base image

software component image

both should be version pinned for auditing