Most of the container incidents I've helped clean up didn't come from anything exotic. They came from small shortcuts that felt reasonable on a Tuesday and turned into a bad Friday. A latest tag here, a manual build there, one image doing three jobs, and eventually something drifts or breaks and nobody can say for certain what's actually running.
The teams that stay calm in production aren't the ones with the fanciest container tooling. They're the ones with a handful of dull, non-negotiable habits. None of these are clever. That's the point — clever doesn't survive an on-call rotation, but boring discipline does. Here's the set I've settled on, and for each one, the specific failure it's meant to prevent.
1. Pin everything
This is the first habit because it prevents the most failures. Every input to your build should be a specific, named version — the base image, the packages, the dependencies.
# Not this
