Explain multi-stage Docker builds for Python and builder vs runtime

WHAT THIS TESTS: This question tests whether you understand the difference between build-time and runtime environments in containerized Python applications. Interviewers want to see that you know how to keep production images minimal, secure, and cache-friendly by isolating compilation steps from the final deployment artifact. It also reveals whether you understand Docker layer caching and supply-chain hygiene.

A GOOD ANSWER COVERS: First, define the builder stage as an image that contains compilers, system headers, and development libraries needed to build Python packages with C extensions. Examples include gcc, python3-dev, libpq-dev, and build-essential. In this stage, you typically create a virtual environment, install requirements, and compile wheels. Second, define the runtime stage as a slim or distroless base image that contains only the Python interpreter and essential system libraries. You copy the pre-built virtual environment or wheels from the builder stage using COPY --from=builder. Third, list concrete benefits: image size often drops from hundreds of megabytes to under one hundred megabytes, the attack surface shrinks because compilers and shell utilities are absent, and layer caching improves because dependency installation is isolated in a separate stage that only rebuilds when requirements change. Fourth, mention that this pattern prevents shipping secrets or development tools into production.

COMMON WRONG ANSWERS: A red flag is suggesting that you can achieve the same result in a single-stage build by uninstalling packages with apt-get remove after installation. This still bloats the image because the layers containing the original packages remain in the history. Another red flag is claiming that multi-stage builds are only about image size while ignoring security and caching. Some candidates also forget to mention that compiled wheels must be compatible with the runtime base image, especially when the builder and runtime use different OS versions or glibc versions.

LIKELY FOLLOW-UPS: The interviewer may ask how you would handle native dependencies that are required at runtime, such as libpq or libssl, which need to be installed in the final stage as well. They might also ask how to leverage BuildKit mount caches to speed up pip installs across rebuilds, or how to copy only specific files rather than the entire build context. A senior candidate should be ready to discuss distroless images versus slim images, and when to use non-root users in the runtime stage.

ONE CONCRETE EXAMPLE: A typical Python FastAPI multi-stage Dockerfile starts with python:3.11 as the builder. It installs build-essential and gcc, creates a virtual environment in /opt/venv, and runs pip install -r requirements.txt to compile packages like psycopg2, pandas, or pydantic with C extensions. The runtime stage uses python:3.11-slim, installs only runtime libraries like libpq5, copies the /opt/venv directory with COPY --from=builder /opt/venv /opt/venv, sets PATH to include the virtual environment, copies the application code, and runs the server with a non-root user. The final image contains no gcc, no python3-dev, and no build cache, often reducing the size from over 1 GB to around 150 MB.