enforcements:
  - path: variants.production.base
    rule: oneof=debian:jessie debian:jessie-slim
  - path: variants.production.runs.insecurely
    rule: isfalse