4. Container images and registries

Create reproducible OCI images with Dockerfiles or equivalent build tools, then tag, scan, and publish them to a registry. Image layers, digests, architectures, and pull policies explain what Kubernetes eventually runs.