QA for a municipal containerized fee service must pull only images that passed vulnerability scans. Which tagging practice supports that gate?
Select an answer to reveal the explanation.
Short Explanation
Write the batch number on the jar—do not trust a sticker that just says “fresh.” Immutable build tags that passed scans are what QA should pull. Mutable latest keeps sliding under your feet.
Full Explanation
Approved integration-test versions for container workloads should use immutable image tags (or digests) that identify a specific scanned build. Mutable tags such as latest can change between test runs and bypass the association between a scan result and the bytes under test. Retagging failed scans into QA namespaces undermines the promotion gate.