SnowPro Specialty: Gen AI Question 201
Single answerDocker imagesA data science team is deploying a custom inference service for a GenAI workload in Snowflake Container Services. The service uses a Docker image that includes Python dependencies, tokenization libraries, and model-serving code. During testing, deployments are slow and security review flags the image as unnecessarily large and difficult to patch. The team wants to improve startup time, reduce attack surface, and make future updates easier without changing application behavior. Which action is the BEST recommendation?
- A
Rebuild the container using a smaller, production-focused base image and a multi-stage Docker build so only runtime artifacts are included in the final image
- B
Keep the current image but add more CPU and memory to the container service so the larger image can be pulled and started faster
- C
Bundle development tools, debugging packages, and test datasets into the same production image so operational troubleshooting is easier after deployment
- D
Create a single monolithic image that contains multiple model versions and all optional Python libraries to avoid rebuilding images later
Show answer and explanation
Correct answer: A
Explanation
The best recommendation is to minimize the Docker image by using a smaller runtime base image and a multi-stage build. This aligns with standard container security and operational best practices: ship only the dependencies and artifacts needed at runtime, avoid build tools in production images, and reduce the number of packages that must be maintained and patched. In Snowflake Container Services scenarios, this is especially practical because image size affects deployment efficiency and maintainability. Candidates should recognize that Docker image optimization is not just about storage savings; it directly affects startup time, security posture, and operational simplicity for GenAI inference services. Relevant best practices are consistent with Docker guidance on multi-stage builds, minimizing base images, and reducing attack surface in production containers.
- A. Correct.
Correct. A smaller base image combined with multi-stage builds is a standard Docker best practice for production workloads. Multi-stage builds let the team compile or assemble artifacts in one stage, then copy only the required runtime files into the final image. This reduces image size, lowers pull time, minimizes the number of packages that need patching, and decreases the attack surface. For Snowflake Container Services deployments, smaller images also help improve service startup efficiency because less data must be transferred and initialized.
- B. Incorrect.
Incorrect. Increasing compute resources does not address the root problem: the image itself is oversized and includes unnecessary content. Image pull time and security exposure are primarily affected by image composition, not just by CPU or memory settings. While additional resources may help runtime performance in some cases, they are not the best remediation for slow deployments caused by bloated Docker images.
- C. Incorrect.
Incorrect. Including development tools, debug packages, and test data in a production image is a common anti-pattern. It increases image size, expands the attack surface, and complicates vulnerability management. Troubleshooting needs should typically be addressed through separate debug images, logs, metrics, or controlled diagnostics rather than by shipping unnecessary tooling in the production runtime image.
- D. Incorrect.
Incorrect. A monolithic image with multiple model versions and optional libraries makes the image larger, harder to patch, and more difficult to maintain. It also increases the risk that unused dependencies introduce vulnerabilities. Best practice is to keep images purpose-built and minimal, packaging only what is needed for the specific service version being deployed.