Practice: Containers, CI/CD and serverless delivery
Generated by Claude through GigAI 0.1.11.10 on 2026-10-11.
Main tool: AWS · AWS Lambda lets you practise the whole delivery problem on one small artifact: a container image, an execution role, configuration injected from outside and a pipeline that promotes into an account you do not own. · Alternatives: Google Cloud Run runs any container image and scales to zero with fewer packaging limits; Azure Functions is the closest equivalent for customers on Azure; Kubernetes with Helm, promoted by Argo CD or Flux, fits customers who own the cluster and want pull-based GitOps; Docker with GitHub Actions covers build and pipeline but not hosting; HashiCorp Vault replaces AWS Secrets Manager when secrets must stay cloud-neutral; Sigstore Cosign adds image signing that any of these can verify.
Every step links into the tool's own documentation; links were checked on 2026-10-11 · version 1
Setup (one time)
1. Create or reuse an AWS free tier account and set up credentials for a non-root identity on your laptop; no paid service or GPU is needed for this path.
Every later step signs requests as this identity, and a customer will always hand you a scoped identity, never root.
Explained in: AWS General Reference - AWS General Reference (docs.aws.amazon.com), checked 2026-10-11
Done when: A caller identity query from your terminal prints the non-root identity you created.
2. Install a container runtime and the local Lambda development tooling named in the docs so functions can be built and invoked on the laptop.
Local emulation lets you practise most of the path without touching a cloud account, which mirrors working before the customer grants access.
Explained in: Development tools for Lambda - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: The local tooling prints its version and can pull a Lambda base image.
3. Read the serverless getting started overview to map which guides cover functions, images and deployment.
Knowing where each topic lives in the documentation saves time when a customer environment forces you off the default route.
Explained in: Get started with serverless (docs.aws.amazon.com), checked 2026-10-11
Done when: You can name the guide you would open for packaging, for permissions and for deployment.
Steps
1. Write a minimal function handler that takes a JSON event and returns a JSON reply, then invoke it locally with a sample event.
The handler and its event are the smallest unit everything else wraps, so you need to see one run before packaging it.
Explained in: How Lambda works - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: The local invoke prints your handler's JSON reply for the sample event.
2. Run the handler several times in a row locally and log when initialisation code runs versus when only the handler runs.
The execution environment lifecycle decides where you load model clients and configuration, and it explains cold start latency a customer will ask about.
Explained in: Running code with Lambda - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: Your logs show initialisation once and the handler on every invocation.
3. Package the function as a container image on a Lambda base image, tag it with an immutable version and run that image locally.
The image is the unit of delivery: the same digest must run on your laptop, in your registry and in the customer's registry without a rebuild.
Explained in: How Lambda works - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: The locally running image answers a test invocation and you can read its digest.
4. Create an execution role that can read exactly one customer's secret, and configure the function to take its environment name and secret name from outside the image.
Per customer configuration and secrets must be injected at deploy time so one image serves every environment and no credential is baked in.
Explained in: How Lambda works - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: The same image returns different settings for two environment values and is denied when asked for another customer's secret.
5. Compare Lambda Functions and Lambda MicroVMs for an LLM workload and record which one fits a short tool call and which fits a long agent session.
Choosing the compute shape up front is part of serverless delivery, and writing the comparison down gives you a record to revisit per customer.
Explained in: What is AWS Lambda? - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: You have a saved one page comparison with a chosen option and its reason for each of the two workloads.
6. Write a streaming handler that returns a stubbed LLM answer token by token; deploying it needs the free tier account, so use the local stub of the model call as the laptop substitute.
Token streaming is where serverless meets LLM systems, and its payload and network limits decide whether Lambda fits the use case.
Explained in: Response streaming for Lambda functions - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: A client receives the answer in visible chunks instead of one final payload.
7. Write an asynchronous version of the model call so the function hands off slow work instead of waiting on it inside one invocation.
Long model calls held open inside a function waste paid time and hit timeouts, a known anti-pattern you will be asked to fix.
Explained in: Creating event-driven architectures with Lambda - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: The first function returns immediately and the result arrives through a separate event.
8. Compare Lambda with container services for a customer who mandates their own Kubernetes cluster, and load the same image into a local kind cluster as the laptop substitute for a managed cluster.
Packaging for a customer cluster starts with knowing when serverless is the wrong target and proving the image is portable to it.
Explained in: Choosing an AWS serverless service - AWS Decision Guides (docs.aws.amazon.com), checked 2026-10-11
Done when: The same image digest runs as a pod locally and you have noted which criteria pushed the choice to the cluster.
9. Write an infrastructure as code template that declares the function, its image reference, its role and its per customer parameters.
A template makes the deployment reproducible in an account you cannot click around in and turns customer differences into parameters.
Explained in: Development tools for Lambda - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: Deleting the stack and deploying the template again with one parameter file recreates the identical function.
10. Create a GitHub Actions workflow that builds the image, publishes it by digest and deploys the template on every merge.
The vendor side pipeline must produce an artifact a customer pipeline can promote without rebuilding, so automation ends at a pinned digest.
Explained in: Development tools for Lambda - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: A merge produces a green workflow run and the deployed function reports the digest that run published.
11. Configure a resource-based policy that lets a second identity, standing in for the customer's pipeline account, invoke and promote the function; use a second role in the same account as the laptop substitute.
Crossing the vendor and customer boundary is done with explicit grants on the resource, never by sharing your own credentials.
Explained in: How Lambda works - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: The second identity can invoke the function and is denied again once the policy statement is removed.
12. Write a governance strategy for your functions and layers that states the preventive and detective controls a customer would enforce, then apply one control and trigger it.
In production the customer's guardrails decide what you may deploy, so rehearsing against them is the closest thing to their environment.
Explained in: Create a governance strategy for Lambda functions and layers - AWS Lambda (docs.aws.amazon.com), checked 2026-10-11
Done when: A deployment that breaks your chosen control is blocked or flagged and a compliant one passes.