DevOps Engineer Interview Questions India 2026: CI/CD, Docker, Kubernetes, and AWS

DevOps interviews in India test 5 core areas:

1. CI/CD pipelines: what CI/CD means, common tools (GitHub Actions, Jenkins, GitLab CI, CircleCI), pipeline stages (checkout, build, test, security scan, Docker build, push to registry, deploy to staging, integration tests, deploy to production)

1. Docker and containers: image vs container, Dockerfile, docker-compose, multi-stage builds for image optimisation

1. Kubernetes: Pod, Deployment, Service, Ingress, ConfigMap, Secret, Namespace, HPA, resource limits

1. AWS: EC2, S3, RDS, EKS, Lambda, IAM (roles and policies), VPC (subnets, security groups, NACLs), CloudWatch (metrics, logs, alarms)

1. Infrastructure as Code: Terraform (providers, resources, state file, plan and apply), Ansible (idempotent configuration management with playbooks and roles)

Most common Docker interview questions:

1. 'What is the difference between a Docker image and a Docker container?' Image: a read-only snapshot (layered filesystem) built from a Dockerfile. Container: a running instance of an image, with a writable layer on top. Stopping a container does not delete its writable layer; use 'docker rm' to delete the container.

2. 'What is a multi-stage Docker build and why do you use it?' Multi-stage: use a build stage with a full build environment (e.g. a Go image with SDK) to compile the binary, then copy only the binary into a minimal runtime image (e.g. alpine or distroless). Result: production image has no build tools, dramatically smaller size, fewer security vulnerabilities.

3. 'What is the difference between CMD and ENTRYPOINT in a Dockerfile?' ENTRYPOINT: the fixed command that always runs when the container starts. CMD: default arguments passed to ENTRYPOINT, or the default command if ENTRYPOINT is not set. Together: ENTRYPOINT ['/usr/local/bin/myapp'] and CMD ['--config', '/etc/myapp/config.yaml'] means 'docker run myimage' runs 'myapp --config /etc/myapp/config.yaml'; 'docker run myimage --config /other.yaml' overrides CMD.

4. 'How do you reduce Docker image size?' Strategies: use a slim or alpine base image, multi-stage builds (compile in full image, copy binary to minimal runtime image), combine RUN commands into one layer (reduces layer count), remove build dependencies and package manager caches in the same RUN command (apt-get clean, rm -rf /var/lib/apt/lists/*), use .dockerignore to exclude node_modules and other large dirs from the build context.

Most common Kubernetes interview questions:

1. 'What is the difference between a Deployment and a StatefulSet?' Deployment: for stateless apps; pods are interchangeable; rolling updates replace pods in place; pod names have random suffixes. StatefulSet: for stateful apps like databases; pods have stable network identities (pod-0, pod-1) and stable persistent storage; pods are created and deleted in order.

2. 'What happens when a Pod is OOMKilled?' The Linux OOM killer terminates the process when the container exceeds its memory limit; the container restarts (if RestartPolicy is Always); the Pod stays on the same node; if this keeps happening, the Deployment/HPA needs adjusting (increase the memory limit or optimise memory usage).

3. 'What is the difference between a Service and an Ingress?' Service: exposes a set of pods on a stable network endpoint inside the cluster (ClusterIP: cluster-internal only; NodePort: exposed on each node's IP at a static port; LoadBalancer: provisions a cloud load balancer). Ingress: an HTTP/HTTPS routing rule that directs external requests to Services based on host and path rules; requires an Ingress Controller (nginx-ingress, Traefik, AWS ALB Controller) running in the cluster.

4. 'What is a ConfigMap vs a Secret?' ConfigMap: stores non-sensitive configuration (environment-specific config files, feature flags). Secret: stores sensitive data (passwords, API keys, TLS certificates); base64-encoded (not encrypted by default; use Sealed Secrets or External Secrets Operator for git-safe encrypted storage). Both can be injected into pods as environment variables or file mounts.

CI/CD questions:

1. 'How do you handle secrets in a CI/CD pipeline?' Never hardcode secrets in the pipeline YAML or the repo. Use: CI/CD platform secrets (GitHub Actions encrypted secrets, GitLab CI variables with 'masked' flag), external secrets manager (AWS Secrets Manager, HashiCorp Vault) injected at runtime, or Kubernetes Secrets with Sealed Secrets for git-safe storage.

2. 'What is a blue-green deployment?' Two identical production environments; blue is live, green is the new version. After testing green, switch traffic from blue to green. Instant rollback by switching back to blue. Requires double the infrastructure.

3. 'What is a canary deployment?' Gradually shift a small percentage of traffic to the new version (e.g. 5% then 25% then 100%). Monitor metrics. Increase percentage if healthy. Roll back if errors spike. Requires a traffic splitting mechanism (Nginx, Istio, or cloud load balancer weighted routing).

AWS questions:

1. 'What is IAM and what is the principle of least privilege?' IAM: Identity and Access Management; controls who can do what to which AWS resources. Principle of least privilege: grant only the minimum permissions needed to do the job. Avoid the root account for daily operations. Use roles for EC2/Lambda instead of static access keys.

2. 'What is a VPC and why do you use it?' VPC (Virtual Private Cloud): a logically isolated network in AWS. You define subnets (public: internet-accessible; private: no direct internet access), security groups (stateful firewall at the resource level), NACLs (stateless firewall at the subnet level), route tables, and Internet Gateway. Use VPCs to control network access, isolate production from development environments, and meet compliance requirements.

DevOps career path and salary:

Junior DevOps Engineer (0-2 years): 6-12 LPA Skills: Linux basics, Docker, basic CI/CD (GitHub Actions or Jenkins), AWS basics (EC2, S3, IAM), scripting (Bash or Python)

Mid-level DevOps / Platform Engineer (2-5 years): 12-25 LPA Skills: Kubernetes (EKS or GKE), Terraform, advanced AWS (VPC, EKS, Lambda, RDS, CloudWatch), security scanning in pipelines, on-call incident response

Senior DevOps / Platform / SRE Engineer (5-8 years): 25-45 LPA Skills: multi-cloud or hybrid cloud architecture, service mesh (Istio), advanced observability (OpenTelemetry, Prometheus, Grafana, Loki), SRE practices (SLOs, error budgets, chaos engineering)

Staff/Principal DevOps (8+ years): 45+ LPA at top product companies

Companies hiring DevOps engineers in India: Flipkart, Amazon India (AWS team), Microsoft (Azure), Google (GCP), Swiggy, Razorpay, Juspay, Meesho, CRED, PhonePe, and most funded startups at Series B+.