CI/CD pipeline for a container PaaS

WHAT THIS TESTS This checks whether you understand containerized continuous delivery as distinct, ordered stages, and specifically why a registry sits in the middle.

A GOOD ANSWER COVERS The pipeline triggers on a push or merge. First it checks out the source and runs the verification stage: install dependencies, lint, and run unit and integration tests, failing fast if anything breaks. Next is the build stage, which runs docker build against the Dockerfile to produce an image, tagging it with a unique identifier such as the git commit SHA so every build is traceable. Then the push stage uploads that tagged image to a container registry like Google Artifact Registry, Amazon ECR, or Docker Hub. Finally the deploy stage tells Cloud Run to run a new revision from that exact image reference; Cloud Run pulls the image and shifts traffic to the new revision, often gradually. The registry is the artifact store and the clean handoff between build and deploy: build produces and pushes, deploy pulls. Because images are immutable and tagged, you get reproducible deploys and instant rollback by redeploying a previous tag.

COMMON WRONG ANSWERS Rebuilding the image on the deployment target instead of promoting the tested artifact. Omitting the registry and trying to ship source directly. Using the mutable latest tag everywhere, which destroys traceability and safe rollback. Running deploy before tests pass.

LIKELY FOLLOW-UPS Why tag with the commit SHA instead of latest? How do you do a canary or blue-green rollout on Cloud Run revisions? How do you scan images for vulnerabilities in the pipeline? How does rollback work?

ONE CONCRETE EXAMPLE A developer merges to main. GitHub Actions runs pytest, then docker build -t REGION-docker.pkg.dev/proj/app:GITHUB_SHA ., pushes that image to Artifact Registry, and runs gcloud run deploy app --image REGION-docker.pkg.dev/proj/app:GITHUB_SHA. Cloud Run creates a new revision from the immutable image and migrates traffic to it. To roll back, the team redeploys the previous SHA tag from the registry.