A hardened container image, point by point
Non-root user, read-only filesystem, SBOM, signature: what each measure really prevents, in what order to apply them, and what they do not replace.
Tag
Kubernetes
GitOps explained: ArgoCD, desired state in Git, drift corrected
In a GitOps approach, Git describes the desired state and a controller inside the cluster enforces it continuously. At the scale of a small k3s cluster, here is what changes: deployments, rollbacks and drift.