRYPOINT are defined in a Dockerfile?What is a multi-stage build and why use one?How would you pass a different JAR file name into the build without editing the Dockerfile?What does HEALTHCHECK do, and how does Docker use the result?Why might WORKDIR be safer than using RUN cd?docker stop always takes 10 seconds even though the app shuts down instantly when killed manuallyFinal image still contains Maven and the full JDK despite 'minimizing' itWhy are volumes preferred over bind mounts for production databases?What is tmpfs and when would you use it?What happens to a named volume when its container is removed?What is an anonymous volume and why can it be a problem?How would you back up data stored in a Docker volume?Can multiple containers share the same volume simultaneously?How does a volume mount differ technically from a bind mount at the kernel level?Postgres data vanished after a routine container image upgradeLive reload isn't picking up file changes inside a containerized dev environmentWhy can't containers on the default bridge network resolve each other by name?How does Docker route external traffic into a container?What is the difference between EXPOSE and -p in terms of networking?What is an overlay network and why does it matter for clustering?What happens if you use host networking mode?How would you isolate a database so only specific services can reach it?Can a container be attached to multiple networks at once?Service A can't reach Service B by hostname despite both runningA container's published port works locally but isn't reachable from another machine on the networkDoes depends_on guarantee a dependency is ready before the dependent service starts?How does service discovery work in Compose without any extra configuration?How would you scale a service with Docker Compose, and what constraint does that introduce?What is the difference between docker compose down and docker compose down -v?How do you manage different configuration for local dev vs CI vs staging using Compose?Is Docker Compose suitable for production?App container keeps crash-looping on startup because the database isn't ready yetScaling a service breaks because of a 'port already in use' errorHow should secrets be passed into a container, and why not just use environment variables?What is image scanning and what does it actually check?What is a distroless image and why use one?What is the difference between running as non-root inside a container and using rootless Docker?How would you enforce security scanning as part of a CI/CD pipeline?What Linux capabilities-related hardening would you apply to a production container?A security audit flags that database credentials are visible via `docker inspect` on production hostsAn image scan suddenly reports a dozen new Critical CVEs on an image that hasn't changed in monthsWhat problem does log rotation solve, and how do you configure it?What is the difference between Prometheus's pull model and a push-based metrics system?How does Spring Boot expose metrics for Prometheus to scrape?What role does Grafana play relative to Prometheus?What is cAdvisor and what does it add on top of application-level metrics?Why is docker stats not a substitute for a real monitoring stack?A production host ran out of disk space and the cause turned out to be container logsPrometheus shows a service's memory metric climbing steadily for days before it gets OOM-killedWhy might a Spring Boot app work fine locally (run from the IDE) but fail to connect to Postgres once containerized?What is the classic Kafka-in-Docker connectivity bug, and how do you fix it?What's the difference between Actuator's readiness and liveness probes, and why does the distinction matter?How would you design a Compose-based local environment that mirrors a production microservices topology?What happens to Redis-cached data when its container restarts, and how would you change that behavior?What is Testcontainers and how does it relate to the concepts in this book?Order service crash-loops on startup only in Docker Compose, never when run locally from the IDEKafka consumers in one service never receive messages produced by another serviceWhy is tagging images with 'latest' discouraged in CI/CD pipelines?What are Kaniko and Buildah, and why would you use them instead of standard docker build in CI?How would you speed up slow Docker builds in a CI pipeline?What does a typical security gate look like in a Docker CI/CD pipeline?What is the relationship between CI and CD in a Docker-based workflow?A CI pipeline that used to take 3 minutes now takes 18 minutes after a team grew its monorepoAn auditor asks 'which exact commit is running in production right now' and nobody can answer confidentlyWhat is a Pod, and why is it the unit of scheduling rather than a single container?What does a Deployment provide that directly running Pods does not?How does Kubernetes solve the same service-discovery problem Compose solves with embedded DNS?Why should readiness and liveness probes typically check different things?What happens during a Kubernetes rolling update?What is the practical relationship between Docker (from earlier chapters) and Kubernetes?A team is told 'we can't use our existing Docker images anymore because Kubernetes removed Docker support'A rolling update of a Spring Boot Deployment causes a brief spike in 502 errors during every deploymentWhy isn't switching to Alpine always a safe, free performance win?How do BuildKit cache mounts differ from regular Docker layer caching?What's the practical difference between choosing Alpine vs distroless for a production image?Why does instruction ordering matter even when a multi-stage build is already in use?A team switches a Java service's base image to Alpine for size savings and starts seeing intermittent, hard-to-reproduce DNS resolution failures in production onlyCI build times haven't improved despite the team adding multi-stage builds to every DockerfileWhat are RTO and RPO, and how do they drive architecture decisions?Why is a single-replica 'critical' service a high-availability anti-pattern even if it has a restart policy?What's the difference between having backups and having disaster recovery?How do blue-green and rolling deployments differ in terms of risk and rollback speed?Why should alerting be based on user-facing SLOs rather than only on infrastructure metrics like CPU?What does 'eliminating single points of failure' mean in practice for a typical three-tier web application?How does centralized logging change incident response compared to relying on `docker logs` per host?What is a 'game day' or chaos engineering exercise, and what production gap does it catch that monitoring alone doesn't?Why might a company choose active-passive disaster recovery over active-active across regions, despite active-active offering better RTO?A production order-processing service has 99.9% uptime SLA, runs as a single Docker container with `restart: always`, and the team is confident because 'it auto-restarts on crash'During a postmortem, the team discovers their nightly database backup script has been silently failing for three weeks due to a credential rotation that broke the backup job's auth, and nobody noticedA company's RPO requirement for a financial ledger service is effectively zero (no data loss is acceptable), but their current architecture uses asynchronous cross-region replication with a 30-second typical lagWhat is the difference between a container and a virtual machine?What are namespaces and cgroups, and what does each provide?What is the role of containerd and runc in the Docker architecture?What is the OCI, and why does it matter?How does the Docker client communicate with the daemon?What happens when you run `docker run`?What is a registry, and how does it differ from Docker Hub?Why was dockershim removed from Kubernetes?Is Docker still relevant if Kubernetes no longer uses dockershim?What is the difference between the Docker Engine and Docker Desktop?What makes Docker images layered, and why does that matter?What is copy-on-write, and how does it apply to containers?What is the difference between `docker commit` and writing a Dockerfile?What are the container lifecycle states?What's the difference between `docker stop` and `docker kill`?Why might a container exit immediately after `docker run`?What is an image digest, and how does it differ from a tag?Why is `latest` considered risky to rely on in production?What does `docker image prune -a` do differently from `docker image prune`?How can you inspect what changed between two image layers?What's the practical difference between CMD and ENTRYPOINT?Why is exec form preferred over shell form for CMD/ENTRYPOINT?What is the difference between ARG and ENV?Why is instruction order important for build cache efficiency?What problem do multi-stage builds solve?What's the difference between COPY and ADD?What does HEALTHCHECK actually do?Why might EXPOSE alone not be enough to access a container's service?What is BuildKit, and how does it differ from the legacy builder?How do you pass a build secret without leaking it into image layers?What does `.dockerignore` do, and why does it matter for build performance?Why might a production Dockerfile explicitly set a non-root USER?What is the main difference between a named volume and a bind mount?When would you use a tmpfs mount instead of a volume?What happens to an anonymous volume created implicitly by a Dockerfile's VOLUME instruction if you don't bind it explicitly?Why doesn't the default Docker bridge network support container-name-based DNS resolution?How does host networking mode differ from bridge mode?What is an overlay network used for?How does Docker implement published ports under the hood?What's the difference between `docker compose up` and `docker compose up -d`?Why doesn't `depends_on` alone guarantee a dependency is ready to accept connections?Why can't you combine a fixed host port mapping with `docker compose up --scale`?What's the difference between `docker compose down` and `docker compose down -v`?How does Compose decide which network to put services on by default?What's the purpose of `environment:` vs `env_file:` in a compose.yaml?Why is scaling a stateful service (like a database) fundamentally different from scaling a stateless API service?What is the function of Docker's embedded DNS server?How would you persist PostgreSQL data across container recreation in Compose?What's a common pitfall when bind-mounting source code for live-reload development?Why might two containers on the same bridge network fail to reach each other even though both are running?Why should containers avoid running as root?What is userns-remap, and what does it protect against?How do Docker secrets differ from environment variables for sensitive data?What does a distroless image remove compared to a minimal distro like Alpine?Why is image scanning (e.g., Trivy, Grype) part of a secure CI/CD pipeline?What does `--cap-drop=ALL` followed by selectively adding capabilities back accomplish?Why are container logs ephemeral by default, and what's the production implication?What's the purpose of log rotation settings like `max-size` and `max-file`?How does Prometheus's pull-based model differ from a push-based metrics system?What role does Grafana play relative to Prometheus?What does cAdvisor provide that application-level metrics don't?Why is the difference between liveness and readiness probes commonly tested in interviews?What is the security risk of mounting the Docker socket (`/var/run/docker.sock`) into a container?How would you detect if a base image has known critical CVEs before deploying?Why is `docker stats` insufficient as a production monitoring solution?Why are Spring Boot layered jars beneficial for Docker builds?What is Cloud Native Buildpacks, and how does it relate to `spring-boot:build-image`?Why might Kafka work fine from the host but fail for external clients connecting to a Dockerized broker?What's the difference between liveness and readiness probes for a Spring Boot app using Actuator?Why use Testcontainers in a Dockerized Spring Boot project's test suite?What's the trade-off between Docker-in-Docker (DinD) and socket-mounting in CI pipelines?Why are daemonless builders like Kaniko or Buildah attractive for CI specifically?What does immutable tagging by git SHA buy you in a CI/CD pipeline?Why would a pipeline run a security scan as a blocking gate rather than just an informational step?What replaced dockershim as Kubernetes's interface to container runtimes?What is the difference between a Pod and a Deployment in Kubernetes?Why does Kubernetes still use container images built by Docker even without using the Docker daemon at runtime?What's a common mistake teams make when first containerizing a Spring Boot microservices architecture?How should environment-specific configuration (dev/staging/prod) be handled for a single containerized Spring Boot image?Why is rebuilding the entire fat jar layer on every code change, even with multi-stage builds, still a cache-efficiency problem?What are the three biggest levers for improving Docker build performance?What risk does switching to an Alpine base image introduce?What does a BuildKit cache mount do differently from normal layer caching?Why is `restart: on-failure` not equivalent to high availability?What's the minimum replica count typically recommended for a production service with an SLA?What is RTO, and how does it differ from RPO?Why is an untested backup considered unreliable?What's the difference between a rolling deployment and a blue-green deployment?Why should alerts be based on SLO metrics (error rate, latency) rather than only infrastructure metrics (CPU, memory)?What is a 'game day' / chaos engineering exercise, and what does it validate that monitoring doesn't?Why might a company choose active-passive disaster recovery over active-active across regions?What's the danger of co-locating backups with the primary data they protect?Why is centralized logging considered essential rather than optional in production?What's the relationship between error budgets and deployment velocity?Why does instruction ordering still matter inside a multi-stage build's builder stage?What's the difference between vertical and horizontal scaling for a containerized service?Why is it risky to set no memory limit on a production container?What's the difference between `docker run --memory` and a Kubernetes Pod's resource `limits`/`requests`?How should a production incident's postmortem differ from simply fixing the immediate bug?What is the single most important habit for staying current as Docker/container tooling evolves (e.g., BuildKit, Compose V2, dockershim removal)?A container that worked fine locally fails immediately in production with 'exec format error'.A service's memory usage climbs steadily until the container is OOM-killed, roughly every 6 hours, regardless of traffic level.After enabling Compose health checks with `depends_on: condition: service_healthy`, the dependent service still occasionally fails to connect to the database on startup.A container can `ping` another container by IP but DNS resolution by container name fails.A multi-stage Docker build's final image is still much larger than expected despite using multi-stage builds correctly.A team's CI pipeline builds an image successfully, but the exact same Dockerfile fails to build on a developer's laptop with a 'no space left on device' error.After a rolling update in Kubernetes, a small percentage of requests return errors for about 30 seconds during every deployment, even though readiness probes are configured.A containerized application logs heavily to stdout, and after a few weeks the production host runs out of disk space even though no large files were intentionally written.A `docker build` that used to take 30 seconds now takes 8 minutes after a teammate's recent Dockerfile change, with no obvious new heavy dependency added.A service works correctly when run with `docker run` directly but behaves differently (wrong config, missing env vars) when started via `docker compose up`.A container running as a non-root user fails to write to a mounted volume with a permission denied error.After switching a Dockerfile's base image from a Debian-based one to Alpine, build succeeds but the application throws a runtime error about a missing shared library.A production incident review reveals that a critical service had only one running replica for two weeks because a scaling configuration change silently failed to apply.A Spring Boot service's `/actuator/health` endpoint reports UP, but the service is actually unable to process real requests due to an exhausted database connection pool.A container's `HEALTHCHECK` is defined and passes, but the orchestrator still doesn't restart a clearly hung process inside the container.A team notices that database backups are completing successfully every night, but a recent restore drill revealed the backups are unusable due to a schema-version mismatch with the current restore tooling.A containerized batch job that processes files via a bind-mounted host directory works on one engineer's machine but not on a teammate's, with no permission errors, just silently empty output.A container respects SIGTERM correctly in local testing but production deployments still show a hard 10-second delay (full SIGKILL timeout) on every restart.After moving from a single-region to a multi-region active-active deployment, the team starts seeing intermittent data inconsistencies between regions for a service that wasn't redesigned for this change.A container build using `--mount=type=secret` for a private package registry token still seems to leak the token into the final image when inspected with `docker history`.A service exhibits high latency only for the first request after being idle for a while, then performs normally.A `docker compose up --scale api=3` command succeeds but only one of the three replicas ever receives traffic.After enabling a Kubernetes Horizontal Pod Autoscaler based on CPU usage, replica count fluctuates rapidly up and down ('flapping') under moderately variable load.A production container is found running with `--privileged` mode enabled, and nobody on the current team remembers why.A team's centralized logging pipeline shows a sudden, large gap with no logs at all from a specific service for several hours, even though the service was confirmed to be running and serving traffic during that window.A containerized service intermittently fails health checks under load, but logs show no errors and the application appears to be processing requests normally.After a planned database failover (promoting a standby to primary), several application instances continue trying to write to the old primary for several minutes.A container build pipeline that scans images with Trivy starts failing on a base image that previously passed, with no changes made to the Dockerfile.A team observes that disk usage on their CI runners grows continuously across builds despite each individual build cleaning up its own containers.A microservice that depends on three other services via DNS-based service discovery starts a deployment that briefly renames one of those dependent services, breaking startup for several minutes during the transition.Design a containerized CI/CD pipeline for a microservices platform with 20+ services, balancing build speed, security, and cost.Design the container orchestration and scaling strategy for an e-commerce platform that sees 50x traffic spikes during flash sales.Design a multi-region, highly available deployment for a service requiring 99.99% uptime.Design a secure container build and deployment pipeline for a regulated industry (e.g., fintech or healthcare) with strict compliance requirements.Design a logging and observability architecture for a platform with 200+ containerized microservices.Design the storage architecture for a containerized stateful service (e.g., a database cluster) running on Kubernetes.Design a disaster recovery strategy for a critical financial transaction-processing system with a near-zero RPO requirement.Design a containerized API gateway layer for a platform with both public-facing and internal-only microservices.Design a cost-optimization strategy for a company running containerized workloads that has seen cloud costs grow 3x faster than usage over the past year.Design a zero-downtime database migration strategy for a containerized service that cannot tolerate a maintenance window.Design the container security posture for a platform that runs untrusted, user-submitted code (e.g., an online coding judge or sandboxed execution platform).Design a blue-green deployment system for a platform where some services share a single relational database with others.Design a multi-tenant SaaS platform's container architecture, addressing tenant isolation and noisy-neighbor risk.Design an incident response and on-call system for a platform with 24/7 uptime requirements run by a team across a single time zone.Design the rollback strategy for a platform deploying 50+ times per day across many independent but interdependent services.Why is tagging an image :latest a real risk for anything deployed to production?What's the difference between pulling an image by tag versus by digest?Why does pushing a small code change to an image that shares a base with a previous version upload quickly?Why does putting an API Gateway in front of internal microservices matter for security, not just routing?What's the core trade-off event-driven architecture makes compared to direct service-to-service calls?Why is a Canary deployment considered safer than a full rollout, specifically?
2