Does your organization follow an immutable infrastructure approach for container deployments by replacing rather than updating existing container instances when updates are required?

Immutable infrastructure is a security best practice where container instances are never modified after deployment. Instead, when updates are needed, new container instances are built from updated images and deployed to replace the existing instances. This approach reduces configuration drift, improves reliability, and minimizes the attack surface by ensuring all containers are built from known, verified images.

Evidence of this practice could include: container orchestration configuration files (e.g., Kubernetes deployment manifests) that specify image update strategies, CI/CD pipeline configurations showing image build and deployment processes, or documentation of container lifecycle management procedures that explicitly prohibit in-place updates.