City Linux automation runners need a container base image policy. Which practice best matches a minimal trusted base image approach?
Select an answer to reveal the explanation.
Short Explanation
Keep the runner pantry small and from a trusted grocer—use a minimal, maintained base image and skip unused packages. Less junk means less attack surface on city automation hosts.
Full Explanation
City Linux automation runners should follow a minimal trusted base image policy. Prefer a minimal, maintained base image from a trusted source and avoid bloating the runner with unused packages. Smaller trusted images reduce attack surface, shrink patch scope, and improve build reproducibility for municipal automation hosts. Pulling unverified community images that bundle unnecessary desktop packages by default expands CVE exposure and includes components runners do not need. Building runners from random laptop snapshots without provenance yields unreproducible, unauditable images that may contain personal tools, secrets, or malware. Disabling image updates permanently after the first successful pull freezes known vulnerabilities in place and contradicts maintained-base hygiene. Exam caveat: 'minimal' does not mean unpatched—subscribe to base-image updates from the trusted publisher, scan images in CI, and rebuild runners on a cadence even when application code is unchanged. Operational check: inventory packages in the chosen base versus a bloated alternative, confirm the image comes from the approved registry and publisher, run CIS or vulnerability scans, and verify city automation jobs still function on the minimal runner before retiring older fat images.