Building, testing, and shipping container images automatically as part of your pipeline.
A typical containerized CI/CD pipeline builds an image from the Dockerfile, runs tests inside a container for environment parity with production, tags the resulting image — often with the git commit SHA for exact traceability — pushes it to a registry, and deploys it. The image that gets tested is the same image that gets promoted through environments (dev, staging, production) rather than being rebuilt separately for each one, which is what actually guarantees that what was tested is what ships.
Build caching matters a lot for CI speed specifically, since a slow build directly extends every pipeline run — multi-stage builds and registry-based cache mounts both help meaningfully here. Vulnerability scanning as an explicit pipeline step catches known CVEs in an image before it ever reaches production, which is a far cheaper place to catch a problem than after deployment.
What you'll walk away knowing