Top 30 Infrastructure Interview Questions and Answers

30 questions. Pick an answer, or open “Show the answer” to read it.

Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.

1. Question 1 of 30

   What problem does cloud computing primarily solve for businesses launching new digital services?

   • aThe difficulty of finding skilled IT personnel to manage servers.
   • bThe need for applications to run exclusively on proprietary hardware.
   • cThe high upfront costs and risks of owning physical IT infrastructure.
   • dThe challenge of ensuring 100% uptime for all online services.
   Show the answer

   Answer: c · The high upfront costs and risks of owning physical IT infrastructure.

   The card states cloud computing was created to solve "huge upfront capital costs, long procurement times, and the risk of buying too much or too little capacity" associated with owning physical servers. While cloud computing can help with IT personnel challenges (A) and high availability (D), these are not its primary foundational purpose.

   Read the full bite: Cloud Computing: Renting Someone Else's Computer

2. Question 2 of 30

   What is the significance of Vercel using the same public Adapter API contract as third-party platforms?

   • aThird-party platforms can achieve full framework fidelity without relying on reverse-engineered internals.
   • bAll platforms are required to use an identical runtime configuration generated by modifyConfig.
   • cVercel must submit adapter changes to the Ecosystem Working Group before deployment.
   • dVercel has open-sourced its adapter so platforms can replicate previously private build logic.
   Show the answer

   Answer: a · Third-party platforms can achieve full framework fidelity without relying on reverse-engineered internals.

   The correct answer is B because the card emphasizes that the public contract allows any platform to target the same framework fidelity as Vercel without reverse-engineering build output. Option D is tempting because Vercel did open-source its adapter, but the card explicitly states there are no private hooks, so there was no secret build logic to replicate.

   Read the full bite: Next.js 16.2 ships stable Adapter API for all platforms

3. Question 3 of 30

   A long-running agent job fails on step five after several expensive model calls. How does Vercel Workflow SDK handle the retry?

   • aIt resumes from the last successful checkpoint before the failure, avoiding redundant calls.
   • bIt pauses indefinitely until a developer manually approves the retry.
   • cIt restarts the entire job from step one and re-runs every previous model call.
   • dIt skips the failed step and proceeds to the next step.
   Show the answer

   Answer: a · It resumes from the last successful checkpoint before the failure, avoiding redundant calls.

   Workflow SDK checkpoints every step and persists state, so retries resume from the last good step instead of restarting from zero. Option C describes standard retry behavior without durable execution, while option B conflates automatic retries with the SDK's optional human-in-the-loop pauses.

   Read the full bite: Vercel ships AI Gateway, Workflow SDK, and Sandbox for agents

4. Question 4 of 30

   Why does the card suggest evaluating Vercel Connect against your current secret management strategy?

   • aBecause it replaces long-lived environment tokens with temporary scoped credentials
   • bBecause it enables service-to-service communication without public internet exposure
   • cBecause it integrates with Amazon Aurora and DynamoDB for credential storage
   • dBecause it provides sandboxed compute for agent code execution
   Show the answer

   Answer: a · Because it replaces long-lived environment tokens with temporary scoped credentials

   The card states that Vercel Connect introduces temporary scoped credentials for agent-to-service authentication, eliminating long-lived environment tokens, which directly addresses secret management and token rotation struggles. Option C confuses Connect with Marketplace database integrations, while B and D describe other distinct products in the Agent Stack.

   Read the full bite: Vercel Ship 2026: agent stack, eve framework, and microservices

5. Question 5 of 30

   When you run a container from an image, how does Docker handle the image layers and runtime file changes?

   • aIt keeps the image layers read-only and adds a writable layer on top for runtime changes.
   • bIt converts the image into a virtual disk that the container boots as an independent mini-VM.
   • cIt copies all image layers into the container so changes do not affect the original image.
   • dIt merges runtime changes back into the image layers so all containers see the updates.
   Show the answer

   Answer: a · It keeps the image layers read-only and adds a writable layer on top for runtime changes.

   A container mounts the image's read-only layers and adds a writable layer on top, allowing runtime changes without altering the original image. Option B is wrong because containers are isolated processes that share the host kernel, not mini-VMs that boot their own kernels.

   Read the full bite: How do Docker images and containers differ and relate?

6. Question 6 of 30

   Which statement best describes a core benefit of adopting public cloud for a new business?

   • aIt completely removes the need for any IT security management.
   • bIt ensures all data remains within a single, specified geographic region by default.
   • cIt enables rapid resource scaling and avoids large upfront capital investments.
   • dIt guarantees lower overall IT spending compared to owning hardware.
   Show the answer

   Answer: c · It enables rapid resource scaling and avoids large upfront capital investments.

   Option C is correct because the card emphasizes public cloud's ability to turn rigid capital expense into flexible operational expense, allowing rapid scaling without large upfront hardware purchases. Option D is incorrect as the card notes that public cloud may not be cost-effective for stable, high-utilization workloads and uncontrolled usage can lead to higher costs.

   Read the full bite: Public Cloud: Renting, Not Owning, Your Datacenter

7. Question 7 of 30

   Which scenario would trigger an automated MLOps deployment but typically not a traditional DevOps pipeline?

   • aA scheduled rebuild of the serving application container
   • bProduction monitoring detecting drift in input data distributions
   • cA pull request merging changes to the model serving API
   • dA new GPU driver update pushed to the inference cluster
   Show the answer

   Answer: b · Production monitoring detecting drift in input data distributions

   The card states that MLOps deployments add triggers like data drift detection, unlike DevOps pipelines that react to code commits, dependency patches, or infrastructure changes. The GPU driver update is a tempting distractor because a common misconception is that MLOps is simply DevOps plus GPUs.

   Read the full bite: What are the primary differences between traditional DevOps and MLOps?

8. Question 8 of 30

   What is the key feature that distinguishes a private cloud from a traditional, on-premises data center?

   • aIt ensures data remains within the organization's physical control for regulatory compliance.
   • bAll hardware and infrastructure are owned and operated solely by a single organization.
   • cIt primarily utilizes virtualization technology to consolidate server workloads.
   • dIt offers on-demand, self-service access to resources through a management software layer.
   Show the answer

   Answer: d · It offers on-demand, self-service access to resources through a management software layer.

   A private cloud's defining characteristic is the cloud management software stack that provides self-service, on-demand access and automation, differentiating it from a traditional data center which may also own its hardware and use virtualization but lacks these cloud-like capabilities. While option B is often true for private clouds, it's also true for traditional data centers, so it's not the distinguishing factor.

   Read the full bite: Private Cloud: Cloud Computing on Your Terms

9. Question 9 of 30

   An e-commerce company notices prediction accuracy dropping on a model whose serving code hasn't changed. What is the most appropriate first step in a mature MLOps setup?

   • aTrigger the CT pipeline to validate data, train, evaluate against the champion, and promote if blessed
   • bRoll back the serving container to the last known good software version
   • cUpdate the feature engineering library and deploy a new container via the CI/CD pipeline
   • dRetrain the model immediately on fresh data and replace the production endpoint
   Show the answer

   Answer: a · Trigger the CT pipeline to validate data, train, evaluate against the champion, and promote if blessed

   When model performance decays but serving code is unchanged, the CT pipeline should validate data, retrain, and evaluate before promotion. Option D is wrong because it bypasses evaluation gates and data validation, and B is wrong because models are separate deployable units from serving code.

   Read the full bite: Explain ML pipelines and typical CI/CD/CT components

10. Question 10 of 30

    A development team prioritizes rapid deployment of their custom web application and wants to avoid managing servers or operating systems. Which cloud service model best fits their needs?

    • aOn-premises hosting, to ensure maximum security and compliance by keeping everything in-house.
    • bPlatform as a Service (PaaS), as it abstracts away infrastructure, allowing focus on code and quick deployment.
    • cSoftware as a Service (SaaS), because it provides ready-to-use applications without any development effort.
    • dInfrastructure as a Service (IaaS), to retain full control over the underlying virtual machines and network.
    Show the answer

    Answer: b · Platform as a Service (PaaS), as it abstracts away infrastructure, allowing focus on code and quick deployment.

    PaaS is designed for rapid development and deployment by abstracting away the underlying infrastructure like servers and operating systems, allowing developers to focus solely on their application code. While IaaS offers control, it requires managing those underlying components, which the team wants to avoid.

    Read the full bite: Platform as a Service (PaaS): Focus on Code, Not Infrastructure

11. Question 11 of 30

    What key characteristic separates Infrastructure as Code from traditional imperative server scripting?

    • aIaC executes configuration steps sequentially each time a deployment runs
    • bIaC files are written in JSON or YAML rather than Bash or PowerShell
    • cIaC requires manual approval through ticketing systems before any changes apply
    • dIaC defines the desired end state and achieves idempotence through automated reconciliation
    Show the answer

    Answer: d · IaC defines the desired end state and achieves idempotence through automated reconciliation

    True IaC is defined by its declarative, idempotent model that lets the platform reconcile to a desired state, not by the file format used. While IaC definitions are often written in JSON or YAML, simply using those formats without declarative idempotence is still just scripting.

    Read the full bite: What is Infrastructure as Code (IaC), and how does it support CI/CD?

12. Question 12 of 30

    A model is trained on batch aggregates computed in Spark and served via a Python microservice using real-time streams. What is the most robust way to prevent training-serving skew?

    • aKeep separate Spark and Python implementations synchronized through manual code reviews and unit tests before each deployment
    • bUse a shared transformation library for both paths, serve from a versioned feature store, and log features at training time for replay validation
    • cFocus on monitoring data distribution drift between the training warehouse and the live stream, alerting when distributions diverge
    • dRun the same heavy batch ETL pipeline online to ensure identical inputs, accepting higher latency for correctness
    Show the answer

    Answer: b · Use a shared transformation library for both paths, serve from a versioned feature store, and log features at training time for replay validation

    A shared transformation library and versioned feature store guarantee both paths execute identical logic from a single source of truth. Relying on manual code reviews is insufficient because separate implementations inevitably diverge under operational pressure.

    Read the full bite: How do you guarantee identical feature engineering for training and real-time inference?

13. Question 13 of 30

    Which characteristic of blue-green deployment most directly enables sub-minute rollback during a failed release?

    • aTraffic is shifted gradually to green while health metrics are monitored.
    • bGreen runs on the existing production instances alongside blue, separated by process or port isolation.
    • cThe blue environment remains fully operational and ready to receive traffic after cutover.
    • dDatabase schema changes are automatically rolled back by the orchestrator if green fails.
    Show the answer

    Answer: c · The blue environment remains fully operational and ready to receive traffic after cutover.

    The card states that because the old environment stays warm, rollback is a single traffic switch rather than a redeploy. Option A describes a canary release, which reuses the same infrastructure and gradually shifts traffic, making it a common misconception rather than true blue-green behavior.

    Read the full bite: Explain blue-green deployment, its prerequisites, and how it reduces deployment risk.

14. Question 14 of 30

    The cloud's Region/Availability Zone (AZ) model is primarily designed to address which of the following challenges?

    • aThe requirement for applications to automatically scale up and down based on demand.
    • bThe inherent risk of a single data center becoming a critical point of failure.
    • cThe need to distribute application load evenly across a global user base.
    • dThe complexity of managing virtual machines and containers in a distributed environment.
    Show the answer

    Answer: b · The inherent risk of a single data center becoming a critical point of failure.

    The card states that "A single data center is a massive single point of failure" and the Region/AZ model was created to allow applications to "survive the loss of an entire data center or more." This directly addresses the risk of single data center failures. While other options are general cloud benefits, they are not the primary design goal of the Region/AZ model's failure isolation.

    Read the full bite: Cloud Regions and AZs: Infrastructure Built for Failure

15. Question 15 of 30

    Which architectural element of a feature store most directly prevents training-serving skew for a precomputed feature?

    • aRunning identical transformation logic in offline training pipelines and online serving paths
    • bStoring complete historical feature data in the online low-latency store
    • cUsing one shared database for both batch training and online inference
    • dPerforming point-in-time joins in the online store during real-time inference
    Show the answer

    Answer: a · Running identical transformation logic in offline training pipelines and online serving paths

    Training-serving skew is eliminated when the exact same transformations generate features for both training backfills and live inference. Option C is tempting but wrong because offline and online stores are separate, workload-optimized layers rather than a single shared database.

    Read the full bite: Describe feature store architecture and training-serving skew

16. Question 16 of 30

    What is a key characteristic that distinguishes a Virtual Machine (VM) from simply running multiple applications on a single operating system?

    • aVMs allow applications to run directly on the physical hardware without an intermediary.
    • bEach VM provides its own isolated operating system, sharing the host's kernel.
    • cVMs are primarily designed to reduce the overall resource consumption compared to containers.
    • dVMs enable the execution of entirely separate operating systems on a single physical machine.
    Show the answer

    Answer: d · VMs enable the execution of entirely separate operating systems on a single physical machine.

    The core purpose of a VM is to run multiple isolated operating systems on a single physical machine, each with its own OS. Option B is incorrect because VMs do not share the host's OS kernel; that is a characteristic of containers.

    Read the full bite: Virtual Machine (VM): A Computer Inside a Computer

17. Question 17 of 30

    What is the primary benefit of using a machine image for deploying servers?

    • aIt enables rapid and consistent provisioning of identical virtual machines.
    • bIt simplifies server management by abstracting away the underlying hardware details.
    • cIt is primarily used for simple applications where Docker containers are too complex.
    • dIt allows for unique, custom configurations on each server instance at boot time.
    Show the answer

    Answer: a · It enables rapid and consistent provisioning of identical virtual machines.

    The card emphasizes that machine images solve "slow, error-prone, and inconsistent server provisioning" by acting as a "cookie cutter" to launch "hundreds of identical virtual machines" quickly. Option D is incorrect because images are for identical servers; unique configurations often require additional tools. Option C is incorrect as the card states images can be overkill for simple applications, where Docker might be preferred.

    Read the full bite: Machine Images: The Blueprint for Your Servers

18. Question 18 of 30

    Which scenario best illustrates the primary advantage of using cloud instances?

    • aA company with a consistent, predictable computing load that needs to minimize monthly operational costs.
    • bA website experiencing significant, unpredictable spikes in user traffic throughout the day.
    • cAn organization looking to completely eliminate the need for IT staff to manage physical hardware.
    • dA small, local business needing a single, always-on server for internal file storage.
    Show the answer

    Answer: b · A website experiencing significant, unpredictable spikes in user traffic throughout the day.

    Cloud instances are designed for elasticity, allowing users to scale computing resources up or down rapidly to meet fluctuating demand and pay only for the time they are active. A website with unpredictable traffic spikes directly benefits from this on-demand scalability, unlike scenarios with consistent loads or static needs.

    Read the full bite: Cloud Instances: Renting Servers on Demand

19. Question 19 of 30

    A model degrades in production because separate batch and streaming pipelines produce slightly different values for the same feature. What does a feature store primarily solve here?

    • aIt caches pre-computed features to reduce serving latency compared to a database
    • bIt ensures identical transformation logic is used for both training and real-time serving
    • cIt automatically generates features without requiring manual engineering code
    • dIt centralizes raw data storage for both business analytics and model consumption
    Show the answer

    Answer: b · It ensures identical transformation logic is used for both training and real-time serving

    A feature store prevents training-serving skew by governing the same transformations and definitions across batch and real-time contexts. Describing it as merely a cache or database misses its core consistency and governance role.

    Read the full bite: What problems does a Feature Store solve in ML systems?

20. Question 20 of 30

    Which scenario best highlights the core advantage of implementing a data lake?

    • aA system designed for rapid, indexed lookups of specific data points within a well-defined dataset.
    • bA business needing to perform complex, predefined analytical queries on cleaned, structured historical sales data.
    • cA research team collecting vast amounts of raw, multi-format sensor data for exploratory machine learning.
    • dAn application requiring immediate, consistent updates to highly structured customer records.
    Show the answer

    Answer: c · A research team collecting vast amounts of raw, multi-format sensor data for exploratory machine learning.

    The correct answer (C) aligns with the data lake's purpose: storing diverse, raw data for exploratory analysis and machine learning without upfront schema. Options A, B, and D describe use cases better suited for transactional databases, data warehouses, or indexed systems, which data lakes are explicitly not designed for.

    Read the full bite: Data Lake: A Single Repository for Raw Data

21. Question 21 of 30

    Which statement best captures a key operational tradeoff between ephemeral and persistent CI build agents?

    • aContainerized builds inherently require an ephemeral host lifecycle, so persistent containers are impractical
    • bEphemeral agents reduce security patching burden through short lifecycles, while persistent agents require ongoing OS and toolchain maintenance
    • cPersistent agents guarantee reproducible builds because they reuse warmed dependency and compiler caches across jobs
    • dEphemeral agents always deliver faster builds and lower compute costs than persistent agents
    Show the answer

    Answer: b · Ephemeral agents reduce security patching burden through short lifecycles, while persistent agents require ongoing OS and toolchain maintenance

    Ephemeral agents are short-lived, which minimizes patching and drift, whereas persistent agents accumulate state and need active maintenance. Distractor A is wrong because ephemeral agents can suffer from cold-start latency and repeated image pulls, and persistent agents can be more cost-effective when heavily utilized.

    Read the full bite: Compare ephemeral container agents versus persistent build agents

22. Question 22 of 30

    When A/B testing a backend architecture change with shared database pools, which experimental design most rigorously isolates the architecture effect from confounders?

    • aDeploy a 5% canary of the new variant, measure P99 latency, and compare against historical data from the week before
    • bBucket users by session ID hash for sticky routing, stratify by region, pair P99 latency with a user completion metric, and run a parallel holdback at identical traffic percentage
    • cSplit requests 50/50 without stickiness, use mean latency as the primary metric, and compare against pre-launch baseline data
    • dHash user IDs for sticky routing and track P99 latency, but skip stratification and rely only on server-side error rate without a user guardrail
    Show the answer

    Answer: b · Bucket users by session ID hash for sticky routing, stratify by region, pair P99 latency with a user completion metric, and run a parallel holdback at identical traffic percentage

    Option B correctly combines sticky routing, regional stratification, paired P99 and user-completion metrics, and a parallel holdback to isolate architecture effects. Option D is tempting because it includes stickiness and P99 latency, but omitting stratification and a user-facing guardrail leaves the test vulnerable to regional confounders and silent UX regressions.

    Read the full bite: How would you structure a backend architecture A/B test and define metrics?

23. Question 23 of 30

    When is a bare metal instance the most appropriate choice over a virtual machine?

    • aTo provide a cost-effective environment for general-purpose development and testing workloads.
    • bTo host a high-frequency trading platform requiring consistent, ultra-low latency and direct hardware access.
    • cTo deploy a new microservice where minimizing infrastructure management is the top priority.
    • dTo run a stateless web application that needs to rapidly auto-scale to handle unpredictable traffic spikes.
    Show the answer

    Answer: b · To host a high-frequency trading platform requiring consistent, ultra-low latency and direct hardware access.

    Bare metal instances are ideal for performance-critical workloads like high-frequency trading that require consistent low latency and direct hardware access, bypassing virtualization overhead. Virtual machines, on the other hand, are better suited for rapid auto-scaling to handle unpredictable traffic spikes, which bare metal instances lack.

    Read the full bite: Bare Metal Instances: Your Own Dedicated Cloud Server

24. Question 24 of 30

    Which AWS Placement Group strategy is best for a large distributed database to minimize correlated hardware failures?

    • aDedicated Host, to provide exclusive physical servers for the database instances.
    • bCluster, to ensure all nodes are in the same rack for fastest communication.
    • cSpread, to place each instance on entirely distinct hardware for maximum isolation.
    • dPartition, to distribute instances across logical hardware segments, reducing single point of failure impact.
    Show the answer

    Answer: d · Partition, to distribute instances across logical hardware segments, reducing single point of failure impact.

    Partition placement groups are designed for large distributed systems like Kafka or Cassandra, allowing instances to be spread across logical hardware partitions to reduce the chance of multiple nodes failing from a single hardware issue. While Spread groups also offer isolation, they are typically recommended for a small number of critical instances, not large distributed databases, due to the potential to exhaust distinct hardware.

    Read the full bite: AWS Placement Groups: Control Where Your Instances Run

25. Question 25 of 30

    Before a cloud server's operating system can store files on a newly provisioned block storage volume, what essential step must be performed?

    • aIt must be formatted with a filesystem and then mounted to a directory.
    • bIt needs to be configured as a shared network drive accessible by all virtual machines in the same subnet.
    • cThe volume must be assigned a unique public IP address for network accessibility.
    • dThe cloud provider automatically initializes it with a default file structure upon creation.
    Show the answer

    Answer: a · It must be formatted with a filesystem and then mounted to a directory.

    The card states that block storage is like a raw, unformatted SSD, and it's 'up to you to format it with a filesystem... and mount it' before use. Option B is incorrect because block storage is designed for single-server attachment, not for simultaneous access by multiple servers.

    Read the full bite: Block Storage: Your Virtual Hard Drive in the Cloud

26. Question 26 of 30

    For which scenario is cloud file storage the most suitable solution?

    • aProviding low-latency, dedicated storage for a high-performance database.
    • bSecuring individual user data on a single, isolated virtual machine.
    • cEnabling multiple servers or users to access a shared, hierarchical file system.
    • dStoring vast amounts of unstructured data for long-term archives.
    Show the answer

    Answer: c · Enabling multiple servers or users to access a shared, hierarchical file system.

    Cloud file storage is designed for scenarios requiring a shared, traditional file system accessible by multiple clients or servers, as stated in the card. Storing vast unstructured data is better suited for object storage, and high-performance databases typically use block storage.

    Read the full bite: Cloud File Storage: A Shared Drive on the Internet

27. Question 27 of 30

    What is the primary benefit of using Docker Compose profiles?

    • aTo manage configurations for fundamentally different application stacks within a single compose.yaml file.
    • bTo apply major configuration changes, like resource limits or network settings, uniformly across the majority of services in a project.
    • cTo define and selectively activate optional groups of services, such as debugging tools or environment-specific setups, from a unified compose.yaml.
    • dTo ensure that all services defined in the compose.yaml file are always launched together, simplifying deployment.
    Show the answer

    Answer: c · To define and selectively activate optional groups of services, such as debugging tools or environment-specific setups, from a unified compose.yaml.

    Profiles are designed to enable or disable subsets of services (e.g., debugging tools, dev-specific setups) within a single compose.yaml file, reducing complexity. Option A describes a scenario where separate compose.yaml files are explicitly recommended instead of profiles.

    Read the full bite: Docker Compose Profiles: Activate Service Groups

28. Question 28 of 30

    What is the main advantage Hydra offers for managing configurations in complex applications, particularly in machine learning?

    • aIt centralizes all configuration settings into one comprehensive file, simplifying overall management.
    • bIt simplifies passing individual configuration parameters directly via command-line flags for every setting.
    • cIt automatically validates configuration values against predefined schemas to prevent runtime errors.
    • dIt enables the systematic composition of small, reusable configuration pieces to manage numerous experimental variations.
    Show the answer

    Answer: d · It enables the systematic composition of small, reusable configuration pieces to manage numerous experimental variations.

    Hydra's core benefit is its ability to compose modular configuration components, allowing users to systematically manage and swap out different settings for various experimental runs. The card explicitly states it avoids a 'monolithic file' approach, making option A incorrect.

    Read the full bite: Hydra: Composable Configuration for Complex Apps

29. Question 29 of 30

    Which strategy best guarantees that CI and developers use bitwise-identical Docker dev environments without host-specific drift?

    • aPin the Dockerfile base image by digest in Git and have CI and developers rebuild the image locally before each run
    • bBuild the image once, push it to a registry with an immutable tag or digest, and have both CI and developers pull that exact image
    • cVersion control the Dockerfile and require every developer to build the image locally before running tests
    • dUse a private registry and standardize on the 'latest' tag so all machines automatically receive the most current environment
    Show the answer

    Answer: b · Build the image once, push it to a registry with an immutable tag or digest, and have both CI and developers pull that exact image

    The card treats the built image—not the Dockerfile—as the immutable artifact to distribute, and pulling an exact tagged or digested image eliminates host dependency and cache variability. Option A is tempting because pinning a base image by digest is correct, but local rebuilds still reintroduce 'works on my machine' discrepancies from host caches and build contexts.

    Read the full bite: How do you version and distribute Docker dev environments consistently?

30. Question 30 of 30

    Which combination best shrinks a PyTorch serving image while preserving operational rigor and layer hygiene?

    • aPlace rm -rf /root/.cache/pip in a separate RUN after pip install in a single-stage build
    • bUse a single-stage nvidia/cuda:devel image, then run docker squash to flatten layers
    • cBuild in a devel stage, copy artifacts to a runtime stage, and collapse cleanup into the install RUN
    • dSwitch the final stage to python:3.11-alpine and install PyTorch from source
    Show the answer

    Answer: c · Build in a devel stage, copy artifacts to a runtime stage, and collapse cleanup into the install RUN

    The correct approach uses multi-stage builds to exclude devel libraries and collapses cleanup into the installation RUN so intermediate files never commit to a layer. The most tempting distractor, docker squash, merely hides bloat rather than fixing build hygiene, and separate RUN cleanups still preserve deleted files in underlying layers.

    Read the full bite: Strategies to reduce a 5GB ML Docker image size