VocalHyre
Sign up

CI/CD · Ship safely, repeatedly

How do you build container images safely in a pipeline?

Mediumcontainersdockerimage securityUpdated Oct 2026
Quiz this track

Short answer

Use multi-stage builds, pin the base image by digest, run as a non-root user, keep the runtime image minimal, scan and sign the result, and deploy by digest rather than a mutable tag.

A container image is both the build output and the runtime environment. That makes the Dockerfile part of your security and reliability surface, not just a packaging detail.

  • Use multi-stage builds to keep compilers and build tools out of the runtime image
  • Pin base images by digest and rebuild regularly to pick up security fixes
  • Run as a non-root user and drop unnecessary capabilities
  • Use a small runtime base to reduce the attack surface
  • Scan the final image for vulnerabilities and generate an SBOM
  • Sign the image and deploy by digest
dockerfile
FROM node:22-alpine AS build
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
RUN npm run build

FROM node:22-alpine
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
USER node
CMD node dist/server.js
Do not put secrets in build arguments or image layers. Even if a later layer deletes a file, the earlier layer can still contain it and be pulled by anyone with registry access.

Follow-ups you should expect

Interviewers use these to check whether the first answer was understanding or memorisation.

  1. 1Why pin a base image by digest?
  2. 2What belongs in a multi-stage build?
  3. 3How do you handle secrets during a Docker build?
  4. 4Why is running as non-root important?

Say it in the interview

I build images with multi-stage Dockerfiles so the runtime layer contains only what it needs. The base image is pinned by digest, the process runs as non-root, and the final image is scanned, signed and referenced by digest. I keep secrets out of build arguments and layers because they are recoverable from image history. I also rebuild regularly so pinned bases still receive security updates.

Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.

Related questions

MediumWhat is a build artifact and why should you build once?HardWhat does supply-chain security mean for CI/CD?MediumWhy use an artifact repository instead of copying files between jobs?

Reading is step one

Now say it out loud.

Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live CI/CD mock interview and get scored feedback on depth, clarity and confidence.

Start a free CI/CD interviewBrowse all questions