Make Launches Predictable: A Practical CI/CD Checklist for Containerized Apps

Containerized apps ship fast, and they fail in familiar, predictable ways: an image tagged latest, a dependency with a known CVE that slips past testing, a canary that never gets rolled back. Containerization fixes the packaging problem; CI/CD fixes the process problem. This checklist is the set of controls that turns a containerized codebase into a predictable release pipeline — from source control to vulnerability scanning — with the two hsecurities.in guides as the running examples.## TL;DRA predictable containerized release is a chain of small, verified steps: branch discipline, content-tagged images, tiered testing, progressive delivery, and mandatory vulnerability scanning before promotion.## 1. Source control and branching- Never allow direct commits to main or production. Use GitFlow or Trunk-Based Development; every change lives on its own feature branch.- Require pull requests against the main branch, with automated builds triggered by every PR. The PR itself is the first quality checkpoint.## 2. Automated image building and versioning- Build images in CI with clean, multi-stage Dockerfiles; keep the final image small and reproducible.- Tag production images by content, not by mutable tags: semantic versioning (v1.2.3) plus the Git commit SHA. Never push or deploy an image tagged latest to production.## 3. Tiered testing- Enforce a high unit-test coverage threshold (80% + is a sensible starting point); fail the build if coverage drops.- Run integration tests against ephemeral, production-like dependenc