Interview prep · ~12 min read

Azure and containers for an IT interview: a one-week plan

A reader got an interview for an Azure internship after I told them to "study containers." Fair follow-up: they asked what to actually study. "Study containers" is not a plan, so this is the one I'd hand someone on my desk.

What an entry-level interviewer is checking

Nobody expects an intern to run a Kubernetes cluster. They are checking three things. Can you explain the basics in plain words? Have you actually touched it, or only read about it? Do you know where your knowledge ends? One short story of "I built this, it broke, here is how I found out why" beats ten memorized definitions.

The week

Day 1: cloud vocabulary (about 90 minutes). Learn what infrastructure, platform, and software as a service mean, what a region is, what a subscription and a resource group are, and the shared responsibility model (the provider secures the datacenter, you secure what you put in it). Microsoft Learn has a free Azure Fundamentals path for this. The AZ-900 exam covers three areas: cloud concepts, Azure architecture and services, and management and governance. You do not need to sit the exam for the interview, but its study guide is a good checklist of what counts as "the basics."

Day 2: the core Azure services. Compute (virtual machines, App Service), storage, virtual networks, and identity. Identity is Microsoft Entra ID (it used to be called Azure Active Directory) plus Azure role-based access control. If you hold Security+, spend extra time here. A role assignment is three things: who, what role, and at what scope. Be ready to say that without notes.

Day 3: containers, on your own laptop. Do Lab A below. Reading about containers for a week is worse than building one for an hour.

Day 4: Azure's container options. There are several, and "which one would you pick" is a very common question. The table below is the short version.

Day 5: run it in Azure (optional). Lab B, on a free account. Skip it if you have no account or no time; Lab A plus the table already covers most of what an intern is asked.

Day 6: security and cost. Where secrets live (a key vault, not your code), why a managed identity beats a password in a config file, why least privilege matters, and why you delete lab resources when you are done.

Day 7: say it out loud. Work through the questions at the bottom of this page with a friend, or alone in the car. Answers you have never spoken come out worse than answers you know.

Four words you must keep straight

And the question that comes up every time: a virtual machine includes its own guest operating system and runs on a hypervisor. A container shares the host's operating system kernel, so it is smaller and starts faster. The tradeoff is weaker isolation, because containers share that kernel.

Lab A: build and run a container (about 30 minutes, free)

You need Docker installed (Docker Desktop on Windows or Mac, Docker Engine on Linux). Make an empty folder with two files.

app.py

from http.server import BaseHTTPRequestHandler, HTTPServer

class Hello(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Type", "text/plain")
        self.end_headers()
        self.wfile.write(b"hello from a container\n")

HTTPServer(("0.0.0.0", 8000), Hello).serve_forever()

Dockerfile

FROM python:3.12-slim
WORKDIR /app
COPY app.py .
EXPOSE 8000
CMD ["python", "app.py"]

Build the image, then run it. The first number in -p is the port on your machine, the second is the port inside the container.

docker build -t hello-app:v1 .
docker run -d --name hello -p 18080:8000 hello-app:v1
curl localhost:18080

You should see hello from a container. On Windows PowerShell, curl is an alias for something else, so use curl.exe localhost:18080 or just open that address in a browser.

Now poke at it the way a tech would:

docker ps                      # what is running
docker logs hello              # what it printed (one line per request)
docker exec hello python --version   # run a command inside the container
docker stop hello
docker rm hello
docker rmi hello-app:v1        # delete the image too

Use docker ps -a to see stopped containers as well. When a container will not start, the first two commands are docker ps -a (did it exit, and with what code) and docker logs (what did it say before it died). Say that in the interview and you sound like someone who has done it.

Azure's container options

The honest one-sentence answer to "ACA or AKS?" is: Container Apps, unless you specifically need the Kubernetes API itself. That lines up with Microsoft's own comparison page, which points you to AKS if you need the Kubernetes APIs and notes that many teams start with Container Apps.

Lab B: run it in Azure (optional, check the cost first)

You need an Azure account (check Microsoft's current free account offer) and the Azure CLI. Heads up: a container registry has a daily charge and other resources can bill while they sit idle. Do this in one resource group so cleanup is a single command. Names must be lowercase, and the registry name must be unique across all of Azure (5 to 50 letters and numbers).

az login
az extension add --name containerapp --upgrade
az provider register --namespace Microsoft.App
az provider register --namespace Microsoft.OperationalInsights

az group create --name rg-interview-lab --location eastus

Build your Lab A image inside Azure, no local Docker needed. Run this from the folder with your Dockerfile:

az acr create --resource-group rg-interview-lab --name YOURUNIQUENAME --sku Basic
az acr build --image hello-app:v1 --registry YOURUNIQUENAME --file Dockerfile .

Then deploy Microsoft's public sample image to Container Apps, which creates the environment and a log workspace for you:

az containerapp up \
  --name my-container-app \
  --resource-group rg-interview-lab \
  --location eastus \
  --environment interview-lab-env \
  --image mcr.microsoft.com/k8se/quickstart:latest \
  --target-port 80 \
  --ingress external \
  --query properties.configuration.ingress.fqdn

It prints an address; open it in a browser. When you are done, delete everything:

az group delete --name rg-interview-lab

Deploying your own image from your registry into Container Apps is the natural next step. It needs the app to be allowed to pull from the registry, which is its own small lesson in managed identities. Microsoft has a tutorial for it; I have not run that one, so I am not going to hand you commands I cannot vouch for. Knowing that this is the next step, and why, is a good thing to say when they ask what you would learn next.

Questions to practice out loud

1. What is the difference between an image and a container? An image is the read-only template, a container is a running instance of it.
2. Container versus virtual machine? A VM carries its own operating system on a hypervisor. A container shares the host's kernel, so it is lighter and faster to start, with weaker isolation.
3. What does a Dockerfile do? It is the instruction list that builds an image: the base image, what to copy in, what to run.
4. What is a registry? Where images are stored and pulled from. Docker Hub, or Azure Container Registry inside Azure.
5. A container will not start. What do you check? Whether it exited and with what code, then its logs. In Azure, the app's logs in its log workspace.
6. Container Apps or AKS? Container Apps unless you need the Kubernetes API or full cluster control.
7. What is a resource group? A logical container for related Azure resources. Deleting it deletes what is inside, which is why labs go in their own.
8. How are subscriptions and resource groups organized? Management groups hold subscriptions, subscriptions hold resource groups, resource groups hold resources.
9. What is Entra ID, and how is it different from RBAC? Entra ID is the identity service (who you are). Azure RBAC decides what an identity may do to Azure resources, through role assignments at a scope.
10. What is a managed identity? An identity Azure gives a resource so it can authenticate to other Azure services without a stored password or key.
11. Where do secrets go? In a key vault, read at run time. Never in the code or the image.
12. What is the shared responsibility model? The provider secures the underlying cloud. You secure your data, access, and configuration, and how much that covers depends on the service type.
13. Tell me about something you built that broke. Use the port conflict from Lab A if you have nothing better. Say what you saw, what you checked, and what fixed it.

If you only have two hours

Read the Day 1 and Day 2 vocabulary, do Lab A, memorize the options table, and practice questions 1, 2, 6, 9, and 13. That is a real answer set for an entry-level round.

Free resources

• Microsoft Azure Fundamentals (AZ-900) on Microsoft Learn, with the free learning path and study guide
• Docker's official Get Started guide
• Comparing Container Apps with other Azure container options
• Quickstart: deploy your first container app
• Quickstart: build a container image on demand in Azure
• John Savill's free AZ-900 videos on YouTube, which explain the same ground in plain English

Last thing

Do the labs. Then, in the interview, say what you built, what broke, and what you would learn next. That is the whole trick. If you want help with the non-technical half, the stories and the "tell me about a time" questions, that is what the Resume + Interview Pack is for. If the interview goes well, or badly, email me at [email protected] and tell me how it went.

Dave Troyer