Concept questionMedium~7 min

Interview question

How would you version and promote container images, and how do base-image security patches reach a running .NET service?

Container image tags, digests, registries, and patching

Uses immutable image identity, controlled promotion, registry security, and deliberate base-image rebuilding instead of mutable latest tags.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I publish each successful build with an immutable version or commit tag and record its digest. Environments promote the same image digest rather than rebuilding from source with environment-specific differences. Human-friendly release tags can point to that digest, but production deployment records the immutable identity. When the base image is patched, the pipeline rebuilds, scans, tests, and rolls out a new application image.

Full answer below

Practice focus

Tags, digests, registries, artifact promotion, SBOMs, signing, scanning, base images, rebuilds, and rollout evidence.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
A tag is a movable label while a digest identifies exact image content. Running services do not receive a base-image fix until a new application image is built and deployed.
I publish each successful build with an immutable version or commit tag and record its digest. Environments promote the same image digest rather than rebuilding from source with environment-specific differences. Human-friendly release tags can point to that digest, but production deployment records the immutable identity. When the base image is patched, the pipeline rebuilds, scans, tests, and rolls out a new application image.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
The registry is part of the supply chain, so access is least-privileged and CI uses short-lived identity where possible. I retain deployment metadata linking source revision, pipeline run, image digest, and SBOM. Vulnerability scanning informs patch priority, but findings are interpreted by reachability, severity, and available fixes rather than blindly blocking every build. I do not use latest as a production release contract because it hides what actually ran.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I define patch SLAs and an emergency rebuild path even when application code has not changed. Image signing or attestations let the deployment gate verify trusted provenance. Multi-architecture manifests require digest awareness because the index and platform images have different identities. Rollback references a previously verified digest, but I still check schema and external-contract compatibility. I monitor which digest each instance runs so partial rollouts, stale nodes, and unauthorized images are visible rather than inferred from a tag.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Deploying the latest tag to production.
Rebuilding separately in each environment.
Assuming a running container receives base-image patches automatically.
Treating every scanner finding as identical risk.

Red flagsCandidateSigns the container design is fragileSignals that an interviewer may treat as risky.Open details

Details

The team cannot map an incident instance to a source revision.
Rollback depends on a mutable tag.
Registry credentials have broad permanent access.
Patched base images are never rebuilt into application images.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What is the difference between a tag and digest?
How would you promote one artifact across environments?
What should an image attestation prove?

Continue practice

No explicit flow link is set yet, so these are nearby drills from the same path or taxonomy.

Abstraction vs encapsulationConcept question / Easy / ~5 minContinue Access modifiersConcept question / Easy / ~5 minContinue ActionResult vs Typed ResultsComparison question / Medium / ~7 minContinue

Concept questionMedium~7 min

Interview question

How would you version and promote container images, and how do base-image security patches reach a running .NET service?

Container image tags, digests, registries, and patching

Uses immutable image identity, controlled promotion, registry security, and deliberate base-image rebuilding instead of mutable latest tags.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

Full answer below

Practice focus

Tags, digests, registries, artifact promotion, SBOMs, signing, scanning, base images, rebuilds, and rollout evidence.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Why this question matters
A tag is a movable label while a digest identifies exact image content. Running services do not receive a base-image fix until a new application image is built and deployed.
I publish each successful build with an immutable version or commit tag and record its digest. Environments promote the same image digest rather than rebuilding from source with environment-specific differences. Human-friendly release tags can point to that digest, but production deployment records the immutable identity. When the base image is patched, the pipeline rebuilds, scans, tests, and rolls out a new application image.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
The registry is part of the supply chain, so access is least-privileged and CI uses short-lived identity where possible. I retain deployment metadata linking source revision, pipeline run, image digest, and SBOM. Vulnerability scanning informs patch priority, but findings are interpreted by reachability, severity, and available fixes rather than blindly blocking every build. I do not use latest as a production release contract because it hides what actually ran.
Finish
Advanced answer
Optional deeper angle for production judgment and nuance.
In production I define patch SLAs and an emergency rebuild path even when application code has not changed. Image signing or attestations let the deployment gate verify trusted provenance. Multi-architecture manifests require digest awareness because the index and platform images have different identities. Rollback references a previously verified digest, but I still check schema and external-contract compatibility. I monitor which digest each instance runs so partial rollouts, stale nodes, and unauthorized images are visible rather than inferred from a tag.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Deploying the latest tag to production.
Rebuilding separately in each environment.
Assuming a running container receives base-image patches automatically.
Treating every scanner finding as identical risk.

Red flagsCandidateSigns the container design is fragileSignals that an interviewer may treat as risky.Open details

Details

The team cannot map an incident instance to a source revision.
Rollback depends on a mutable tag.
Registry credentials have broad permanent access.
Patched base images are never rebuilt into application images.

Follow-up prompts

Quick interviewer prompts inside this drill.

Follow-up questionsCandidateFollow-up questionsLikely next questions after the main answer.Open details

Details

Treat these as the next interviewer turn. Answer one out loud, then save the gap in your practice notes.

What is the difference between a tag and digest?
How would you promote one artifact across environments?
What should an image attestation prove?

Continue practice

No explicit flow link is set yet, so these are nearby drills from the same path or taxonomy.

How would you version and promote container images, and how do base-image security patches reach a running .NET service?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice

How would you version and promote container images, and how do base-image security patches reach a running .NET service?

Practice focus

Answer path

Why this question matters

Review signals

Follow-up prompts

Continue practice