Container packaging: pin the tested image

Current snapshot

Follow an artifact from test to launch

This offline experiment separates a registry name, an image index and a platform-specific image. A fictional test record covers only the A image for linux/amd64. Index A describes both amd64 and arm64 children, which have different digests. Index B describes only an amd64 child. The repeated hexadecimal strings are illustrative identifiers, not hashes calculated from container bytes. Eight events reveal how a release resolves a reference, chooses a platform, checks evidence and decides whether to launch. No Docker daemon, registry, shell command or container is used.

Choose a reference and a registry change

Reference selects a pinned index-A digest or the mutable latest tag. Registry state has three fixtures: unchanged leaves latest pointing at A; moved points latest at B while retaining A; removed points latest at B and removes A. With the default moved registry, amd64 platform and exact-test gate, a pinned digest reaches the tested A child and is admitted. Switch Reference to tag: the resolved B child lacks a matching test record and is blocked. Change the gate to observation only and the same untested B child is admitted. The model resolves the tag once and retains that resolved index; it does not silently look up latest again at launch.

Pinning has platform and availability boundaries

Platform selects linux/amd64 or linux/arm64. Keep a pinned A index but choose arm64: resolution succeeds, yet the child differs from the tested amd64 artifact. The exact-test gate blocks it; observation only permits it. Now choose tag with the moved registry and arm64: index B has no matching platform descriptor, so both policies block launch. Choose pinned A with the removed registry: fetching fails under either platform and either gate. Pinning an identifier does not make the referenced object available. The fixture treats removal as complete index unavailability, without modeling cached copies or partially retained layers.

Interpret the gate narrowly

Exact tested artifact requires equality with the one recorded child digest. Observation only bypasses that application policy, but never bypasses a missing index or platform. This is a deliberately small release policy, not Docker behavior or a claim that tests prove an image secure. The single successful test is assumed, not executed. There is no vulnerability scanning, signature verification, provenance verification, mutable base-image rebuild, credential handling, health probe or runtime sandbox. A matching artifact can still be unsafe; an unmatched artifact can be correct but lacks this particular evidence. The model does not support operating systems other than Linux, architecture variants or nested indexes.

Inspect each decision without future results

Play reveals the sixty-second inspection and becomes Pause; Pause freezes it. Next event advances to the next seven-and-a-half-second boundary. Restart rewinds while preserving all choices and speed. Time seeks and pauses. Speed changes inspection pace to quarter, half, normal or double without altering the resolution result. Changing a scenario input resets the inspection and never starts playback automatically. Hiding the tab pauses it. Before an event, its result remains unknown in the snapshot; the final launch status appears only at sixty seconds. These seconds pace a teaching sequence and are not image download or container startup measurements.

Record a reproducible comparison

Export events JSON saves the complete precomputed fixture separately from the inspected prefix. Capture baseline stores the current view and choices; Replace baseline updates it, and Clear baseline removes it. Notebook observations persist in this browser; Export notes saves them. Expand experiment and Exit full screen adjust the view. The event list is keyboard scrollable, and all identifiers are available as wrapping text. Compare pinned versus tag first, then vary one platform or gate choice at a time. The two related readings supply container and deployment context; this simulation focuses on artifact identity and bounded release evidence.