Pin and slim the base image
A base image that can change without warning, replaced with a fixed, smaller one, with size and known issues measured.
The ticket
Pin the base image to a digest and move to a slimmer variant.
Acceptance criteria
- The base image is pinned by digest, not by a floating tag
- A slimmer variant is used where it still works
- Size and advisory count are recorded before and after
- A smoke test passes against the new base
What lands as proof
Size and advisory counts either side, plus a smoke test proving the slim variant still runs the application.
Why teams defer it
- A floating tag works until it silently changes underneath a build.
- Slim variants drop system packages that something quietly depended on, so the failure appears at runtime.
Questions
- What does the agent actually change?
- The ticket is scoped to one outcome: pin the base image to a digest and move to a slimmer variant. Work that serves that outcome is in scope, and anything outside it is left for a separate ticket, so the pull request stays reviewable.
- How do I know the work is done?
- The pull request carries the evidence, not only the diff. Here that means size and advisory count before and after, so a reviewer can confirm the result without reproducing the work locally.
- How much oversight does this need?
- The run stops once the plan is written. Somebody reads the approach and approves it before any code exists, which is the cheapest moment to redirect the work.