Containers & Delivery
A track of P36 · CI/CD & Delivery.
Ship a service, not just a library: build a Dockerfile linter for release-hygiene mistakes (unpinned base, cache-busting layer order, root user, no multi-stage), then map a semantic version to an immutable, promoted image tag.
A wheel distributes a library; an image ships a running service. This track is the last mile of delivery — packaging a Python service into a container that's small, reproducible and non-root, then cutting a release that ships exactly what CI tested.
You build a Dockerfile linter for the mistakes that bite in production: an
unpinned base (:latest breaks reproducibility), copying the whole context before
pip install (busts the layer cache on every commit), running as root, and a
single stage that bakes build tools into the shipped image. Fixing those is the
multi-stage, pinned, non-root shape. Then you connect it to release: a semantic
version maps to an immutable image tag, CI promotes the green build from the
protected branch (tag and push the image that passed — never a rebuild), and
rollback is re-pointing a tag. Real docker build and registry pushes stay prose;
here you build the check and reason about the release flow.