KNOWLEDGE / 08
CI/CD, Docker and Kubernetes
Pipelines, containers, orchestration, and fast feedback from quality checks.
Questions and practice
Open a question to see the answer, examples, and exercises.
How does continuous delivery differ from continuous deployment?Junior
Answer
Delivery keeps changes ready for release; deployment automatically releases suitable changes to production.
Examples
- With delivery, release may require a human decision; deployment releases a successful change automatically.
Practice exercises
- Draw a pipeline for both models and mark the human approval point.
How should CI pipeline stages be organised for fast feedback?Junior
Answer
Run cheap, fast checks first: formatting, static analysis, and unit tests, followed by build, integration, security, and expensive system tests. Execute independent jobs in parallel, and ensure fail-fast does not destroy useful diagnostics. Every stage should have a clear purpose and artefact.
Examples
- Lint and unit tests finish within minutes before a container integration suite that takes much longer.
Practice exercises
- Reorder ten pipeline checks by cost, signal, and dependencies, then identify parallel jobs.
Why should a build artefact be created only once?Junior
Answer
One immutable artefact should pass checks and be promoted across environments. Rebuilding for production may use different dependencies or configuration and invalidate CI evidence. Identify artefacts by version, commit digest, and provenance, while applying environment configuration separately during deployment.
Examples
- Test the same container digest in staging and deploy it to production instead of running docker build again.
Practice exercises
- Define traceability metadata for an artefact: source commit, dependencies, build run, signature, and environment configuration.
How does an image differ from a container?Middle
Answer
An image is a filesystem and configuration template; a container is its running or stopped instance with its own state.
Examples
- One immutable image can start multiple containers with different environment variables.
Practice exercises
- Build an image, run two containers, and compare their configuration and writable state.
How should secrets be handled safely in CI/CD?Middle
Answer
Do not store secrets in repositories or artefacts; grant them to jobs under least privilege, mask them in logs, and rotate them regularly. Pull requests running untrusted code must not automatically receive production credentials. Short-lived federated identity is often safer than a long-lived token.
Examples
- A deployment job receives temporary cloud credentials only after approval, while test jobs have no production access.
Practice exercises
- Build a permission matrix for lint, test, preview, and production deployment jobs, then remove unnecessary rights.
What makes a quality gate useful instead of ceremonial?Middle
Answer
A gate blocks a specific unacceptable risk and provides understandable evidence: failed tests, a critical vulnerability, a broken contract, or a policy violation. A threshold needs an owner, rationale, and exception process. Large numbers of unstable checks teach teams to ignore a red pipeline.
Examples
- A gate blocks a known critical exploitable vulnerability, while an informational finding only appears in the report.
Practice exercises
- Classify pipeline findings as blocking, warning, or informational and define a temporary-exception process.
How does readiness differ from liveness?Senior
Answer
Readiness decides whether a workload can receive traffic; liveness decides whether it should be restarted as unhealthy.
Examples
- During warm-up, a pod may be alive but not ready to receive requests.
Practice exercises
- Design separate probes for a service with a long cache warm-up.
How do you choose among rolling, blue-green, and canary deployment?Senior
Answer
Rolling gradually replaces instances with little extra infrastructure; blue-green maintains two environments and enables fast switching; canary sends a traffic subset to the new version and requires strong metrics. Choose based on version compatibility, state, cost, blast radius, and rollback speed.
Examples
- A 5% canary automatically stops when error rate and latency increase relative to baseline.
Practice exercises
- Choose a strategy for a stateful API with a database migration and define promotion and abort criteria.
Why does a successful rollout not prove a successful release?Senior
Answer
An orchestrator may report Healthy while business errors, slow requests, or incorrect data already harm users. Use technical and product signals, compare against a baseline, trace results to a version, and test rollback. Destructive data changes may make code rollback impossible, requiring a roll-forward plan.
Examples
- Pods are ready, but conversion drops because of a pricing defect; a business metric catches it before a CPU alert.
Practice exercises
- Design a release dashboard with golden signals, a business KPI, a version marker, and automatic abort conditions.