An image comes from an unknown public registry. What should happen before production admission?

1. Verify provenance, integrity and applicable vulnerability policy
2. Trust the image solely because its tag says stable
3. Grant it privileged mode to avoid startup errors
4. Skip review if the compressed download is small