containers

Scope

Covers the container artefacts a repository owns and the runtime behaviour they declare: Dockerfiles and the build that produces an image, image hardening and supply-chain metadata, Compose files for local development, Kubernetes workload manifests, Helm charts and Kustomize overlays, devcontainer.json, and the diagnosis of a workload that will not start or will not drain.

Written against Docker Engine 29 with BuildKit, the Compose Specification as shipped in Compose v5, Kubernetes 1.37 (current stable), Helm 4 and Kustomize 5. Rules needing a server newer than 1.29 carry a gate such as (1.33+).

Not covered: