Q: What's the difference between an image and a container? "An image is a static, read-only template — a layered filesystem with metadata about how to run it. A container is a running instance of an image, with a writable layer on top and an isolated process namespace. You can run many containers from the same image."
Q: How do you reduce Docker image size? "Multi-stage builds are the biggest win — build in one stage with all the compilation tooling, then copy just the artifacts into a minimal runtime stage like distroless or alpine. Use a .dockerignore to keep build context small. Combine RUN steps to reduce layers. Use specific slim base images. Remove package manager caches in the same RUN that installs them, so they don't persist as a layer."
Q: How do you secure a container? "At build time: use minimal base images, scan with Trivy or Snyk in CI, pin specific image versions, never embed secrets, run as non-root. At runtime: drop Linux capabilities, set read-only filesystem where possible, set resource limits, use seccomp profiles, isolate networks. At orchestration: enforce pod security standards in Kubernetes, use network policies, mount secrets from a secret manager rather than env vars."