DevOps Engineer interview question · Most asked
Why is deploying the latest tag a bad idea, and what should you do instead?
Summary
Tags are mutable: latest (or node:22) points to different content over time, so nodes may run different images, rebuilds produce different artifacts and rollbacks can't identify the previous version. Build once, tag with the commit SHA, deploy by immutable tag or digest, and pin base images with automated update PRs.
Longer Answer
Enforce it with admission policies that reject :latest, immutable tags in the registry, and lock files for application dependencies. Renovate or Dependabot keep pinned versions fresh.
Key Points
- Tags move; digests don't.
- Deploy by SHA tag or digest.
- Pin base images and lock dependencies.
- Automate updates.
Deep dive: DevOps in Production: Same Commit, Different Build
Explanation
What interviewers look for
Reproducibility and rollback reasoning.
More most-asked DevOps Engineer questions
- Design a CI/CD pipeline for a containerised microservice from commit to production.
- Pods keep restarting with OOMKilled under load. How do you investigate and fix it?
- How do you handle database schema migrations in an automated deployment pipeline?
- How do you handle secrets in CI/CD pipelines securely?
- What happens when you type a URL into a browser and press Enter?
- A rollback after a release made the outage worse because the database had already been migrated. How do you design releases so rollbacks are always safe?
- What are DORA metrics, and how would you use them without gaming them?
- Every deployment produces a burst of 502s. What do you check?