DevOps / GitHub Actions Interview Questions
How do you write a custom Docker container action for GitHub Actions?
A Docker container action packages its logic and dependencies in a Docker image, giving complete control over the execution environment. It is ideal when your action requires a specific OS, binary tools not available on the runner, or a compiled language without a portable pre-built binary.
action.yml:
name: 'OWASP Dependency Check' description: 'Run dependency vulnerability scan inside Docker' inputs: project-name: description: 'Project name for the report' required: true runs: using: 'docker' image: 'Dockerfile' # build from local Dockerfile args: - ${{ inputs.project-name }}
Dockerfile:
FROM openjdk:21-slim RUN apt-get update && apt-get install -y curl unzip && curl -Lo dc.zip https://github.com/jeremylong/DependencyCheck/releases/download/v9.0.0/dependency-check-9.0.0-release.zip && unzip dc.zip -d /opt && rm dc.zip COPY entrypoint.sh /entrypoint.sh RUN chmod +x /entrypoint.sh ENTRYPOINT ["/entrypoint.sh"]
entrypoint.sh:
#!/bin/bash set -e PROJECT_NAME="$1" /opt/dependency-check/bin/dependency-check.sh --project "$PROJECT_NAME" --scan /github/workspace --format HTML --out /github/workspace/dc-report echo "report-path=dc-report/dependency-check-report.html" >> "$GITHUB_OUTPUT"
Key differences from a JS action:
- Docker container actions always run on Linux — they cannot execute on Windows or macOS GitHub-hosted runners.
- The
/github/workspacepath inside the container is the checked-out repository. - You can also reference a pre-built public image (
image: 'docker://alpine:3.19') instead of a local Dockerfile to skip the build step. - Container build adds latency (~30–60 s) compared to a JS action that starts instantly.
More Related questions...