LEARN. PRACTICE. GROW.The final stage needs an execution contract
An inter-stage COPY transfers selected paths. It does not guarantee that libraries, CAs, configuration and permissions required by the program exist at the destination. In the fictional workshop, the API starts but fails its HTTPS query because the approved CA remained in an earlier stage. Define the contract with development and RUN: user, writable paths, dependencies, integrations and functional criteria. Fix the maintained image and repeat the journey. A manual change only to the test instance separates the observed result from the artifact that will be promoted.
Argument scope and desired platform
A global ARG does not automatically become available in every stage. Where needed, consume it in that scope and confirm where it influences construction. If the builder runs on one architecture and the destination on another, distinguish BUILDPLATFORM from TARGETPLATFORM and pass the correct options to the compiler. Support depends on the program, tools and dependencies; changing a tag does not convert machine instructions. Record how the binary was produced and which platform was rehearsed. Declaring a target intention does not replace observing the actual result.
Index and variant have different identities
An OCI index can reference several manifests with platform descriptors. In the fictional sheet, index I contains children A and B for amd64 and arm64 respectively. Testing B on a laptop does not establish A on the cluster. Preserve the link between index, selected manifest, platform and acceptance results. Different digests for these objects are expected and do not alone prove tampering. The change owner should explain which object was tested, which will be used and what evidence is missing so Business and RUN understand readiness.
Provenance informs change review
An attestation can describe build materials and parameters. Its presence is not sponsor authorization, a functional rehearsal or a guarantee of no vulnerabilities. Review the object it concerns, the evidence origin and applicable criteria. In mode=max, build-argument values can be exposed; the design should avoid credentials through that mechanism. If exposure occurred, assess already published artifacts as well as fixing the next build. During handover distinguish available evidence, confidence in that evidence and validations still required for the service to meet its acceptance conditions.
Promotion should preserve the approval link
In the exercise, release-42 moved after approval. Compare resolved identity with the recorded digest and address the mismatch before distribution. Another sheet describes a registry copy that changed the digest and did not preserve the expected attestation. Investigate representation, export and support for required objects without concluding equivalence from naming or tampering from difference alone. If transformation is legitimate, document correspondence and apply reassessment criteria. The aim is an understandable chain connecting content, testing, approval and operational destination for the people accountable for the release.
Readiness and English handover workshop
Prepare a fictional change meeting with three decisions: a CA missing from runtime, an amd64 variant without rehearsal and a digest mismatch in the destination registry. For each, present impact, evidence, owner and next step. An approaching window does not turn a gap into a positive result. Use a short handover: “The approved index is pinned, but the production variant has not passed the functional journey.” Also record operational dependencies and reversal plans. These cases are original; build and runtime rehearsals still need execution in a suitable isolated environment.
Fictional sheet: index I → A (amd64), B (arm64); only B was rehearsed. Production selects A. Pinning I preserves identity, but readiness of A needs its own evidence.
Common pitfalls
Approving by tag; confusing index with child manifest; treating provenance as testing or authorization; fixing only the rehearsed instance; disabling TLS to meet the window.
Related topics: Build and distribution · Compose and privileges · Data, persistence and validated recovery
Promotion connects an identified artifact with its destination and acceptance evidence. If content, variant or dependencies change, make the difference explicit before deciding.
Reference: OCI Image Index Specification v1.1.1 · Docker Engine Linux containers, BuildKit and Compose; official documentation consulted 2026-09-30; version-dependent behavior explicitly scoped