Q: What happens if your CI pipeline repeatedly builds the exact same Dockerfile using the `latest` tag and pushes it to an AWS ECR registry every day for a year?
Using the latest tag makes it a mutable tag.
#Docker #Docker #L1 #Containers #Linux #Git
🎙️ Candidate Opening & Architectural Context
""When containerizing our microservices stack, container lifecycle and resource management were critical. The interviewer is testing: Tag mutability, dangling references, registry bloat.. I structure my answer around systematic triage first, root cause analysis second, and permanent remediation third.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Production Solution & Architecture
Using the latest tag makes it a mutable tag. Every time the CI pipeline pushes, AWS ECR will overwrite the latest tag to point to the brand new image manifest. The older images from previous days will lose their tag and become Untagged (Dangling) images in the registry. If no Lifecycle Policy is configured to garbage-collect untagged images, you will accumulate 365 orphaned 1GB images, paying AWS for useless storage bloat. (Also, deploying latest in Kubernetes is dangerous as it breaks rollback determinism). Always use Git SHAs or Semantic Versioning tags.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Using the latest tag makes it a mutable tag.."
⚡ 60-Second Elevator Pitch Talking Points
- Immediate Triage: Using the latest tag makes it a mutable tag.
- Run targeted verification commands before modifying configuration.
- Automate permanent guardrails (CI check, alerts, IaC policy) to prevent recurrence.
Advertisement