How would you version and promote container images, and how do base-image security patches reach a running service?

I define patch SLAs and an emergency rebuild path even when application code has not changed. Image signing or attestations let the deployment gate verify trusted provenance. Multi-architecture manifests require digest awareness because the index and platform images have different identities. Rollback references a previously verified digest, but I still check schema and external-contract compatibility. I monitor which digest each instance runs so partial rollouts, stale nodes, and unauthorized images are visible rather than inferred from a tag.