A water-billing service ships as a container image to OKE. Laptop unit tests pass, but production pods fail on missing CA material and a non-root USER. What should CI exercise?
Select an answer to reveal the explanation.
Short Explanation
Citizens get the image that runs on OKE, not the laptop JDK. Running that same container in CI catches USER, port, and CA-bundle drift before deploy.
Full Explanation
Citizens are served by the container image that lands on OKE, not by the developer’s laptop JDK. CI should therefore run the same shippable image—or a Function-shaped container—so environment drift such as non-root USER, exposed ports, and missing CA bundles appears before deploy. Laptop unit tests can pass while the image still lacks trust material or runs as the wrong user; exercising the artifact closes that gap.
Testing only the developer language runtime on the laptop fails by concept: language-runtime green does not prove image layers, USER directives, or CA bundles. Quizzing Dockerfile instruction trivia without running any container fails because memorizing syntax does not execute the built image. Treating an OCI DevOps pipeline redesign exam objective as the sole verification of the image fails as well—pipeline architecture knowledge is not a runtime probe of the serving artifact.
Exam caveat: “test the thing you ship” means the container (or Function package), not only host-side unit tests. Operational check: in CI, build the image, run it with a non-root USER as in production, hit a health or business path that needs TLS to a dependency, and fail the job if CA material or USER assumptions break.