This image is a minimal standalone proof of concept, not a secure cluster configuration. It contains static etcd and etcdctl binaries in a scratch filesystem and runs as numeric user and group 65532:65532.

• Use a uniquely named disposable container.
• Use --network none for version and single-member smoke checks.
• Keep test data in the container's writable layer and remove the container afterward.
• Do not mount host paths, named volumes, snapshots, backups, or existing etcd data into the smoke container.
• Do not publish client or peer ports during the standalone smoke test.

The make image-smoke target follows these constraints and communicates with the test member only through docker exec on its loopback endpoint.

A real deployment requires an independently reviewed configuration for:

• mutually authenticated client and peer TLS;
• certificate issuance, rotation, and file permissions;
• network policy and restricted port exposure;
• authenticated client access and least-privilege credentials;
• encrypted, access-controlled backups and tested restores;
• storage ownership for numeric user 65532;
• resource limits, monitoring, alerting, compaction, and defragmentation; and
• version-specific upgrade, downgrade, and quorum procedures.

The final image has no shell or CA bundle. Operators must supply explicit certificate paths and a writable data location when those are required. Do not work around permission failures by defaulting to a privileged container.

The build verifies the upstream tag's full commit ID and the SHA-256 checksum of the downloaded Go archive. The upstream source's go.sum and -mod=readonly constrain Go module resolution. A build-only golang.org/x/text v0.39.0 override is applied to the server, etcdctl, and etcdutl modules; both checksum-database records and the dependency license hash are verified before compilation. These controls do not replace dependency vulnerability review, SBOM generation, signature verification, or release-time provenance attestations.

The repository root license has an unresolved integrity defect. Follow LICENSE-STATUS.md; do not silently repair, reinterpret, or replace that file during an image build.