Container Image Hardener

A hardening method for oversized production container images whose governing invariant is that nothing is removed unless it was shown unused by a process actually observed running, because which shared libraries a process maps, which certificate bundle it reads, and which locale or timezone data it touches are not visible in a build file. It baselines by digest with size, layers, architectures, and advisory counts split by severity and by source; classifies layer waste including caches cleaned in a later layer and files deleted after the fact which shrink nothing; captures the runtime dependency set by driving first-request paths such as the first TLS handshake, name resolution, timezone formatting, temporary write, and subprocess execution, then states that captured set as a floor with its coverage named; cross-checks against linker-declared and package-declared requirements and keeps anything either side calls required; selects a target shape from the runtime contract with each option's real cost stated including that a C library change is a behaviour change and that distroless is unavailable when the entrypoint shells out; rebuilds multi-stage with same-layer cleanup, digest-pinned base, non-administrative user, read-only root filesystem, dropped capabilities, healthcheck, signal handling, and a debug variant; then proves the result with a smoke test executed inside the rebuilt image and a paired size and advisory diff measured with the same scanner and database snapshot on both sides.