How should you tag and promote images across environments? What is wrong with using :latest?
What they are really testing: Whether you understand mutable tags vs immutable digests and that you should promote the same artifact rather than rebuild per environment. A real source of "works in staging, broken in prod".
A real interview question
How should you tag and promote images across environments? What is wrong with using :latest?
What most people say
drag me
“You tag images with version numbers, and :latest just points to the newest one.”
It describes :latest but not the danger: it is mutable and not reproducible, so two pulls can differ. It also misses promoting one immutable artifact across environments, which is the core practice.
The follow-ups they ask next
Why can deploying :latest give two servers different images?
It is a mutable pointer: if it is repointed between pulls, two servers pulling :latest at different times get different images. Pin by digest (or an immutable tag) so every node runs identical bytes.
Why promote the same image instead of rebuilding for prod?
A rebuild can pull newer base layers or dependencies, so the prod image differs from the one you tested. Promoting the same artifact (same digest) means prod runs exactly what passed staging.
What the interviewer is listening for
- Mutable tags vs immutable digests
- Build-once, promote-same-artifact
- Pins prod by digest/immutable tag; mentions signing
What sinks the answer
- Thinks :latest is safe/reproducible
- Rebuilds per environment
- No notion of digests
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Tags like :latest are [mutable pointers, two pulls can differ, not reproducible]; a [digest (sha256) is immutable and identifies exact content]. So I [build once and promote the same artifact through dev/staging/prod, pinned by digest], use [immutable tags like a git SHA for traceability], keep [:latest as a convenience only], and [sign images for provenance].”
Keep going with docker
Foundation
What is a container, and how is it different from a virtual machine?
Foundation
What is the difference between a Docker image and a container?
Foundation
What is a Dockerfile, and what do the main instructions do?
Junior
How does the Docker build cache work, and how do you order a Dockerfile to use it well?
Junior
What is the difference between CMD and ENTRYPOINT, and what is the exec versus shell form?
Junior
How does container networking work in Docker, and how do containers talk to each other?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free