Question

Your team uses Cloud Build to build container images that are pushed to a Docker repository in Artifact Registry. After a recent incident, an engineer accidentally re-pushed a new image using an existing tag (v1.4.2) that had already been deployed to production, causing confusion about which binary was actually running. You need to guarantee that once a tagged image is published, that exact tag can never be overwritten by a later push, while still allowing new tags. What should you do?

Accepted Answer

Enable immutable image tags on the Artifact Registry repository so that pushing an already-existing tag is rejected.

Answer

Configure a cleanup policy on the repository to delete images older than 30 days to prevent tag reuse.

Answer

Add a Cloud Build step that runs a shell script to check whether the tag exists and fails the build if it does.

Answer

Enable Binary Authorization with a require-attestation policy so unverified image pushes are blocked.