Interview › Kubernetes, Docker, Helm & Podman
What is a container registry, and how does image tagging and digests work?
Kubernetes, Docker, Helm & Podman · Advanced level
Answer
A registry stores and distributes container images. Tags are mutable pointers to image manifests, while digests are immutable content identifiers; production deployments should prefer versioned tags and, for strict reproducibility, digest pinning.
Technical explanation
Tags such as prod or latest can move; digests such as sha256:... identify exact content.
Registries often support vulnerability scanning, signing, retention policies, and immutability controls.
Container image quality affects supply chain, startup time, vulnerability surface, rollout reliability, and debugging workflows.
Prefer reproducible builds: pinned dependencies, small build context, deterministic Dockerfile order, non-root runtime, and immutable image references.
Understand the runtime boundary: an image is not a VM, and container isolation depends on kernel, namespaces, cgroups, capabilities, seccomp, and mounts.
Hands-on example
1. Create a tiny sample app and Dockerfile for this exercise: push an image to a registry and deploy by tag versus digest.
2. Build and inspect it with docker build or podman build, docker history, image inspect, and a vulnerability or size scan if available.
3. Run it locally with explicit env vars, ports, user, volumes, and signal tests depending on the question.
4. Convert the final runtime assumptions into Kubernetes fields such as image, command, args, ports, securityContext, probes, and volumeMounts.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Kubernetes, Docker, Helm & Podman interview questions
- What is Kubernetes, and what problem does it solve over running containers manually?
- Explain the Kubernetes control plane components (API server, etcd, scheduler, controller manager).
- What runs on a worker node (kubelet, kube-proxy, container runtime)?
- What is a Pod, and why does Kubernetes schedule Pods rather than containers?
- What is the difference between a Pod, a ReplicaSet, and a Deployment?
- How does a Deployment perform a rolling update, and how do maxSurge and maxUnavailable work?
- How do you roll back a Deployment, and how does Kubernetes track revisions?
- What is a Service, and what are the types (ClusterIP, NodePort, LoadBalancer, ExternalName)?