containerize

# Containerize an Application Build a small, non-root, reproducible OCI image and verify it before it ships. Pairs with [k8s-local](../k8s-local/SKILL.md) for the local dev loop and [security-scan](../security-scan/SKILL.md) for image scanning. ## Choose an Approach 1. **Go → `ko` (default, no Dockerfile)**: builds a minimal, shell-less, multi-arch, reproducible image straight from a package path (base defaults to `cgr.dev/chainguard/static`, override with `KO_DEFAULTBASEIMAGE`). Pin it per project (`go get -tool github.com/google/ko`, then `go tool ko`) so builds stay reproducible even where a global toolchain already provides `ko`. ```bash export KO_DOCKER_REPO=registry.localhost:5050/<slug> # or a real registry go tool ko build ./cmd/<slug> --bare --platform=linux/amd64,linux/arm64 ``` 1. **Python (or any other language) → multi-stage Dockerfile** on a distroless or minimal base (optimized with `uv`). Copy and customize the image digests and the `<slug>` console-script entry point: - [Dockerfile](references/Dockerfile) - [.dockerignore](references/.dockerignore) ```bash # Build locally for current platform docker build -t <registry>/<slug>:<tag> . # Build multi-platform using Buildx (recommended for multi-arch registries) docker buildx build --platform linux/amd64,linux/arm64 -t <registry>/<slug>:<tag> --push . ``` ## Verify Before Ship 1. **Scan** the built image (fail on HIGH/CRITICAL — see [security-scan](../security-scan/SKI...