Title: Discussion 3 — Small, Versioned, and Verified: Image Practices in Production
Course: AIINFRA 101: Applied Infrastructure & Containerization > Section: Week 03 — Building AI Images with Dockerfiles: Multi-Stage & Image Security

💬 Discussion 3 — Small, Versioned, and Verified: Image Practices in Production (20 pts)

Imagine you're on a team running an AI inference service in production, deploying updated container images multiple times a week across a fleet of servers (and maybe a few GPU nodes at the edge), some of those images pulled from a public registry. Prompt: What combination of build and registry practices from this week would you insist on before any image reaches production, and why? Ground your answer in at least two specific techniques from the lecture — for example, multi-stage builds or non-root users (for size/attack surface), and semantic version tags, digest pinning, or Trivy/Grype scanning with a CI severity gate (for trust). Consider deployment speed, storage/bandwidth costs, and how the March 2026 Trivy supply-chain compromise should change how much you trust even your own security tooling. Post your initial response (150+ words), then respond to at least two classmates, engaging with a technique or tradeoff they raised that you didn't cover in your own post.