Describe how containers may be used as an application artifact

[craigtracey]

Describe how containers may be the consistent artifact type for all of a developer's applications.

• language agnostic
• standardized format
• all runtime dependencies are bundled in

Demonstrate the ways in which containers help us to achieve various aspects of a secure software supply chain.

• How do I ensure that the dependencies don’t change/change minimally?
  • How do layers help here?
• What are the best practices for building and tagging container images?
  • Just using “latest” is a bad practice
  • How can labels help here?
• Describe how images may be signed to ensure only official images may be launched at runtime
• What diligence should a developer/operator perform on third-party images?
  • Scan for CVEs?
  • Utilize known-good base images
  • Continually update known-good list of base images and ensure that developers are utilizing only these images

[joemoore]

@craigtracey is this in flight or should it be moved back to the "To Do" column of the backlog?