Walk me through what happens when you run docker run -p 8080:80 nginx:1.27 on a fresh machine.
What the interviewer wants to hear
- Image is pulled layer by layer from the registry if not cached
- Container gets a writable layer on top of read-only image layers
- Namespaces and cgroups isolate the process
- Port mapping forwards host 8080 to container port 80
- The main process runs as PID 1 and the container lives as long as it does
Model answer
The Docker CLI sends the request to the daemon, which checks whether nginx:1.27 is in the local cache. If not, it resolves the tag to a manifest in the registry and pulls each layer, skipping any it already has. The daemon, through containerd and runc, then creates a container: a thin writable layer on top of the read-only image layers, Linux namespaces for process, network, mount and hostname isolation, and cgroups for CPU and memory limits. It sets up a virtual network interface on the default bridge and adds NAT rules so traffic to host port 8080 reaches container port 80. Finally it starts the image entrypoint, here the nginx master process, as PID 1 inside the container. The container keeps running only while that process runs; when it exits, the container stops, and its writable layer is lost when removed.
Can you answer it under time pressure?
Take a timed easy round and get scored on every answer.
More easy DevOps Engineer questions
- What does DevOps mean to you, and how is it different from a traditional operations team?
- Walk me through the stages of a typical CI/CD pipeline you would build for a web service.
- How is a container different from a virtual machine? When would you choose one over the other?
- What is Infrastructure as Code and why is it better than creating resources by clicking in the cloud console?
- Explain how a Deployment, a Service and an Ingress work together to expose a web app in Kubernetes.
- Compare trunk-based development with GitFlow. Which would you choose for a team that deploys several times a day, and why?
- What is the difference between monitoring and observability, and what are the main signals you would collect for a web service?
- How does a load balancer use health checks, and what makes a good health check endpoint?
- Terraform and Ansible are both called infrastructure as code. How do they differ, and when would you use each?