# 6.1 — Hardened container image (GREEN)

Phase: 6 — Deploy and cutover
Stage: GREEN

The gateway is the public edge process. It gets no shell, no package manager, no
writable filesystem and no privileges it does not need.

- [ ] The runtime image is distroless or scratch — no shell, no package manager, no busybox
- [ ] The container runs as a non-root user, enforced by `runAsNonRoot` and an explicit non-zero UID
- [ ] The root filesystem is read-only; any writable path the process genuinely needs is an explicitly mounted volume, not a relaxed rootfs
- [ ] All Linux capabilities are dropped, and none are added back
- [ ] `seccompProfile` is `RuntimeDefault`
- [ ] Privilege escalation is disabled
- [ ] Image tags are the commit SHA of the source that built them. Never `:latest`, never a moving tag — Argo `selfHeal` cannot reconcile a mutable tag reliably, and a rollback needs a tag that still means what it meant yesterday
- [ ] The image is reproducible from a committed build definition; nothing is built by hand
- [ ] The image contains no credentials, kubeconfig or service-account token baked in (G2)

## Verify

```bash
docker run --rm --entrypoint sh <image>:<sha>
# expected: fails — no shell in the image

docker run --rm --read-only --user 65532 <image>:<sha> --version
# expected: starts and exits cleanly under a read-only rootfs as a non-root user

docker inspect <image>:<sha> --format '{{.Config.User}}'
# expected: a non-zero numeric UID, not empty and not "root"

grep -rn 'image:' k8s/ | grep -v '@sha256\|:[0-9a-f]\{7,\}'
# expected: no matches — every image reference is pinned to a SHA
```