Explain container image flow in CI/CD

Scenario

Outline what occurs in a typical CI/CD pipeline that builds and deploys a containerized service.

Questions

1. During CI, what happens when a container image is built (layers, cache, build context)?
2. How does the image get tagged and pushed to a registry?
3. What happens when runtimes/nodes pull the image (auth, caching, digests)?
4. Which security checks should be part of the pipeline (scanning, SBOM, signing)?
5. What are the common failure modes, and how can you mitigate them?

Overview: This question tests familiarity with the container image lifecycle across CI/CD pipelines, spanning build mechanics (layers, cache, build context), tagging and registry interactions, image distribution and pull behavior (authentication, caching, digests), security controls (vulnerability scanning, SBOM generation, signing), and common failure modes. It is frequently posed to assess operational and security competence in the Software Engineering Fundamentals/DevOps domain and evaluates both conceptual understanding and practical application of pipeline design and runtime image management.