8. Review containers, CI and infrastructure as code

Objective & prerequisites

Distinguish reproducible design artifacts from an executed runtime or deployment. Prerequisites: Python functions, JSON, basic SQL, Git and the existing software/testing workshops. Extract the full kit and open a terminal in cloud-operations-kit. Python 3.10+ with its standard SQLite module is sufficient for the executed labs; no cloud account, credentials, package installation or network is needed. All data and prices are invented teaching fixtures. The runnable drills use new temporary folders and databases, never the website or hosting. These free companions retain existing course progress/access. Payments and public registration remain disabled.

python3 lab.py
python3 -m unittest discover -s tests -v

Understand the concept

A container image packages a filesystem and process configuration; running it depends on a compatible container runtime and operating boundaries. Keep build context small, exclude secrets, use a reviewed base and avoid root where feasible. A mutable image tag is not an immutable digest, and a pinned digest still needs maintenance review. CI runs declared checks but does not make deployment safe by itself. Infrastructure as code records intended resource configuration; a plan needs review for actual account, region, permissions, state storage, cost and destructive changes before apply. This kit includes optional container and CI examples plus a provider-neutral plan worksheet. It includes no Terraform provider configuration and no apply command. Docker and Terraform are unavailable in the current checked environment, so their runtimes are explicitly unexecuted.

Worked example

The example Dockerfile runs the same local lab/tests and exits; it is not a web service or Aruba deployment. It requires the learner to provide a reviewed official Python base image reference, preferably a verified digest. Its non-root user and restricted copies illustrate intent, but were not tested in a container here. The CI YAML runs compile and unit tests in a disposable learning repository with read-only contents permission and no deploy/key steps. The commands were run locally; a hosted GitHub run is not claimed.

python3 -m compileall -q lab.py tests
python3 -m unittest discover -s tests -v
python3 lab.py

Try it yourself

Review container-ci-review.txt, Dockerfile.example and ci-example.yml. Identify the intended runtime user, copied files, base-image decision and absent secrets. Run the equivalent local compile/tests. Explain what additional evidence is required before calling the container, hosted CI or cloud infrastructure tested. Predict the result first, keep the original fixture, and record the exact command and observed outcome from your practice copy.

Knowledge check

If a Dockerfile looks correct and local tests pass, can you report that its Linux container ran successfully?

Evidence, mistakes & handover

State whether an activity was executed locally, reviewed as a design, or left unexecuted. A successful local drill does not verify a cloud provider, container, hosted pipeline or production recovery. Keep an owner, acceptance criteria, known failures and rollback/cleanup evidence with the work. The download includes source fixtures, runnable drills/tests, separate exercises and solutions, a runbook, a resource plan, an optional container/CI review pack and a capstone rubric. Credit the teaching baseline and your own contribution; no certification, commercial service or employment guarantee follows.

Authoritative reference

Read the official reference ↗

— primary/official reference for the mechanism. Lesson explanations and fictional cases are original. Provider details can differ; this lesson does not configure or provision an account. No production access, payment, public registration or live deployment is activated.