Containers & Delivery

A track of P36 · CI/CD & Delivery.

Ship a service, not just a library: build a Dockerfile linter for release-hygiene mistakes (unpinned base, cache-busting layer order, root user, no multi-stage), then map a semantic version to an immutable, promoted image tag.

A wheel distributes a library; an image ships a running service. This track is the last mile of delivery — packaging a Python service into a container that's small, reproducible and non-root, then cutting a release that ships exactly what CI tested.

You build a Dockerfile linter for the mistakes that bite in production: an unpinned base (:latest breaks reproducibility), copying the whole context before pip install (busts the layer cache on every commit), running as root, and a single stage that bakes build tools into the shipped image. Fixing those is the multi-stage, pinned, non-root shape. Then you connect it to release: a semantic version maps to an immutable image tag, CI promotes the green build from the protected branch (tag and push the image that passed — never a rebuild), and rollback is re-pointing a tag. Real docker build and registry pushes stay prose; here you build the check and reason about the release flow.

multi-stage buildbuild tools out of the final imagepinned, non-rootreproducible + smaller attack surfacelayer orderdeps before source -> cache hitsimmutable tagpromote the green build; rollback = re-tag
An image is a delivery artifact: build it small, ship it versioned.