Docker Basics MCQ

Docker is an open platform for developing, shipping, and running applications. It enables you to separate your applications from your infrastructure using containers, so you can deliver software quickly.

A Docker image is a read-only template used to create containers. A container is a running (or stopped) instance of an image. Multiple containers can be created from the same image.

The FROM instruction initialises a new build stage and sets the base image. Every valid Dockerfile must start with a FROM instruction (except for ARG instructions that precede it).

'docker build' reads the Dockerfile and builds an image. Example: 'docker build -t my-app:1.0 .' builds an image tagged 'my-app:1.0' using the Dockerfile in the current directory.

EXPOSE is a documentation instruction — it informs Docker that the container listens on the specified port at runtime but does NOT actually publish the port. To publish a port you use -p with 'docker run'.

'docker ps' lists all currently running containers. To see all containers (including stopped ones), use 'docker ps -a'.

A .dockerignore file works like .gitignore — it excludes files and directories from the build context. This reduces the context size, speeds up builds, and prevents sensitive files (like .env or node_modules) from being copied into the image.

COPY copies local files/directories into the image. ADD does everything COPY does plus it can fetch files from URLs and automatically extract compressed archives (tar, gzip). Best practice is to use COPY unless you specifically need ADD's extra features.

ENTRYPOINT defines the command that always runs when the container starts. CMD provides default arguments to ENTRYPOINT (or the default command if no ENTRYPOINT is set). CMD arguments can be overridden by passing arguments to 'docker run', while ENTRYPOINT cannot easily be overridden without --entrypoint.

'docker exec' runs a new command in a running container. For example, 'docker exec -it mycontainer bash' opens an interactive bash shell inside the container.

The -d (or --detach) flag runs the container in the background and prints the container ID. Without -d, the container runs in the foreground and you see its output directly in the terminal.

Docker volumes provide persistent storage that survives container restarts and removal. Volumes are managed by Docker, stored in a part of the host filesystem (/var/lib/docker/volumes/), and are the preferred way to persist data.

Named volumes are created and managed by Docker in /var/lib/docker/volumes/. Bind mounts map any host directory or file directly into the container. Named volumes are recommended for production as they are portable and easier to back up.

The bridge network driver is the default for user-defined networks on a single host. Containers on the same bridge network can communicate with each other. The 'host' driver shares the host's network stack, and 'overlay' connects containers across multiple Docker hosts.

'docker stop' sends SIGTERM to the main process, giving it time to shut down gracefully (default 10-second timeout), then sends SIGKILL. 'docker kill' sends SIGKILL (or a specified signal) immediately without waiting for graceful shutdown.

'docker system prune' reclaims disk space by removing all stopped containers, networks not used by any container, dangling images (untagged), and the build cache. Add -a to also remove all unused images (not just dangling ones).

Multi-stage builds use multiple FROM instructions in one Dockerfile. Each stage can copy artifacts from previous stages. This lets you use a large build environment (e.g., with compilers and build tools) and copy only the final binary into a small runtime image, dramatically reducing image size.

Docker Compose uses a docker-compose.yml (or compose.yaml) file to define services, networks, and volumes for a multi-container application. 'docker compose up' starts all services defined in the file.

'docker compose up -d' builds (if needed), creates, starts, and attaches to all containers defined in the compose file. The -d flag runs everything in detached/background mode.

RUN executes commands during the image build process. Each RUN instruction creates a new layer. For example, 'RUN apt-get update && apt-get install -y curl' installs curl into the image. CMD and ENTRYPOINT define runtime commands, not build-time commands.

The -p flag maps host:container ports. 'docker run -p 8080:80 nginx' maps host port 8080 to container port 80. So requests to localhost:8080 on the host are forwarded to port 80 inside the container.

'docker images' (or 'docker image ls') lists all Docker images stored locally on the host, showing repository, tag, image ID, creation date, and size.

Dangling images are layers that have no relationship to any tagged image — they appear as '<none>:<none>' in 'docker images'. They accumulate when you rebuild images and the old layers become orphaned. Remove them with 'docker image prune'.

ENV sets environment variables that persist in the image and are available when the container runs. ARG is similar but only available during the build process (not in the running container). Use ENV for runtime config, ARG for build-time parameters.

WORKDIR sets the working directory inside the container for RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it. If the directory doesn't exist, it's created automatically. It's equivalent to 'cd' + 'mkdir -p'.

'docker logs webserver' displays the stdout/stderr output of the container. Use -f to follow live logs, --tail N to see the last N lines, and --since to filter by time (e.g., --since 1h for the last hour).

--restart unless-stopped restarts the container on failure or after Docker restarts, but NOT if it was manually stopped with 'docker stop'. Use --restart always to restart even if it was manually stopped. 'on-failure' restarts only on non-zero exit codes.

'docker inspect' returns a detailed JSON object with low-level information about a container or image — including its configuration, networking settings, mount points, environment variables, and state. Use --format to extract specific fields.

A Docker registry is a storage and distribution system for Docker images. Docker Hub is the default public registry. You can also run a private registry using the official 'registry' image. 'docker push' uploads images to a registry; 'docker pull' downloads them.

The USER instruction sets the user name (or UID) and optionally the group to use when running the image and for any subsequent RUN, CMD, and ENTRYPOINT instructions. Running containers as non-root is a security best practice.

HEALTHCHECK tells Docker how to test whether the container is still working. The CMD form runs the command inside the container. If the command returns a non-zero exit code, the container is marked as unhealthy. Options include --interval, --timeout, --start-period, and --retries.