\

Application Requirements

A deployable application should satisfy the GWEB application contract defined for its tenant/environment.

At minimum, expect the deployment model to require or validate:

an approved application identity;
an approved environment;
an immutable container image digest;
a permitted image registry/repository;
application ownership;
valid runtime configuration;
health/readiness expectations where configured;
resource settings within platform policy.

Immutable images

Prefer:

text

ghcr.io/example/application@sha256:<digest>

Do not treat mutable tags such as latest as a production-quality release identity.

Restricted Kubernetes controls

Tenant deployment does not imply arbitrary control over:

privileged containers;
host networking;
host paths;
arbitrary node ports;
arbitrary namespaces;
cluster-wide RBAC;
production mutation.