Docker interview question · Most asked
How do you run Docker builds in CI pipelines efficiently and safely?
Summary
Use BuildKit with remote caching (registry or CI cache) so ephemeral runners reuse layers, build once and push an immutable tag, scan the image, sign it, and deploy that exact digest to every environment. Avoid privileged Docker-in-Docker on shared runners where possible; use rootless or remote builders.
Longer Answer
Pipeline sketch: build with --cache-from/--cache-to, run tests against the built image, scan (Trivy, Grype, Docker Scout) and fail on critical vulnerabilities with an exception process, generate an SBOM and provenance attestations, sign (cosign), push with the commit SHA tag, and promote the same digest through environments. Authenticate to registries with OIDC or short-lived tokens, not stored passwords.
Key Points
- Remote build caches.
- Build once, promote the same digest.
- Scan, SBOM, sign.
- Avoid privileged DinD; OIDC to registries.
More most-asked Docker questions
- What is the difference between an image and a container, and how do image layers work?
- What is a container, and how does it differ from a virtual machine?
- What are multi-stage builds, and why use them?
- CMD or ENTRYPOINT: what is the difference, and what are exec and shell forms?
- How does Docker build caching work, and how do you order a Dockerfile to use it well?
- What are Dockerfile best practices for production images?
- ARG or ENV: what is the difference, and how do you pass secrets into a build safely?
- How do you secure Docker containers and images?