\

Application Requirements

A deployable application should satisfy the GWEB application contract defined for its tenant/environment.

At minimum, expect the deployment model to require or validate:

• an approved application identity;
• an approved environment;
• an immutable container image digest;
• a permitted image registry/repository;
• application ownership;
• valid runtime configuration;
• health/readiness expectations where configured;
• resource settings within platform policy.

Immutable images

Prefer:

ghcr.io/example/application@sha256:<digest>

Do not treat mutable tags such as latest as a production-quality release identity.

Restricted Kubernetes controls

Tenant deployment does not imply arbitrary control over:

• privileged containers;
• host networking;
• host paths;
• arbitrary node ports;
• arbitrary namespaces;
• cluster-wide RBAC;
• production mutation.

Outbound service requirements

If an application needs to call public external services, APIs, AI providers, authentication services, webhooks, or SaaS endpoints, outbound Internet access must be declared through managed application egress.

Do not assume Internet egress is open by default.

For dev/preprod:

gwebc egress show <application> --environment <dev|preprod>
gwebc egress allow <application> --environment <dev|preprod> --protocol https

See ../gwebc/egress.md.