Before deploymentImages

Checklist: Container image production readiness

10 items ·3 critical ·4 warn ·3 info

Procedure

For each item:

Container runs as non-root.

docker image inspect IMAGE --format "{{.Config.User}}"

No secrets in image layers (verified with docker scout or trivy).
```
trivy image --severity CRITICAL --secret IMAGE
```

No CRITICAL or HIGH CVEs at publish time.

trivy image --severity HIGH,CRITICAL --exit-code 1 IMAGE

Base image is small and supported (distroless, slim, or alpine).
```
docker image inspect IMAGE --format "{{.Config.Image}}"
```

HEALTHCHECK directive is present in the Dockerfile.

docker image inspect IMAGE --format "{{json .Config.Healthcheck}}"

Image declares only the capabilities it needs.

docker run --rm IMAGE cat /etc/ld.so.cache > /dev/null

Image is signed (Cosign or Docker Content Trust).
```
cosign verify IMAGE 2>&1 | head -5
```

Image is designed to run with --read-only root filesystem.
```
docker image inspect IMAGE --format "{{.Config.User}}"
```
Base image and packages pinned to specific versions.
```
docker image history --no-trunc IMAGE | head -10
```
Multi-arch image is published for amd64 and arm64.
```
docker manifest inspect IMAGE
```