Cloud and Container Basics
A container image built by a CI/CD pipeline was tested in the staging environment and passed. Which of the following is the most appropriate way to release this image to production?
- ABuild the image again from the same source code for production and release that to production
- BRetag the tested image as latest, and pull latest in the production environment
- CRelease the tested image itself to production by specifying its digest, and supply the differences between environments through configuration
Show answer and explanation
Answer: C. Release the tested image itself to production by specifying its digest, and supply the differences between environments through configuration
In a pipeline, the artifact produced by the build (here, the image) is treated as unchangeable, and the same artifact is promoted from staging to production. Even from the same source code, a rebuild may pick up different versions of the libraries or base image it depends on, so something different from what was tested would reach production. A tag can later be moved to another image, so to be sure of pointing to the same image, use the digest, which is determined by the contents. Differences between environments, such as connection targets, are not built into the image but supplied through configuration such as environment variables.
- A. A rebuild may change dependent libraries and produce an image different from the one tested.
- B. latest is a tag that can be moved, so at pull time it may point to a different image.
- C. Correct. The digest guarantees that the same image that was tested goes to production.