Canonical catalogue of security requirements for containers and images (CNT-001 to CNT-012), with applicability by risk level and acceptance criteria for the selection of base images, hardening, signing, scanning, runtime policies and access to registries.
Minimisation, hardening and effective verification of permissions in images and containerised environments
Selection, hardening and validation of secure base images for containers
Operational patterns for serving self-hosted AI models (vLLM, Ollama, TGI, llama.cpp, NVIDIA Triton) — workload isolation, weight management, protection of inference, AI-specific container hardening.