Containers & Delivery
A track of P36 · CI/CD & Delivery.
Ship a service, not just a library: build a Dockerfile linter for release-hygiene mistakes (unpinned base, cache-busting layer order, root user, no multi-stage), then map a semantic version to an immutable, promoted image tag.
The image built cleanly in March. The same Dockerfile today produces a
different image, because the :latest base moved underneath it — and the thing
currently serving your users contains a C compiler, a package-index cache, and a
process running as root. Every one of those arrived by default, and none of them
was a decision anybody made.
A wheel distributes a library; an image ships a running service. This track is the last mile of delivery — packaging a Python service into a container that's small, reproducible and non-root, then cutting a release that ships exactly what CI tested.
You build a Dockerfile linter for the mistakes that bite in production: an
unpinned base (:latest breaks reproducibility), copying the whole context before
pip install (busts the layer cache on every commit), running as root, and a
single stage that bakes build tools into the shipped image. Fixing those is the
multi-stage, pinned, non-root shape. Then you connect it to release: a semantic
version maps to an immutable image tag, CI promotes the green build from the
protected branch (tag and push the image that passed — never a rebuild), and
rollback is re-pointing a tag. Real docker build and registry pushes stay prose;
here you build the check and reason about the release flow.