Interview › Kubernetes, Docker, Helm & Podman
What is the difference between CMD and ENTRYPOINT in a Dockerfile?
Kubernetes, Docker, Helm & Podman · Intermediate level
Answer
ENTRYPOINT defines the main executable for the container, while CMD provides default arguments or a default command. In production images, I often use exec-form ENTRYPOINT plus CMD for overridable defaults.
Technical explanation
Shell form performs shell expansion but handles signals poorly; exec form is usually better for production.
CMD can be overridden easily at docker run time or through Kubernetes command/args.
Container image quality affects supply chain, startup time, vulnerability surface, rollout reliability, and debugging workflows.
Prefer reproducible builds: pinned dependencies, small build context, deterministic Dockerfile order, non-root runtime, and immutable image references.
Understand the runtime boundary: an image is not a VM, and container isolation depends on kernel, namespaces, cgroups, capabilities, seccomp, and mounts.
Hands-on example
1. Create a tiny sample app and Dockerfile for this exercise: test CMD and ENTRYPOINT override behavior with docker run arguments.
2. Build and inspect it with docker build or podman build, docker history, image inspect, and a vulnerability or size scan if available.
3. Run it locally with explicit env vars, ports, user, volumes, and signal tests depending on the question.
4. Convert the final runtime assumptions into Kubernetes fields such as image, command, args, ports, securityContext, probes, and volumeMounts.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Kubernetes, Docker, Helm & Podman interview questions
- What is Kubernetes, and what problem does it solve over running containers manually?
- Explain the Kubernetes control plane components (API server, etcd, scheduler, controller manager).
- What runs on a worker node (kubelet, kube-proxy, container runtime)?
- What is a Pod, and why does Kubernetes schedule Pods rather than containers?
- What is the difference between a Pod, a ReplicaSet, and a Deployment?
- How does a Deployment perform a rolling update, and how do maxSurge and maxUnavailable work?
- How do you roll back a Deployment, and how does Kubernetes track revisions?
- What is a Service, and what are the types (ClusterIP, NodePort, LoadBalancer, ExternalName)?