CKAD field manual

k8s Dockerfile example

A Dockerfile is the recipe, an image is the frozen result, a tag says which one. Build once, tag precisely, then kubectl set image or edit the Pod spec to use it — Kubernetes never builds anything for you.

Lava overflows a shattered glass weir. Lava overflows a shattered glass weir.
Dockerfile 
# --- build stage ---
FROM golang:1.23 AS build
WORKDIR /src
COPY . .
RUN go build -o /out/app .

# --- runtime stage ---
FROM gcr.io/distroless/base-debian12
COPY --from=build /out/app /app
USER 1000
ENTRYPOINT ["/app"]
Build, tag, push 
docker build -t registry.example.com/team/app:1.4.0 .
docker push registry.example.com/team/app:1.4.0
docker tag registry.example.com/team/app:1.4.0 registry.example.com/team/app:latest
Point a workload at it 
kubectl set image deploy/app app=registry.example.com/team/app:1.4.0
kubectl rollout status deploy/app
kubectl describe pod -l app=app

Fields

FROM
Base image and its tag. Pin a version — an untagged FROM means :latest, which drifts.
COPY
Plain copy from build context to image. ADD also unpacks tarballs and fetches URLs — use COPY unless you need that.
ENTRYPOINT
The fixed command. CMD is its default args, overridable by the Pod's command/args.
imagePullPolicy
Always re-pulls even if the tag exists locally. IfNotPresent (default unless the tag is :latest) reuses a local copy — stale after a same-tag rebuild.
kubectl set image
Changes a running Deployment's image in place and triggers a rollout — no YAML edit needed.
docker build
-t names and tags in one step. Repeat -t to also apply a :latest alias.
docker push
Needs the registry host in the tag (registry/repo:tag) or it pushes to Docker Hub by default.
ImagePullBackOff
Kubernetes couldn't pull the image — wrong name/tag, a private registry with no imagePullSecrets, or the registry is unreachable.

Watch

  • Never :latest in an exam task — it's the default if you omit a tag, and it silently drifts. Always give an explicit tag.
  • ImagePullBackOff / ErrImagePull almost always means: wrong image name/tag, a private registry with no imagePullSecrets on the Pod or its ServiceAccount, or the registry is unreachable from the node.
  • kubectl set image edits the live object and starts a rollout — no YAML file needed, and it's the fastest fix for a 'change the running image' task.
  • Multi-stage builds only ship the final FROM. Build tools in an earlier stage never reach the runtime image unless you COPY --from= them.

Official docs Dockerfile reference Images

Practice these objects on a live cluster →