Pin exact versions with digests for base images

Related rules

From the same buckets as this rule.

• Critical

  Pods must run as non-root with read-only root filesystem

  Set securityContext.runAsNonRoot=true, runAsUser!=0, and readOnlyRootFilesystem=true on pods/containers.

  infra-as-codesecurity-hardening+1
• High

  Add explicit environment variable checks

  Validate required runtime env vars at container start via an entrypoint script; exit with a clear message on missing values.

  config-environmentcontainer-docker-hygiene+1
• High

  Implement multi-stage builds for production

  Use a builder stage for toolchains/dev deps and a minimal runtime stage that contains only runtime artifacts.

  container-docker-hygienesecurity-hardening