Question 1

What is a build artifact, and why does reproducibility matter?

Accepted Answer

An **artifact** is the packaged output of a build — a compiled binary, a container image, a library archive — and reproducibility means that building the same source produces an **identical** artifact, every time, anywhere.

**Why artifacts are produced once and promoted.** The important principle: **build once, deploy many times**. The artifact tested in staging should be **the same bytes** deployed to production, not a rebuild from the same source.

**Why rebuilding is dangerous.** Two builds from identical source can differ — a dependency resolved to a newer version, a different compiler patch level, a different build machine configuration, an environment variable. **If you rebuild for production, you deploy something that was never tested**, however identical the source.

**What an artifact repository does:** stores built artifacts with immutable versions, so a specific build can be retrieved, deployed and rolled back to. Deploying means fetching a known artifact, not building.

**Reproducible builds.** Going further: the same source, built by anyone, produces bit-for-bit identical output.

**Why that matters:**

**Verification.** If a build is reproducible, anyone can build the source and confirm that a distributed binary corresponds to it. **Without reproducibility, you must trust that the published binary came from the published source** — and there is no way to check.

**Supply chain security.** This is the serious case. Compromising a build system is an extremely effective attack, because the source looks correct and the binary is not. Reproducibility makes such an attack detectable by independent rebuilding.

**Debugging.** Reproducing a build from months ago lets you investigate what actually shipped.

**Caching.** Deterministic builds allow results to be reused safely.

**What prevents reproducibility**, and these are the practical obstacles: **timestamps** embedded in output; **absolute file paths**; **non-deterministic ordering** of files or map iteration; embedded build machine identifiers; locale and timezone differences; and **unpinned dependencies**, which is the largest single cause.

**What helps:** lockfiles pinning exact dependency versions and hashes; containerised builds with a fixed base; normalising timestamps; and sorting anything with arbitrary order.

**Provenance attestation** — a signed statement of how an artifact was produced — is the related development, alongside **software bills of materials** listing what an artifact contains.

Question 2

What is infrastructure as code?

Accepted Answer

Defining servers, networks, databases and everything else supporting an application in files that are version-controlled and executed, rather than configuring them by hand through a console or by

Question 3

How does Git actually store your files?

Accepted Answer

As complete snapshots, not as differences — which is the single fact that makes Git's behaviour comprehensible, because almost every mental model imported from older version control systems is wrong

Question 4

What is the difference between COPY and ADD in a Dockerfile?

Accepted Answer

Both instructions move files from the build context into the image, and for ordinary files they behave identically. The difference is that ADD has two extra behaviours that trigger automatically, and

Question 5

Why is my Docker image so large and how do I shrink it?

Accepted Answer

Image size is the sum of every layer, and layers are immutable. That second point catches people out: deleting a file in a later instruction does not reclaim the space, because the earlier layer

Question 6

Why is my Docker build so slow?

Accepted Answer

Most slow builds are slow because the cache is being invalidated unnecessarily, not because the work itself is expensive. Each instruction produces a layer, and once one is invalidated every

Question 7

What is the difference between a monorepo and multiple repositories?

Accepted Answer

Whether all of an organisation's code lives in one version-controlled repository or in many — and the trade-off is between coordination cost and isolation, with tooling determining whether either

Related Questions