Describe essential CI/CD stages for a containerized app and critical quality gates

WHAT THIS TESTS: Your ability to design a structured, automated software delivery workflow rather than recite tool names. Interviewers want to see that you understand the difference between continuous integration, continuous delivery, and continuous deployment, and that you know how automation performs quality control across each phase. For a containerized application, the pipeline must treat the container image as the immutable artifact that progresses through environments.

A GOOD ANSWER COVERS: First, the source stage where a commit to a version control system like Git triggers the pipeline. Second, the build stage that compiles code, runs unit tests, and packages the application into a container image. Third, automated security and quality scanning including static analysis, dependency checks, and container image vulnerability scans to catch issues early. Fourth, pushing the validated image to a registry and deploying it to a staging environment where integration tests, API tests, and smoke tests run against realistic dependencies. Fifth, the production deployment stage using strategies like blue-green or canary releases with automated rollback if health checks fail. Critical quality gates should be explicit: build must pass, code coverage must meet a threshold, no critical CVEs may be present, staging smoke tests must pass, and production error rates must stay within SLOs before full traffic shifts.

COMMON WRONG ANSWERS: Listing Jenkins, GitLab CI, or ArgoCD without explaining the flow between stages. Saying tests happen after production deployment. Proposing manual approval as the only quality gate instead of automated tests and metrics. Ignoring container-specific concerns like image immutability, registry scanning, or runtime security. Treating rollback as a manual procedure rather than an automated pipeline feature.

LIKELY FOLLOW-UPS: How would you handle secrets and configuration across environments? What happens if a vulnerability is found in a base image after deployment? How do you balance deployment speed with regulatory requirements for change approval? Can you describe a time when a missing gate caused a production incident?

ONE CONCRETE EXAMPLE: A team commits code to a main branch. The pipeline builds a new image, runs 500 unit tests, and scans with a container scanner. On a critical CVE, the pipeline fails before registry push. After passing, the image deploys to a staging Kubernetes namespace. Integration tests verify database connectivity and API latency under load. Once staging passes, a canary deploy sends 5 percent of traffic to the new version in production for 10 minutes while error rate and latency metrics are evaluated. If metrics breach SLOs, traffic automatically reverts to the previous stable image.

Source: ibm.com