For containers, do you often "encourage" common development on same base images? Ex. I come from Java environments where they'd have license agreements with Oracle, so someone would pull JDK into a file server, then they'd (often someone else) build an image from that. But it was never automated to always have the latest version of that available (rarely mattered for minor patches), but it was still a multi day bottleneck compared to just pulling any of the publicly available Java images

Hey Jordan what do you mean by common development? For us it depends on dev or stg/prd, we have images with dev tools (a shell, curl, etc..) but in prod a base minimal image is used.

Company wide adoption. I see no reason to allow different images in different environments. If someone needs a shell & curl, they can install themselves and therefore should understand the risks

Sure that is a valid approach, for us we have gateways in our gitlab pipelines where for certain releases a certain base image needs to be used. In dev everything is short lived and meant for developers to try things outs so from an ops perspective I would rather control what’s on those images rather than allow developers to just install things on them. It allows us some level of control over dev rather than it just being the Wild West.

Sure, we integrated trivy-scan into the CICD pipeline, but we didn't enforce the images used, or even the pipeline steps itself (forking and removing the cve scan could be done to deploy to prod faster).

we build our development images in such a way that the components are the same as production. That way we follow the path of least surprise. we even have a suite of containers that allow us to authenticate using our authentication proxy the same way as our sso in production works. Works on my machine is not just a description related to code. It is a description related to the solution

I'm not sure that answered my question? Any build should be productional; runtime operation can be modified

What I meant is that we're using the same images for development the as production the only difference is that I allow for hot reloading by mounting my source folder into the development image. Every service implementation I have is the same and every image I have as well

if you're not using Chainguard by now just give up

I agree but that was not the question.

Chainguard doesn't use Oracle JDK so you wouldn't get enterprise JVM support