Interview › Kubernetes, Docker, Helm & Podman
Why is using the latest tag in production discouraged?
Kubernetes, Docker, Helm & Podman · Advanced level
Answer
Using latest in production is discouraged because it is mutable and non-auditable. The same manifest can deploy different bits over time, which breaks rollback, provenance, vulnerability tracking, and incident investigation.
Technical explanation
latest also makes staged rollouts ambiguous because dev, staging, and prod may silently pull different images.
Use semantic versions, git SHA tags, build numbers, and promotion-by-digest for reproducible releases.
Container image quality affects supply chain, startup time, vulnerability surface, rollout reliability, and debugging workflows.
Prefer reproducible builds: pinned dependencies, small build context, deterministic Dockerfile order, non-root runtime, and immutable image references.
Understand the runtime boundary: an image is not a VM, and container isolation depends on kernel, namespaces, cgroups, capabilities, seccomp, and mounts.
Hands-on example
1. Create a tiny sample app and Dockerfile for this exercise: replace latest with immutable version tags and digest pinning.
2. Build and inspect it with docker build or podman build, docker history, image inspect, and a vulnerability or size scan if available.
3. Run it locally with explicit env vars, ports, user, volumes, and signal tests depending on the question.
4. Convert the final runtime assumptions into Kubernetes fields such as image, command, args, ports, securityContext, probes, and volumeMounts.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More Kubernetes, Docker, Helm & Podman interview questions
- What is Kubernetes, and what problem does it solve over running containers manually?
- Explain the Kubernetes control plane components (API server, etcd, scheduler, controller manager).
- What runs on a worker node (kubelet, kube-proxy, container runtime)?
- What is a Pod, and why does Kubernetes schedule Pods rather than containers?
- What is the difference between a Pod, a ReplicaSet, and a Deployment?
- How does a Deployment perform a rolling update, and how do maxSurge and maxUnavailable work?
- How do you roll back a Deployment, and how does Kubernetes track revisions?
- What is a Service, and what are the types (ClusterIP, NodePort, LoadBalancer, ExternalName)?