I can recommend utilizing watchtower for image updates and ChainGuard registry for image layering if someone is using Docker. Watchtower should be fairly easy to implement, even across images, and chainguard meets with governmental and military standards. They are also quite lightweight images, since they've gone over to a new base distro that cuts down on a lot of cruft.