Before you begin: Complete Using the Index testing tool. Run through this checklist last, immediately before your first push.
Your container image is not eligible for auto-deployment until all three of the following are satisfied.
1. It must follow the artifact naming conventions
The image tag and the S3 folder name must be compliant with the Artifact naming conventions and deployment regions: a CalVer version, plus an optional annotation, plus an optional single deployment region suffix (_AMS, _EMEA, or _APAC).
Note: This is not a pass/fail check like #2 and #3. A tag that doesn't match the required format produces no deployment event at all. The upload is silently ignored and not rejected with a visible failure. If a partner uploads an image and "nothing happens," this is almost always why.
Includes deployment region: omitting the region suffix deploys everywhere, and a global (no-suffix) upload will overwrite an existing region-specific deployment. See Artifact naming conventions and deployment regions for the full format, region definitions, and examples.
2. It must pass a vulnerability scan
Index scans every image automatically once it's pushed, and blocks deployment if any component in it scores 9 or higher on CVSS. Catch this yourself first, so a failed scan doesn't hold up your deployment.
Run a vulnerability scanner against your image. For example:
trivy image yourrepo/yourimage:2026.07.10.2.Confirm nothing comes back scored 9 or higher on CVSS.
If your image fails the Index scan during deployment, a Grafana log entry is made naming the specific component(s) that need to be updated.
3. It must expose the required endpoints
The container must expose the endpoints described in Building a Docker container:
The gRPC health check protocol (
grpc.health.v1.Health) onGRPC_PORTThe HTTP metrics endpoint
A URL which is configured to interact with a server in a specific way. (/metrics, Prometheus format) onSERVER_PORT
Verification happens in two steps, in order:
Locally, first, using the ARTF reference tools with no Index involvement required. See the Familiarize yourself with ARTF section in Validating a container.
Final validation with Using the Index testing tool, which sends sample requests to your container against a live-like environment. This will not send any test traffic at all until the health check and metrics endpoint above both pass.
See also
Building a Docker container: The full requirements this checklist is drawn from
Artifact naming conventions and deployment regions: The full naming spec for gate #1
Deploying your services to Index Cloud: What happens once your image clears these gates
Using the Index testing tool: Validation tool referenced in gate #3
