Docker interview question · Most asked
How should you tag Docker images, and why is 'latest' a problem?
Summary
Tag images with immutable, traceable identifiers such as the Git commit SHA (and optionally a semantic version), and deploy by those tags or by digest. latest is just a default tag name, not 'the newest version': it moves, so different hosts can run different code under the same tag, rollbacks are unclear, and caches may serve stale images.
Longer Answer
Good practice: org/app:1.4.2 plus org/app:git-3f9c2ab; enable tag immutability in the registry (ECR, Artifact Registry) so a tag can never be overwritten; deploy by digest (@sha256:...) for full reproducibility; and use latest (if at all) only for local convenience. Record which tag runs in each environment for audits and rollbacks.
Key Points
- Immutable tags: commit SHA, semver.
- 'latest' moves and is ambiguous.
- Registry tag immutability.
- Deploy by digest for reproducibility.
More most-asked Docker questions
- What is the difference between an image and a container, and how do image layers work?
- What is a container, and how does it differ from a virtual machine?
- What are multi-stage builds, and why use them?
- CMD or ENTRYPOINT: what is the difference, and what are exec and shell forms?
- How does Docker build caching work, and how do you order a Dockerfile to use it well?
- What are Dockerfile best practices for production images?
- ARG or ENV: what is the difference, and how do you pass secrets into a build safely?
- How do you secure Docker containers and images?