diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 8f5c8c5..3af99ba 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -3,8 +3,22 @@
 # These owners will be the default owners for everything in the
 # repo. Unless a later match takes precedence, these owners will be
 # requested for review when someone opens a pull request.
-* @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
+* @dav3r @felddy @jsf9k @mcdonnnj
 
 # These folks own any files in the .github directory at the root of
 # the repository and any of its subdirectories.
-/.github/ @dav3r @felddy @jasonodoom @jsf9k @mcdonnnj
+/.github/ @dav3r @felddy @jsf9k @mcdonnnj
+
+# These folks own all linting configuration files.
+/.ansible-lint @dav3r @felddy @jsf9k @mcdonnnj
+/.bandit.yml @dav3r @felddy @jsf9k @mcdonnnj
+/.flake8 @dav3r @felddy @jsf9k @mcdonnnj
+/.isort.cfg @dav3r @felddy @jsf9k @mcdonnnj
+/.mdl_config.yaml @dav3r @felddy @jsf9k @mcdonnnj
+/.pre-commit-config.yaml @dav3r @felddy @jsf9k @mcdonnnj
+/.prettierignore @dav3r @felddy @jsf9k @mcdonnnj
+/.yamllint @dav3r @felddy @jsf9k @mcdonnnj
+/requirements.txt @dav3r @felddy @jsf9k @mcdonnnj
+/requirements-dev.txt @dav3r @felddy @jsf9k @mcdonnnj
+/requirements-test.txt @dav3r @felddy @jsf9k @mcdonnnj
+/setup-env @dav3r @felddy @jsf9k @mcdonnnj
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 61116c3..7efa6ee 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -18,13 +18,17 @@ updates:
       - dependency-name: actions/checkout
       - dependency-name: actions/setup-go
       - dependency-name: actions/setup-python
+      - dependency-name: cisagov/setup-env-github-action
       - dependency-name: crazy-max/ghaction-dump-context
       - dependency-name: crazy-max/ghaction-github-labeler
       - dependency-name: crazy-max/ghaction-github-status
+      - dependency-name: GitHubSecurityLab/actions-permissions
+      - dependency-name: hashicorp/setup-packer
       - dependency-name: hashicorp/setup-terraform
       - dependency-name: mxschmitt/action-tmate
       - dependency-name: step-security/harden-runner
       # Managed by cisagov/skeleton-docker
+<<<<<<< HEAD
       - dependency-name: actions/download-artifact
       - dependency-name: actions/github-script
       - dependency-name: actions/upload-artifact
@@ -33,6 +37,16 @@ updates:
       - dependency-name: docker/setup-buildx-action
       - dependency-name: docker/setup-qemu-action
       - dependency-name: github/codeql-action
+=======
+      # - dependency-name: actions/download-artifact
+      # - dependency-name: actions/upload-artifact
+      # - dependency-name: docker/build-push-action
+      # - dependency-name: docker/login-action
+      # - dependency-name: docker/metadata-action
+      # - dependency-name: docker/setup-buildx-action
+      # - dependency-name: docker/setup-qemu-action
+      # - dependency-name: github/codeql-action
+>>>>>>> 7a5cddf2432f7e49c0f775066739b9464ad66332
     package-ecosystem: github-actions
     schedule:
       interval: weekly
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1a2df04..01341bd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,45 +2,70 @@
 name: build
 
 on:
+  merge_group:
+    types:
+      - checks_requested
+  pull_request:
   push:
     branches:
       - "**"
     tags:
       - "v*.*.*"
-  pull_request:
-  schedule:
-    - cron: "0 10 * * *"  # everyday at 10am
   repository_dispatch:
     # Respond to rebuild requests. See: https://github.com/cisagov/action-apb/
-    types: [apb]
+    types:
+      - apb
+  schedule:
+    - cron: "0 10 * * *"  # everyday at 10am
   workflow_dispatch:
     inputs:
-      remote-shell:
-        description: "Debug with remote shell"
-        required: true
-        default: "false"
       image-tag:
+        default: "dispatch"
         description: "Tag to apply to pushed images"
         required: true
-        default: "dispatch"
+      remote-shell:
+        default: "false"
+        description: "Debug with remote shell"
+        required: true
+
+# Set a default shell for any run steps. The `-Eueo pipefail` sets errtrace,
+# nounset, errexit, and pipefail. The `-x` will print all commands as they are
+# run. Please see the GitHub Actions documentation for more information:
+# https://docs.github.com/en/actions/using-jobs/setting-default-values-for-jobs
+defaults:
+  run:
+    shell: bash -Eueo pipefail -x {0}
 
 env:
   BUILDX_CACHE_DIR: ~/.cache/buildx
+<<<<<<< HEAD
   CURL_CACHE_DIR: ~/.cache/curl
   IMAGE_NAME: cisagov/postfix
+=======
+  IMAGE_NAME: cisagov/example
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
   PIP_CACHE_DIR: ~/.cache/pip
-  PLATFORMS: "linux/amd64,linux/arm/v6,linux/arm/v7,\
-  linux/arm64,linux/ppc64le,linux/s390x"
   PRE_COMMIT_CACHE_DIR: ~/.cache/pre-commit
   RUN_TMATE: ${{ secrets.RUN_TMATE }}
+  TERRAFORM_DOCS_REPO_BRANCH_NAME: improvement/support_atx_closed_markdown_headers
+  TERRAFORM_DOCS_REPO_DEPTH: 1
+  TERRAFORM_DOCS_REPO_URL: https://github.com/mcdonnnj/terraform-docs.git
 
 jobs:
   diagnostics:
     name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
       # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -48,7 +73,7 @@ jobs:
           egress-policy: audit
       - id: github-status
         name: Check GitHub status
-        uses: crazy-max/ghaction-github-status@v3
+        uses: crazy-max/ghaction-github-status@v4
       - id: dump-context
         name: Dump context
         uses: crazy-max/ghaction-dump-context@v2
@@ -58,8 +83,15 @@ jobs:
     name: Lint sources
     needs:
       - diagnostics
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -69,23 +101,23 @@ jobs:
         uses: cisagov/setup-env-github-action@develop
       - uses: actions/checkout@v4
       - id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ steps.setup-env.outputs.python-version }}
       # We need the Go version and Go cache location for the actions/cache step,
       # so the Go installation must happen before that.
       - id: setup-go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           # There is no expectation for actual Go code so we disable caching as
           # it relies on the existence of a go.sum file.
           cache: false
-          go-version: "1.20"
-      - name: Lookup Go cache directory
-        id: go-cache
+          go-version: ${{ steps.setup-env.outputs.go-version }}
+      - id: go-cache
+        name: Lookup Go cache directory
         run: |
           echo "dir=$(go env GOCACHE)" >> $GITHUB_OUTPUT
-      - uses: actions/cache@v3
+      - uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-\
@@ -93,6 +125,10 @@ jobs:
             packer${{ steps.setup-env.outputs.packer-version }}-\
             tf${{ steps.setup-env.outputs.terraform-version }}-"
         with:
+          key: "${{ env.BASE_CACHE_KEY }}\
+            ${{ hashFiles('**/requirements-test.txt') }}-\
+            ${{ hashFiles('**/requirements.txt') }}-\
+            ${{ hashFiles('**/.pre-commit-config.yaml') }}"
           # Note that the .terraform directory IS NOT included in the
           # cache because if we were caching, then we would need to use
           # the `-upgrade=true` option. This option blindly pulls down the
@@ -102,30 +138,13 @@ jobs:
           path: |
             ${{ env.PIP_CACHE_DIR }}
             ${{ env.PRE_COMMIT_CACHE_DIR }}
-            ${{ env.CURL_CACHE_DIR }}
             ${{ steps.go-cache.outputs.dir }}
-          key: "${{ env.BASE_CACHE_KEY }}\
-            ${{ hashFiles('**/requirements-test.txt') }}-\
-            ${{ hashFiles('**/requirements.txt') }}-\
-            ${{ hashFiles('**/.pre-commit-config.yaml') }}"
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
-      - name: Setup curl cache
-        run: mkdir -p ${{ env.CURL_CACHE_DIR }}
-      - name: Install Packer
-        env:
-          PACKER_VERSION: ${{ steps.setup-env.outputs.packer-version }}
-        run: |
-          PACKER_ZIP="packer_${PACKER_VERSION}_linux_amd64.zip"
-          curl --output ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --time-cond ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}" \
-            --location \
-            "https://releases.hashicorp.com/packer/${PACKER_VERSION}/${PACKER_ZIP}"
-          sudo unzip -d /opt/packer \
-            ${{ env.CURL_CACHE_DIR }}/"${PACKER_ZIP}"
-          sudo mv /usr/local/bin/packer /usr/local/bin/packer-default
-          sudo ln -s /opt/packer/packer /usr/local/bin/packer
-      - uses: hashicorp/setup-terraform@v2
+      - uses: hashicorp/setup-packer@v3
+        with:
+          version: ${{ steps.setup-env.outputs.packer-version }}
+      - uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: ${{ steps.setup-env.outputs.terraform-version }}
       - name: Install go-critic
@@ -133,26 +152,38 @@ jobs:
           PACKAGE_URL: github.com/go-critic/go-critic/cmd/gocritic
           PACKAGE_VERSION: ${{ steps.setup-env.outputs.go-critic-version }}
         run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
+      - name: Install goimports
+        env:
+          PACKAGE_URL: golang.org/x/tools/cmd/goimports
+          PACKAGE_VERSION: ${{ steps.setup-env.outputs.goimports-version }}
+        run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
       - name: Install gosec
         env:
           PACKAGE_URL: github.com/securego/gosec/v2/cmd/gosec
           PACKAGE_VERSION: ${{ steps.setup-env.outputs.gosec-version }}
         run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
-      - name: Install shfmt
-        env:
-          PACKAGE_URL: mvdan.cc/sh/v3/cmd/shfmt
-          PACKAGE_VERSION: ${{ steps.setup-env.outputs.shfmt-version }}
-        run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
       - name: Install staticcheck
         env:
           PACKAGE_URL: honnef.co/go/tools/cmd/staticcheck
           PACKAGE_VERSION: ${{ steps.setup-env.outputs.staticcheck-version }}
         run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
-      - name: Install Terraform-docs
-        env:
-          PACKAGE_URL: github.com/terraform-docs/terraform-docs
-          PACKAGE_VERSION: ${{ steps.setup-env.outputs.terraform-docs-version }}
-        run: go install ${PACKAGE_URL}@${PACKAGE_VERSION}
+      # TODO: https://github.com/cisagov/skeleton-generic/issues/165
+      # We are temporarily using @mcdonnnj's forked branch of terraform-docs
+      # until his PR: https://github.com/terraform-docs/terraform-docs/pull/745
+      # is approved. This temporary fix will allow for ATX header support when
+      # terraform-docs is run during linting.
+      - name: Clone ATX headers branch from terraform-docs fork
+        run: |
+          git clone \
+           --branch $TERRAFORM_DOCS_REPO_BRANCH_NAME \
+           --depth $TERRAFORM_DOCS_REPO_DEPTH \
+           --single-branch \
+           $TERRAFORM_DOCS_REPO_URL /tmp/terraform-docs
+      - name: Build and install terraform-docs binary
+        run: |
+          go build \
+          -C /tmp/terraform-docs \
+          -o $(go env GOPATH)/bin/terraform-docs
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip setuptools wheel
@@ -165,109 +196,46 @@ jobs:
         uses: mxschmitt/action-tmate@v3
         if: env.RUN_TMATE
   prepare:
-    # Calculates and publishes outputs that are used by other jobs.
-    #
-    # Outputs:
-    #   created:
-    #     The current date-time in RFC3339 format.
-    #   repometa:
-    #     The json metadata describing this repository.
-    #   source_version:
-    #     The source version as reported by the `bump_version.sh show` command.
-    #   tags:
-    #     A comma separated list of Docker tags to be applied to the images on
-    #     Docker Hub.  The tags will vary depending on:
-    #     - The event that triggered the build.
-    #     - The branch the build is based upon.
-    #     - The git tag the build is based upon.
-    #
-    #     When a build is based on a git tag of the form `v*.*.*` the image will
-    #     be tagged on Docker Hub with multiple levels of version specificity.
-    #     For example, a git tag of `v1.2.3+a` will generate Docker tags of
-    #     `:1.2.3_a`, `:1.2.3`, `:1.2`, `:1`, and `:latest`.
-    #
-    #     Builds targeting the default branch will be tagged with `:edge`.
-    #
-    #     Builds from other branches will be tagged with the branch name. Solidi
-    #     (`/` characters - commonly known as slashes) in branch names are
-    #     replaced with hyphen-minuses (`-` characters) in the Docker tag.  For
-    #     more information about the solidus see these links:
-    #       * https://www.compart.com/en/unicode/U+002F
-    #       * https://en.wikipedia.org/wiki/Slash_(punctuation)#Encoding
-    #
-    #     Builds triggered by a push event are tagged with a short hash in the
-    #     form: sha-12345678
-    #
-    #     Builds triggered by a pull request are tagged with the pull request
-    #     number in the form pr-123.
-    #
-    #     Builds triggered using the GitHub GUI (workflow_dispatch) are tagged
-    #     with the value specified by the user.
-    #
-    #     Scheduled builds are tagged with `:nightly`.
+    # Generate Docker image metadata using the docker/metadata-action GitHub Action.
     name: Prepare build variables
     needs:
       - diagnostics
     outputs:
-      created: ${{ steps.prep.outputs.created }}
-      repometa: ${{ steps.repo.outputs.result }}
-      source_version: ${{ steps.prep.outputs.source_version }}
-      tags: ${{ steps.prep.outputs.tags }}
+      labels: ${{ steps.generate-metadata.outputs.labels }}
+      tags: ${{ steps.generate-metadata.outputs.tags }}
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
         with:
           egress-policy: audit
       - uses: actions/checkout@v4
-      - name: Gather repository metadata
-        id: repo
-        uses: actions/github-script@v7
+      - id: generate-metadata
+        name: Generate Docker image metadata
+        uses: docker/metadata-action@v5
         with:
-          script: |
-            const repo = await github.rest.repos.get(context.repo)
-            return repo.data
-      - name: Calculate output values
-        id: prep
-        run: |
-          VERSION=noop
-          SEMVER="^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*)(\.(0|[1-9][0-9]*|[0-9]*[a-zA-Z-][0-9a-zA-Z-]*))*))?(\+([0-9a-zA-Z-]+(\.[0-9a-zA-Z-]+)*))?$"
-          if [ "${{ github.event_name }}" = "schedule" ]; then
-            VERSION=nightly
-          elif [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION=${{ github.event.inputs.image-tag }}
-          elif [[ $GITHUB_REF == refs/tags/* ]]; then
-            VERSION=${GITHUB_REF#refs/tags/}
-          elif [[ $GITHUB_REF == refs/heads/* ]]; then
-            VERSION=$(echo ${GITHUB_REF#refs/heads/} | sed -r 's#/+#-#g')
-            if [ "${{ github.event.repository.default_branch }}" = "$VERSION" ];
-              then
-              VERSION=edge
-            fi
-          elif [[ $GITHUB_REF == refs/pull/* ]]; then
-            VERSION=pr-${{ github.event.number }}
-          fi
-          if [[ $VERSION =~ $SEMVER ]]; then
-            VERSION_NO_V=${VERSION#v}
-            MAJOR="${BASH_REMATCH[1]}"
-            MINOR="${BASH_REMATCH[2]}"
-            PATCH="${BASH_REMATCH[3]}"
-            TAGS="${IMAGE_NAME}:${VERSION_NO_V//+/_},${IMAGE_NAME}:${MAJOR}.${MINOR}.${PATCH},${IMAGE_NAME}:${MAJOR}.${MINOR},${IMAGE_NAME}:${MAJOR},${IMAGE_NAME}:latest"
-          else
-            TAGS="${IMAGE_NAME}:${VERSION}"
-          fi
-          if [ "${{ github.event_name }}" = "push" ]; then
-            TAGS="${TAGS},${IMAGE_NAME}:sha-${GITHUB_SHA::8}"
-          fi
-          for i in ${TAGS//,/ }
-          do
-            TAGS="${TAGS},ghcr.io/${i}"
-          done
-          echo "created=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
-          echo "source_version=$(./bump_version.sh show)" >> $GITHUB_OUTPUT
-          echo "tags=${TAGS}" >> $GITHUB_OUTPUT
-          echo tags=${TAGS}
+          images: |
+            ${{ env.IMAGE_NAME }}
+            ghcr.io/${{ env.IMAGE_NAME }}
+          tags: |
+            type=edge
+            type=raw,event=workflow_dispatch,value=${{ github.event.inputs.image-tag }}
+            type=ref,event=branch
+            type=ref,event=pr
+            type=ref,event=tag
+            type=schedule
+            type=semver,pattern={{major}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{version}}
+            type=sha
       - name: Setup tmate debug session
         uses: mxschmitt/action-tmate@v3
         if: github.event.inputs.remote-shell == 'true' || env.RUN_TMATE
@@ -278,8 +246,15 @@ jobs:
     needs:
       - diagnostics
       - prepare
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -292,26 +267,25 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: buildx-${{ runner.os }}-
         with:
-          path: ${{ env.BUILDX_CACHE_DIR }}
           key: ${{ env.BASE_CACHE_KEY }}${{ github.sha }}
+          path: ${{ env.BUILDX_CACHE_DIR }}
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
       - name: Create dist directory
         run: mkdir -p dist
       - name: Build image
         id: docker_build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
-          build-args: |
-            VERSION=${{ needs.prepare.outputs.source_version }}
           cache-from: type=local,src=${{ env.BUILDX_CACHE_DIR }}
           cache-to: type=local,dest=${{ env.BUILDX_CACHE_DIR }}
           context: .
           file: ./Dockerfile
+          labels: ${{ needs.prepare.outputs.labels }}
           outputs: type=docker,dest=dist/image.tar
           # Uncomment the following option if you are building an image for use
           # on Google Cloud Run or AWS Lambda. The current default image output
@@ -321,33 +295,10 @@ jobs:
           tags: ${{ env.IMAGE_NAME }}:latest  # not to be pushed
           # For a list of pre-defined annotation keys and value types see:
           # https://github.com/opencontainers/image-spec/blob/master/annotations.md
-          labels: "\
-            org.opencontainers.image.created=${{
-              needs.prepare.outputs.created }}
-
-            org.opencontainers.image.description=${{
-              fromJson(needs.prepare.outputs.repometa).description }}
-
-            org.opencontainers.image.licenses=${{
-              fromJson(needs.prepare.outputs.repometa).license.spdx_id }}
-
-            org.opencontainers.image.revision=${{ github.sha }}
-
-            org.opencontainers.image.source=${{
-              fromJson(needs.prepare.outputs.repometa).clone_url }}
-
-            org.opencontainers.image.title=${{
-              fromJson(needs.prepare.outputs.repometa).name }}
-
-            org.opencontainers.image.url=${{
-              fromJson(needs.prepare.outputs.repometa).html_url }}
-
-            org.opencontainers.image.version=${{
-              needs.prepare.outputs.source_version }}"
       - name: Compress image
         run: gzip dist/image.tar
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: dist
           path: dist
@@ -360,28 +311,37 @@ jobs:
     needs:
       - diagnostics
       - build
+    permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
         with:
           egress-policy: audit
+      - id: setup-env
+        uses: cisagov/setup-env-github-action@develop
       - uses: actions/checkout@v4
       - id: setup-python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
-          python-version: "3.11"
+          python-version: ${{ steps.setup-env.outputs.python-version }}
       - name: Cache testing environments
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\
             py${{ steps.setup-python.outputs.python-version }}-"
         with:
-          path: ${{ env.PIP_CACHE_DIR }}
           key: "${{ env.BASE_CACHE_KEY }}\
             ${{ hashFiles('**/requirements-test.txt') }}-\
             ${{ hashFiles('**/requirements.txt') }}"
+          path: ${{ env.PIP_CACHE_DIR }}
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
       - name: Install dependencies
@@ -389,7 +349,7 @@ jobs:
           python -m pip install --upgrade pip setuptools wheel
           pip install --upgrade --requirement requirements-test.txt
       - name: Download docker image artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: dist
           path: dist
@@ -403,12 +363,12 @@ jobs:
         uses: mxschmitt/action-tmate@v3
         if: env.RUN_TMATE
   build-push-all:
-    # Builds the final set of images for each of the platforms listed in
-    # PLATFORMS environment variable.  These images are tagged with the Docker
-    # tags calculated in the "prepare" job and pushed to Docker Hub and the
-    # GitHub Container Registry.  The contents of README.md are pushed as the
-    # image's description to Docker Hub.  This job is skipped when the
-    # triggering event is a pull request.
+    # Builds the final set of images for each of the platforms specified in the
+    # "platforms" input for the docker/build-push-action Action.  These images
+    # are tagged with the Docker tags calculated in the "prepare" job and
+    # pushed to Docker Hub and the GitHub Container Registry.  The contents of
+    # README.md are pushed as the image's description to Docker Hub.  This job
+    # is skipped when the triggering event is a pull request.
     if: github.event_name != 'pull_request'
     name: Build and push all platforms
     needs:
@@ -416,12 +376,18 @@ jobs:
       - lint
       - prepare
       - test
-    # When Dependabot creates a PR it requires this permission in
-    # order to push Docker images to ghcr.io.
     permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
+      # When Dependabot creates a PR it requires this permission in
+      # order to push Docker images to ghcr.io.
       packages: write
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -430,14 +396,14 @@ jobs:
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
+          username: ${{ secrets.DOCKER_USERNAME }}
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
+          password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Checkout
         uses: actions/checkout@v4
       - name: Set up QEMU
@@ -445,27 +411,32 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         env:
           BASE_CACHE_KEY: buildx-${{ runner.os }}-
         with:
-          path: ${{ env.BUILDX_CACHE_DIR }}
           key: ${{ env.BASE_CACHE_KEY }}${{ github.sha }}
+          path: ${{ env.BUILDX_CACHE_DIR }}
           restore-keys: |
             ${{ env.BASE_CACHE_KEY }}
       - name: Create cross-platform support Dockerfile-x
         run: ./buildx-dockerfile.sh
       - name: Build and push platform images to registries
         id: docker_build
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@v6
         with:
-          build-args: |
-            VERSION=${{ needs.prepare.outputs.source_version }}
           cache-from: type=local,src=${{ env.BUILDX_CACHE_DIR }}
           cache-to: type=local,dest=${{ env.BUILDX_CACHE_DIR }}
           context: .
           file: ./Dockerfile-x
-          platforms: ${{ env.PLATFORMS }}
+          labels: ${{ needs.prepare.outputs.labels }}
+          platforms: |
+            linux/amd64
+            linux/arm/v6
+            linux/arm/v7
+            linux/arm64
+            linux/ppc64le
+            linux/s390x
           # Uncomment the following option if you are building an image for use
           # on Google Cloud Run or AWS Lambda. The current default image output
           # is unable to run on either. Please see the following issue for more
@@ -475,29 +446,6 @@ jobs:
           tags: ${{ needs.prepare.outputs.tags }}
           # For a list of pre-defined annotation keys and value types see:
           # https://github.com/opencontainers/image-spec/blob/master/annotations.md
-          labels: "\
-            org.opencontainers.image.created=${{
-              needs.prepare.outputs.created }}
-
-            org.opencontainers.image.description=${{
-              fromJson(needs.prepare.outputs.repometa).description }}
-
-            org.opencontainers.image.licenses=${{
-              fromJson(needs.prepare.outputs.repometa).license.spdx_id }}
-
-            org.opencontainers.image.revision=${{ github.sha }}
-
-            org.opencontainers.image.source=${{
-              fromJson(needs.prepare.outputs.repometa).clone_url }}
-
-            org.opencontainers.image.title=${{
-              fromJson(needs.prepare.outputs.repometa).name }}
-
-            org.opencontainers.image.url=${{
-              fromJson(needs.prepare.outputs.repometa).html_url }}
-
-            org.opencontainers.image.version=${{
-              needs.prepare.outputs.source_version }}"
       - name: Publish README.md to Docker Hub
         env:
           DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index dc49271..642adda 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -7,25 +7,36 @@
 name: CodeQL
 
 on:
+  merge_group:
+    types:
+      - checks_requested
+  pull_request:
+    # The branches here must be a subset of the ones in the push key
+    branches:
+      - develop
   push:
     # Dependabot triggered push events have read-only access, but uploading code
     # scanning requires write access.
     branches-ignore:
       - dependabot/**
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches:
-      - develop
   schedule:
     - cron: '0 21 * * 6'
 
 jobs:
   diagnostics:
     name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
     runs-on: ubuntu-latest
     steps:
       # Note that a duplicate of this step must be added at the top of
       # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -33,7 +44,7 @@ jobs:
           egress-policy: audit
       - id: github-status
         name: Check GitHub status
-        uses: crazy-max/ghaction-github-status@v3
+        uses: crazy-max/ghaction-github-status@v4
       - id: dump-context
         name: Dump context
         uses: crazy-max/ghaction-dump-context@v2
@@ -43,6 +54,8 @@ jobs:
       - diagnostics
     runs-on: ubuntu-latest
     permissions:
+      # actions/checkout needs this to fetch code
+      contents: read
       # required for all workflows
       security-events: write
     strategy:
@@ -56,6 +69,10 @@ jobs:
         # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
 
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
       - id: harden-runner
         name: Harden the runner
         uses: step-security/harden-runner@v2
@@ -67,7 +84,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v2
+        uses: github/codeql-action/init@v3
         with:
           languages: ${{ matrix.language }}
 
@@ -75,7 +92,7 @@ jobs:
       # Java). If this step fails, then you should remove it and run the build
       # manually (see below).
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v2
+        uses: github/codeql-action/autobuild@v3
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -89,4 +106,4 @@ jobs:
       #     make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v2
+        uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml
index 44e8e19..0005147 100644
--- a/.github/workflows/sync-labels.yml
+++ b/.github/workflows/sync-labels.yml
@@ -4,14 +4,42 @@ name: sync-labels
 on:
   push:
     paths:
-      - '.github/labels.yml'
-      - '.github/workflows/sync-labels.yml'
+      - .github/labels.yml
+      - .github/workflows/sync-labels.yml
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
+  diagnostics:
+    name: Run diagnostics
+    # This job does not need any permissions
+    permissions: {}
+    runs-on: ubuntu-latest
+    steps:
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      # Note that a duplicate of this step must be added at the top of
+      # each job.
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
+      - id: github-status
+        name: Check GitHub status
+        uses: crazy-max/ghaction-github-status@v4
+      - id: dump-context
+        name: Dump context
+        uses: crazy-max/ghaction-dump-context@v2
   labeler:
+    needs:
+      - diagnostics
     permissions:
       # actions/checkout needs this to fetch code
       contents: read
@@ -19,6 +47,15 @@ jobs:
       issues: write
     runs-on: ubuntu-latest
     steps:
+      - uses: GitHubSecurityLab/actions-permissions/monitor@v1
+        with:
+          # Uses the organization variable unless overridden
+          config: ${{ vars.ACTIONS_PERMISSIONS_CONFIG }}
+      - id: harden-runner
+        name: Harden the runner
+        uses: step-security/harden-runner@v2
+        with:
+          egress-policy: audit
       - uses: actions/checkout@v4
       - name: Sync repository labels
         if: success()
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index e35add0..7e188d1 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -4,16 +4,25 @@ default_language_version:
   python: python3
 
 repos:
+  # Check the pre-commit configuration
+  - repo: meta
+    hooks:
+      - id: check-useless-excludes
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v5.0.0
     hooks:
       - id: check-case-conflict
       - id: check-executables-have-shebangs
       - id: check-json
       - id: check-merge-conflict
+      - id: check-shebang-scripts-are-executable
+      - id: check-symlinks
       - id: check-toml
+      - id: check-vcs-permalinks
       - id: check-xml
       - id: debug-statements
+      - id: destroyed-symlinks
       - id: detect-aws-credentials
         args:
           - --allow-missing-credentials
@@ -21,7 +30,6 @@ repos:
         # Ignore the fake private key in this repo
         exclude: src/secrets/privkey.pem
       - id: end-of-file-fixer
-        exclude: files/(issue|motd)
       - id: mixed-line-ending
         args:
           - --fix=lf
@@ -33,17 +41,17 @@ repos:
 
   # Text file hooks
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.36.0
+    rev: v0.42.0
     hooks:
       - id: markdownlint
         args:
           - --config=.mdl_config.yaml
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: v3.0.3
+  - repo: https://github.com/rbubley/mirrors-prettier
+    rev: v3.3.3
     hooks:
       - id: prettier
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.32.0
+    rev: v1.35.1
     hooks:
       - id: yamllint
         args:
@@ -51,14 +59,14 @@ repos:
 
   # GitHub Actions hooks
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0.26.3
+    rev: 0.29.4
     hooks:
       - id: check-github-actions
       - id: check-github-workflows
 
   # pre-commit hooks
   - repo: https://github.com/pre-commit/pre-commit
-    rev: v3.4.0
+    rev: v4.0.1
     hooks:
       - id: validate_manifest
 
@@ -66,21 +74,25 @@ repos:
   - repo: https://github.com/TekWizely/pre-commit-golang
     rev: v1.0.0-rc.1
     hooks:
-      # Style Checkers
-      - id: go-critic
-      # StaticCheck
-      - id: go-staticcheck-repo-mod
       # Go Build
       - id: go-build-repo-mod
+      # Style Checkers
+      - id: go-critic
+      # goimports
+      - id: go-imports-repo
+        args:
+          # Write changes to files
+          - -w
       # Go Mod Tidy
       - id: go-mod-tidy-repo
+      # GoSec
+      - id: go-sec-repo-mod
+      # StaticCheck
+      - id: go-staticcheck-repo-mod
       # Go Test
       - id: go-test-repo-mod
       # Go Vet
       - id: go-vet-repo-mod
-      # GoSec
-      - id: go-sec-repo-mod
-
   # Nix hooks
   - repo: https://github.com/nix-community/nixpkgs-fmt
     rev: v1.3.0
@@ -88,29 +100,33 @@ repos:
       - id: nixpkgs-fmt
 
   # Shell script hooks
-  - repo: https://github.com/cisagov/pre-commit-shfmt
-    rev: v0.0.2
+  - repo: https://github.com/scop/pre-commit-shfmt
+    rev: v3.10.0-1
     hooks:
       - id: shfmt
         args:
+          # List files that will be formatted
+          - --list
+          # Write result to file instead of stdout
+          - --write
           # Indent by two spaces
-          - -i
-          - '2'
+          - --indent
+          - "2"
           # Binary operators may start a line
-          - -bn
+          - --binary-next-line
           # Switch cases are indented
-          - -ci
+          - --case-indent
           # Redirect operators are followed by a space
-          - -sr
-  - repo: https://github.com/detailyang/pre-commit-shell
-    rev: 1.0.5
+          - --space-redirects
+  - repo: https://github.com/shellcheck-py/shellcheck-py
+    rev: v0.10.0.1
     hooks:
-      - id: shell-lint
+      - id: shellcheck
 
   # Python hooks
   # Run bandit on the "tests" tree with a configuration
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.5
+    rev: 1.7.10
     hooks:
       - id: bandit
         name: bandit (tests tree)
@@ -119,44 +135,93 @@ repos:
           - --config=.bandit.yml
   # Run bandit on everything except the "tests" tree
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.7.5
+    rev: 1.7.10
     hooks:
       - id: bandit
         name: bandit (everything else)
         exclude: tests
   - repo: https://github.com/psf/black-pre-commit-mirror
-    rev: 23.9.1
+    rev: 24.10.0
     hooks:
       - id: black
   - repo: https://github.com/PyCQA/flake8
-    rev: 6.1.0
+    rev: 7.1.1
     hooks:
       - id: flake8
         additional_dependencies:
-          - flake8-docstrings
+          - flake8-docstrings==1.7.0
   - repo: https://github.com/PyCQA/isort
-    rev: 5.12.0
+    rev: 5.13.2
     hooks:
       - id: isort
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.5.1
+    rev: v1.13.0
     hooks:
       - id: mypy
+  - repo: https://github.com/pypa/pip-audit
+    rev: v2.7.3
+    hooks:
+      - id: pip-audit
+        args:
+          # Add any pip requirements files to scan
+          - --requirement
+          - requirements-dev.txt
+          - --requirement
+          - requirements-test.txt
+          - --requirement
+          - requirements.txt
   - repo: https://github.com/asottile/pyupgrade
-    rev: v3.10.1
+    rev: v3.19.0
     hooks:
       - id: pyupgrade
 
   # Ansible hooks
   - repo: https://github.com/ansible/ansible-lint
-    rev: v6.19.0
+    rev: v24.10.0
     hooks:
       - id: ansible-lint
-      # files: molecule/default/playbook.yml
+        additional_dependencies:
+          # On its own ansible-lint does not pull in ansible, only
+          # ansible-core.  Therefore, if an Ansible module lives in
+          # ansible instead of ansible-core, the linter will complain
+          # that the module is unknown.  In these cases it is
+          # necessary to add the ansible package itself as an
+          # additional dependency, with the same pinning as is done in
+          # requirements-test.txt of cisagov/skeleton-ansible-role.
+          #
+          # Version 10 is required because the pip-audit pre-commit
+          # hook identifies a vulnerability in ansible-core 2.16.13,
+          # but all versions of ansible 9 have a dependency on
+          # ~=2.16.X.
+          #
+          # It is also a good idea to go ahead and upgrade to version
+          # 10 since version 9 is going EOL at the end of November:
+          # https://endoflife.date/ansible
+          # - ansible>=10,<11
+          # ansible-core 2.16.3 through 2.16.6 suffer from the bug
+          # discussed in ansible/ansible#82702, which breaks any
+          # symlinked files in vars, tasks, etc. for any Ansible role
+          # installed via ansible-galaxy.  Hence we never want to
+          # install those versions.
+          #
+          # Note that the pip-audit pre-commit hook identifies a
+          # vulnerability in ansible-core 2.16.13.  The pin of
+          # ansible-core to >=2.17 effectively also pins ansible to
+          # >=10.
+          #
+          # It is also a good idea to go ahead and upgrade to
+          # ansible-core 2.17 since security support for ansible-core
+          # 2.16 ends this month:
+          # https://docs.ansible.com/ansible/devel/reference_appendices/release_and_maintenance.html#ansible-core-support-matrix
+          #
+          # Note that any changes made to this dependency must also be
+          # made in requirements.txt in cisagov/skeleton-packer and
+          # requirements-test.txt in cisagov/skeleton-ansible-role.
+          - ansible-core>=2.17
 
   # Terraform hooks
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.83.2
+    rev: v1.96.1
     hooks:
       - id: terraform_fmt
       - id: terraform_validate
@@ -169,7 +234,7 @@ repos:
 
   # Packer hooks
   - repo: https://github.com/cisagov/pre-commit-packer
-    rev: v0.0.2
+    rev: v0.3.0
     hooks:
-      - id: packer_validate
       - id: packer_fmt
+      - id: packer_validate
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c57cac0..a501c28 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -46,9 +46,13 @@ There are a few ways to do this, but we prefer to use
 create and manage a Python virtual environment specific to this
 project.
 
-If you already have `pyenv` and `pyenv-virtualenv` configured you can
-take advantage of the `setup-env` tool in this repo to automate the
-entire environment configuration process.
+We recommend using the `setup-env` script located in this repository,
+as it automates the entire environment configuration process. The
+dependencies required to run this script are
+[GNU `getopt`](https://github.com/util-linux/util-linux/blob/master/misc-utils/getopt.1.adoc),
+[`pyenv`](https://github.com/pyenv/pyenv), and [`pyenv-virtualenv`](https://github.com/pyenv/pyenv-virtualenv).
+If these tools are already configured on your system, you can simply run the
+following command:
 
 ```console
 ./setup-env
@@ -57,13 +61,18 @@ entire environment configuration process.
 Otherwise, follow the steps below to manually configure your
 environment.
 
-#### Installing and using `pyenv` and `pyenv-virtualenv` ####
+#### Installing and using GNU `getopt`, `pyenv`, and `pyenv-virtualenv` ####
 
-On the Mac, we recommend installing [brew](https://brew.sh/).  Then
-installation is as simple as `brew install pyenv pyenv-virtualenv` and
+On macOS, we recommend installing [brew](https://brew.sh/).  Then
+installation is as simple as `brew install gnu-getopt pyenv pyenv-virtualenv` and
 adding this to your profile:
 
 ```bash
+# GNU getopt must be explicitly added to the path since it is
+# keg-only (https://docs.brew.sh/FAQ#what-does-keg-only-mean)
+export PATH="$(brew --prefix)/opt/gnu-getopt/bin:$PATH"
+
+# Setup pyenv
 export PYENV_ROOT="$HOME/.pyenv"
 export PATH="$PYENV_ROOT/bin:$PATH"
 eval "$(pyenv init --path)"
@@ -71,13 +80,15 @@ eval "$(pyenv init -)"
 eval "$(pyenv virtualenv-init -)"
 ```
 
-For Linux, Windows Subsystem for Linux (WSL), or on the Mac (if you
+For Linux, Windows Subsystem for Linux (WSL), or macOS (if you
 don't want to use `brew`) you can use
 [pyenv/pyenv-installer](https://github.com/pyenv/pyenv-installer) to
 install the necessary tools. Before running this ensure that you have
 installed the prerequisites for your platform according to the
 [`pyenv` wiki
 page](https://github.com/pyenv/pyenv/wiki/common-build-problems).
+GNU `getopt` is included in most Linux distributions as part of the
+[`util-linux`](https://github.com/util-linux/util-linux) package.
 
 On WSL you should treat your platform as whatever Linux distribution
 you've chosen to install.
diff --git a/Dockerfile b/Dockerfile
index 52927ee..dcfc538 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,63 @@
-ARG VERSION=unspecified
+# Official Docker images are in the form library/<app> while non-official
+# images are in the form <user>/<app>.
+FROM docker.io/library/python:3.13.1-alpine3.20 AS compile-stage
 
+<<<<<<< HEAD
 FROM debian:bullseye-slim
+=======
+###
+# Unprivileged user variables
+###
+ARG CISA_USER="cisa"
+ENV CISA_HOME="/home/${CISA_USER}"
+ENV VIRTUAL_ENV="${CISA_HOME}/.venv"
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
+
+# Versions of the Python packages installed directly
+ENV PYTHON_PIP_VERSION=24.3.1
+ENV PYTHON_PIPENV_VERSION=2024.4.0
+ENV PYTHON_SETUPTOOLS_VERSION=75.6.0
+ENV PYTHON_WHEEL_VERSION=0.45.1
+
+###
+# Install the specified versions of pip, setuptools, and wheel into the system
+# Python environment; install the specified version of pipenv into the system Python
+# environment; set up a Python virtual environment (venv); and install the specified
+# versions of pip, setuptools, and wheel into the venv.
+#
+# Note that we use the --no-cache-dir flag to avoid writing to a local
+# cache.  This results in a smaller final image, at the cost of
+# slightly longer install times.
+###
+RUN python3 -m pip install --no-cache-dir --upgrade \
+        pip==${PYTHON_PIP_VERSION} \
+        setuptools==${PYTHON_SETUPTOOLS_VERSION} \
+        wheel==${PYTHON_WHEEL_VERSION} \
+    && python3 -m pip install --no-cache-dir --upgrade \
+        pipenv==${PYTHON_PIPENV_VERSION} \
+    # Manually create the virtual environment
+    && python3 -m venv ${VIRTUAL_ENV} \
+    # Ensure the core Python packages are installed in the virtual environment
+    && ${VIRTUAL_ENV}/bin/python3 -m pip install --no-cache-dir --upgrade \
+        pip==${PYTHON_PIP_VERSION} \
+        setuptools==${PYTHON_SETUPTOOLS_VERSION} \
+        wheel==${PYTHON_WHEEL_VERSION}
+
+###
+# Check the Pipfile configuration and then install the Python dependencies into
+# the virtual environment.
+#
+# Note that pipenv will install into a virtual environment if the VIRTUAL_ENV
+# environment variable is set.
+###
+WORKDIR /tmp
+COPY src/Pipfile src/Pipfile.lock ./
+RUN pipenv check --verbose \
+    && pipenv install --clear --deploy --extra-pip-args "--no-cache-dir" --verbose
 
-ARG VERSION
+# Official Docker images are in the form library/<app> while non-official
+# images are in the form <user>/<app>.
+FROM docker.io/library/python:3.13.1-alpine3.20 AS build-stage
 
 ###
 # For a list of pre-defined annotation keys and value types see:
@@ -18,6 +73,7 @@ LABEL org.opencontainers.image.vendor="Cybersecurity and Infrastructure Security
 # must be able to modify postfix and opendkim config files and
 # therefore must run as root.
 ###
+<<<<<<< HEAD
 
 ###
 # Upgrade the system
@@ -68,11 +124,48 @@ RUN mv /etc/postfix/master.cf /etc/postfix/master.cf.orig
 
 COPY src/templates templates/
 COPY src/docker-entrypoint.sh src/version.txt ./
+=======
+ARG CISA_UID=421
+ARG CISA_GID=${CISA_UID}
+ARG CISA_USER="cisa"
+ENV CISA_GROUP=${CISA_USER}
+ENV CISA_HOME="/home/${CISA_USER}"
+ENV VIRTUAL_ENV="${CISA_HOME}/.venv"
+
+###
+# Create unprivileged user
+###
+RUN addgroup --system --gid ${CISA_GID} ${CISA_GROUP} \
+    && adduser --system --uid ${CISA_UID} --ingroup ${CISA_GROUP} ${CISA_USER}
+
+###
+# Copy in the Python virtual environment created in compile-stage, symlink the
+# Python binary in the venv to the system-wide Python, and add the venv to the PATH.
+#
+# Note that we symlink the Python binary in the venv to the system-wide Python so that
+# any calls to `python3` will use our virtual environment. We are using short flags
+# because the ln binary in Alpine Linux does not support long flags. The -f instructs
+# ln to remove the existing file and the -s instructs ln to create a symbolic link.
+###
+COPY --from=compile-stage --chown=${CISA_USER}:${CISA_GROUP} ${VIRTUAL_ENV} ${VIRTUAL_ENV}
+RUN ln -fs "$(command -v python3)" "${VIRTUAL_ENV}"/bin/python3
+ENV PATH="${VIRTUAL_ENV}/bin:$PATH"
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 
 ###
 # Prepare to run
 ###
+<<<<<<< HEAD
 VOLUME ["/var/log", "/var/spool/postfix"]
 EXPOSE 25/TCP 587/TCP 993/TCP
 ENTRYPOINT ["./docker-entrypoint.sh"]
 CMD ["postfix", "-v", "start-fg"]
+=======
+ENV ECHO_MESSAGE="Hello World from Dockerfile"
+WORKDIR ${CISA_HOME}
+USER ${CISA_USER}:${CISA_GROUP}
+EXPOSE 8080/TCP
+VOLUME ["/var/log"]
+ENTRYPOINT ["example"]
+CMD ["--log-level", "DEBUG", "8", "2"]
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
diff --git a/README.md b/README.md
index 848eac2..e070fbf 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,11 @@ of sent email.  All email is BCC'd to the `mailarchive` account.
 To run the `cisagov/postfix` image via Docker:
 
 ```console
+<<<<<<< HEAD
 docker run cisagov/postfix:0.0.4
+=======
+docker run cisagov/example:0.2.0
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 ```
 
 ### Running with Docker Compose ###
@@ -36,6 +40,7 @@ this repository.
     version: "3.7"
 
     services:
+<<<<<<< HEAD
       postfix:
         build:
           # VERSION must be specified on the command line:
@@ -45,6 +50,14 @@ this repository.
         image: cisagov/postfix
         init: true
         restart: always
+=======
+      example:
+        image: cisagov/example:0.2.0
+        volumes:
+          - type: bind
+            source: <your_log_dir>
+            target: /var/log
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
         environment:
           - PRIMARY_DOMAIN=example.com
           - RELAY_IP=172.16.202.1/32
@@ -109,6 +122,7 @@ environment variables.  See the
         file: ./src/secrets/users.txt
 
     services:
+<<<<<<< HEAD
       postfix:
         build:
           # VERSION must be specified on the command line:
@@ -118,6 +132,14 @@ environment variables.  See the
         image: cisagov/postfix
         init: true
         restart: always
+=======
+      example:
+        image: cisagov/example:0.2.0
+        volumes:
+          - type: bind
+            source: <your_log_dir>
+            target: /var/log
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
         environment:
           - PRIMARY_DOMAIN=example.com
           - RELAY_IP=172.16.202.1/32
@@ -181,16 +203,50 @@ environment variables.  See the
 1. Pull the new image:
 
     ```console
+<<<<<<< HEAD
     docker pull cisagov/postfix:0.0.4
+=======
+    docker pull cisagov/example:0.2.0
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
     ```
 
 1. Recreate and run the container by following the [previous instructions](#running-with-docker).
 
+## Updating Python dependencies ##
+
+This image uses [Pipenv] to manage Python dependencies using a [Pipfile](https://github.com/pypa/pipfile).
+Both updating dependencies and changing the [Pipenv] configuration in `src/Pipfile`
+will result in a modified `src/Pipfile.lock` file that should be committed to the
+repository.
+
+> [!WARNING]
+> The `src/Pipfile.lock` as generated will fail `pre-commit` checks due to JSON formatting.
+
+### Updating dependencies ###
+
+If you want to update existing dependencies you would run the following command
+in the `src/` subdirectory:
+
+```console
+pipenv lock
+```
+
+### Modifying dependencies ###
+
+If you want to add or remove dependencies you would update the `src/Pipfile` file
+and then update dependencies as you would above.
+
+> [!NOTE]
+> You should only specify packages that are explicitly needed for your Docker
+> configuration. Allow [Pipenv] to manage the dependencies of the specified
+> packages.
+
 ## Image tags ##
 
 The images of this container are tagged with [semantic
 versions](https://semver.org) of the underlying Postfix project that they
 containerize.  It is recommended that most users use a version tag (e.g.
+<<<<<<< HEAD
 `:0.0.4`).
 
 | Image:tag | Description |
@@ -201,6 +257,18 @@ containerize.  It is recommended that most users use a version tag (e.g.
 |`cisagov/postfix:edge` | The most recent image built from a merge into the `develop` branch of this repository. |
 |`cisagov/postfix:nightly` | A nightly build of the `develop` branch of this repository. |
 |`cisagov/postfix:latest`| The most recent release image pushed to a container registry.  Pulling an image using the `:latest` tag [should be avoided.](https://vsupalov.com/docker-latest-tag/) |
+=======
+`:0.2.0`).
+
+| Image:tag | Description |
+|-----------|-------------|
+|`cisagov/example:0.2.0`| An exact release version. |
+|`cisagov/example:0.2`| The most recent release matching the major and minor version numbers. |
+|`cisagov/example:0`| The most recent release matching the major version number. |
+|`cisagov/example:edge` | The most recent image built from a merge into the `develop` branch of this repository. |
+|`cisagov/example:nightly` | A nightly build of the `develop` branch of this repository. |
+|`cisagov/example:latest`| The most recent release image pushed to a container registry.  Pulling an image using the `:latest` tag [should be avoided.](https://vsupalov.com/docker-latest-tag/) |
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 
 See the [tags tab](https://hub.docker.com/r/cisagov/postfix/tags) on Docker
 Hub for a list of all the supported tags.
@@ -253,9 +321,14 @@ Build the image locally using this git repository as the [build context](https:/
 
 ```console
 docker build \
+<<<<<<< HEAD
   --build-arg VERSION=0.0.4 \
   --tag cisagov/postfix:0.0.4 \
   https://github.com/cisagov/postfix-docker.git#develop
+=======
+  --tag cisagov/example:0.2.0 \
+  https://github.com/cisagov/example.git#develop
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 ```
 
 ## Cross-platform builds ##
@@ -284,9 +357,14 @@ Docker:
     docker buildx build \
       --file Dockerfile-x \
       --platform linux/amd64 \
+<<<<<<< HEAD
       --build-arg VERSION=0.0.4 \
       --output type=docker \
       --tag cisagov/postfix:0.0.4 .
+=======
+      --output type=docker \
+      --tag cisagov/example:0.2.0 .
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
     ```
 
 ## Contributing ##
@@ -306,3 +384,5 @@ dedication](https://creativecommons.org/publicdomain/zero/1.0/).
 All contributions to this project will be released under the CC0
 dedication. By submitting a pull request, you are agreeing to comply
 with this waiver of copyright interest.
+
+[Pipenv]: https://pypi.org/project/pipenv/
diff --git a/bump-version b/bump-version
new file mode 100755
index 0000000..324fea9
--- /dev/null
+++ b/bump-version
@@ -0,0 +1,172 @@
+#!/usr/bin/env bash
+
+# bump-version [--push] [--label LABEL] (major | minor | patch | prerelease | build | finalize | show)
+# bump-version --list-files
+
+set -o nounset
+set -o errexit
+set -o pipefail
+
+# Stores the canonical version for the project.
+VERSION_FILE=src/version.txt
+# Files that should be updated with the new version.
+VERSION_FILES=("$VERSION_FILE" README.md)
+
+USAGE=$(
+  cat << END_OF_LINE
+Update the version of the project.
+
+Usage:
+  ${0##*/} [--push] [--label LABEL] (major | minor | patch | prerelease | build | finalize | show)
+  ${0##*/} --list-files
+  ${0##*/} (-h | --help)
+
+Options:
+  -h | --help    Show this message.
+  --push         Perform a \`git push\` after updating the version.
+  --label LABEL  Specify the label to use when updating the build or prerelease version.
+  --list-files   List the files that will be updated when the version is bumped.
+END_OF_LINE
+)
+
+old_version=$(< "$VERSION_FILE")
+# Comment out periods so they are interpreted as periods and don't
+# just match any character
+old_version_regex=${old_version//\./\\\.}
+new_version="$old_version"
+
+bump_part=""
+label=""
+commit_prefix="Bump"
+with_push=false
+commands_with_label=("build" "prerelease")
+commands_with_prerelease=("major" "minor" "patch")
+with_prerelease=false
+
+#######################################
+# Display an error message, the help information, and exit with a non-zero status.
+# Arguments:
+#   Error message.
+#######################################
+function invalid_option() {
+  echo "$1"
+  echo "$USAGE"
+  exit 1
+}
+
+#######################################
+# Bump the version using the provided command.
+# Arguments:
+#   The version to bump.
+#   The command to bump the version.
+# Returns:
+#   The new version.
+#######################################
+function bump_version() {
+  local temp_version
+  temp_version=$(python -c "import semver; print(semver.parse_version_info('$1').${2})")
+  echo "$temp_version"
+}
+
+if [ $# -eq 0 ]; then
+  echo "$USAGE"
+  exit 1
+else
+  while [ $# -gt 0 ]; do
+    case $1 in
+      --push)
+        if [ "$with_push" = true ]; then
+          invalid_option "Push has already been set."
+        fi
+
+        with_push=true
+        shift
+        ;;
+      --label)
+        if [ -n "$label" ]; then
+          invalid_option "Label has already been set."
+        fi
+
+        label="$2"
+        shift 2
+        ;;
+      build | finalize | major | minor | patch)
+        if [ -n "$bump_part" ]; then
+          invalid_option "Only one version part should be bumped at a time."
+        fi
+
+        bump_part="$1"
+        shift
+        ;;
+      prerelease)
+        with_prerelease=true
+        shift
+        ;;
+      show)
+        echo "$old_version"
+        exit 0
+        ;;
+      -h | --help)
+        echo "$USAGE"
+        exit 0
+        ;;
+      --list-files)
+        printf '%s\n' "${VERSION_FILES[@]}"
+        exit 0
+        ;;
+      *)
+        invalid_option "Invalid option: $1"
+        ;;
+    esac
+  done
+fi
+
+if [ -n "$label" ] && [ "$with_prerelease" = false ] && [[ ! " ${commands_with_label[*]} " =~ [[:space:]]${bump_part}[[:space:]] ]]; then
+  invalid_option "Setting the label is only allowed for the following commands: ${commands_with_label[*]}"
+fi
+
+if [ "$with_prerelease" = true ] && [ -n "$bump_part" ] && [[ ! " ${commands_with_prerelease[*]} " =~ [[:space:]]${bump_part}[[:space:]] ]]; then
+  invalid_option "Changing the prerelease is only allowed in conjunction with the following commands: ${commands_with_prerelease[*]}"
+fi
+
+label_option=""
+if [ -n "$label" ]; then
+  label_option="token='$label'"
+fi
+
+if [ -n "$bump_part" ]; then
+  if [ "$bump_part" = "finalize" ]; then
+    commit_prefix="Finalize"
+    bump_command="finalize_version()"
+  elif [ "$bump_part" = "build" ]; then
+    bump_command="bump_${bump_part}($label_option)"
+  else
+    bump_command="bump_${bump_part}()"
+  fi
+  new_version=$(bump_version "$old_version" "$bump_command")
+  echo Changing version from "$old_version" to "$new_version"
+fi
+
+if [ "$with_prerelease" = true ]; then
+  bump_command="bump_prerelease($label_option)"
+  temp_version=$(bump_version "$new_version" "$bump_command")
+  echo Changing version from "$new_version" to "$temp_version"
+  new_version="$temp_version"
+fi
+
+tmp_file=/tmp/version.$$
+for version_file in "${VERSION_FILES[@]}"; do
+  if [ ! -f "$version_file" ]; then
+    echo Missing expected file: "$version_file"
+    exit 1
+  fi
+  sed "s/$old_version_regex/$new_version/" "$version_file" > $tmp_file
+  mv $tmp_file "$version_file"
+done
+
+git add "${VERSION_FILES[@]}"
+git commit --message "$commit_prefix version from $old_version to $new_version"
+
+if [ "$with_push" = true ]; then
+  git push
+fi
diff --git a/bump_version.sh b/bump_version.sh
deleted file mode 100755
index 0071670..0000000
--- a/bump_version.sh
+++ /dev/null
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-
-# Usage:
-#   bump_version.sh (show|major|minor|patch|finalize)
-#   bump_version.sh (build|prerelease) [token]
-# Notes:
-#   - If you specify a token it will only be used if the current version is
-#     tokenless or if the provided token matches the token used in the current
-#     version.
-
-set -o nounset
-set -o errexit
-set -o pipefail
-
-VERSION_FILE=src/version.txt
-README_FILE=README.md
-
-function usage {
-  cat << HELP
-Usage:
-  ${0##*/} (show|major|minor|patch|finalize)
-  ${0##*/} (build|prerelease) [token]
-
-Notes:
-  - If you specify a token it will only be used if the current version is
-    tokenless or if the provided token matches the token used in the current
-    version.
-HELP
-  exit 1
-}
-
-function update_version {
-  # Comment out periods so they are interpreted as periods and don't
-  # just match any character
-  old_version_regex=${1//\./\\\.}
-
-  echo Changing version from "$1" to "$2"
-  tmp_file=/tmp/version.$$
-  sed "s/$old_version_regex/$2/" $VERSION_FILE > $tmp_file
-  mv $tmp_file $VERSION_FILE
-  sed "s/$old_version_regex/$2/" $README_FILE > $tmp_file
-  mv $tmp_file $README_FILE
-  git add $VERSION_FILE $README_FILE
-  git commit --message "$3"
-}
-
-if [ $# -lt 1 ] || [ $# -gt 2 ]; then
-  usage
-else
-  old_version=$(sed -n "s/^__version__ = \"\(.*\)\"$/\1/p" $VERSION_FILE)
-  case $1 in
-    major | minor | patch)
-      if [ $# -ne 1 ]; then
-        usage
-      fi
-      new_version=$(python -c "import semver; print(semver.bump_$1('$old_version'))")
-      update_version "$old_version" "$new_version" "Bump version from $old_version to $new_version"
-      ;;
-    build | prerelease)
-      if [ $# -eq 2 ]; then
-        new_version=$(python -c "import semver; print(semver.bump_$1('$old_version', token='$2'))")
-      else
-        new_version=$(python -c "import semver; print(semver.bump_$1('$old_version'))")
-      fi
-      update_version "$old_version" "$new_version" "Bump version from $old_version to $new_version"
-      ;;
-    finalize)
-      if [ $# -ne 1 ]; then
-        usage
-      fi
-      new_version=$(python -c "import semver; print(semver.finalize_version('$old_version'))")
-      update_version "$old_version" "$new_version" "Finalize version from $old_version to $new_version"
-      ;;
-    show)
-      echo "$old_version"
-      ;;
-    *)
-      usage
-      ;;
-  esac
-fi
diff --git a/docker-compose.yml b/docker-compose.yml
index 21075ea..6bc83dd 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -29,6 +29,7 @@ services:
       front:
         ipv4_address: 172.16.202.2
     ports:
+<<<<<<< HEAD
       - target: "25"
         published: "1025"
         protocol: tcp
@@ -39,6 +40,10 @@ services:
         mode: host
       - target: "993"
         published: "1993"
+=======
+      - target: 8421
+        published: 8421
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
         protocol: tcp
         mode: host
     secrets:
diff --git a/requirements-dev.txt b/requirements-dev.txt
index cb51627..d7a04ed 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,3 +1,4 @@
 --requirement requirements-test.txt
 ipython
-semver
+pipenv
+semver>=3
diff --git a/setup-env b/setup-env
index 77926bf..059ccad 100755
--- a/setup-env
+++ b/setup-env
@@ -9,60 +9,122 @@ USAGE=$(
 Configure a development environment for this repository.
 
 It does the following:
+  - Allows the user to specify the Python version to use for the virtual environment.
+  - Allows the user to specify a name for the virtual environment.
   - Verifies pyenv and pyenv-virtualenv are installed.
-  - Creates a Python virtual environment.
+  - Creates the Python virtual environment.
   - Configures the activation of the virtual enviroment for the repo directory.
   - Installs the requirements needed for development.
   - Installs git pre-commit hooks.
-  - Configures git upstream remote "lineage" repositories.
+  - Configures git remotes for upstream "lineage" repositories.
 
 Usage:
-  setup-env [options] [virt_env_name]
+  setup-env [--venv-name venv_name] [--python-version python_version]
   setup-env (-h | --help)
 
 Options:
-  -f --force          Delete virtual enviroment if it already exists.
-  -h --help           Show this message.
-  -i --install-hooks  Install hook environments for all environments in the
-                      pre-commit config file.
+  -f | --force             Delete virtual enviroment if it already exists.
+  -h | --help              Show this message.
+  -i | --install-hooks     Install hook environments for all environments in the
+                           pre-commit config file.
+  -l | --list-versions     List available Python versions and select one interactively.
+  -v | --venv-name         Specify the name of the virtual environment.
+  -p | --python-version    Specify the Python version for the virtual environment.
 
 END_OF_LINE
 )
 
+# Display pyenv's installed Python versions
+python_versions() {
+  pyenv versions --bare --skip-aliases --skip-envs
+}
+
+check_python_version() {
+  local version=$1
+
+  # This is a valid regex for semantically correct Python version strings.
+  # For more information see here:
+  # https://semver.org/#is-there-a-suggested-regular-expression-regex-to-check-a-semver-string
+  # Break down the regex into readable parts major.minor.patch
+  local major="0|[1-9]\d*"
+  local minor="0|[1-9]\d*"
+  local patch="0|[1-9]\d*"
+
+  # Splitting the prerelease part for readability
+  # Start of the prerelease
+  local prerelease="(?:-"
+  # Numeric or alphanumeric identifiers
+  local prerelease+="(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)"
+  # Additional dot-separated identifiers
+  local prerelease+="(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*"
+  # End of the prerelease, making it optional
+  local prerelease+=")?"
+  # Optional build metadata
+  local build="(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?"
+
+  # Final regex composed of parts
+  local regex="^($major)\.($minor)\.($patch)$prerelease$build$"
+
+  # This checks if the Python version does not match the regex pattern specified in $regex,
+  # using Perl for regex matching. If the pattern is not found, then prompt the user with
+  # the invalid version message.
+  if ! echo "$version" | perl -ne "exit(!/$regex/)"; then
+    echo "Invalid version of Python: Python follows semantic versioning," \
+      "so any version string that is not a valid semantic version is an" \
+      "invalid version of Python."
+    exit 1
+  # Else if the Python version isn't installed then notify the user.
+  # grep -E is used for searching through text lines that match the specific verison.
+  elif ! python_versions | grep -E "^${version}$" > /dev/null; then
+    echo "Error: Python version $version is not installed."
+    echo "Installed Python versions are:"
+    python_versions
+    exit 1
+  else
+    echo "Using Python version $version"
+  fi
+}
+
 # Flag to force deletion and creation of virtual environment
 FORCE=0
 
-# Positional parameters
-PARAMS=""
+# Initialize the other flags
+INSTALL_HOOKS=0
+LIST_VERSIONS=0
+PYTHON_VERSION=""
+VENV_NAME=""
 
-# Parse command line arguments
-while (("$#")); do
-  case "$1" in
-    -f | --force)
-      FORCE=1
-      shift
-      ;;
-    -h | --help)
-      echo "${USAGE}"
-      exit 0
-      ;;
-    -i | --install-hooks)
-      INSTALL_HOOKS=1
-      shift
-      ;;
-    -*) # unsupported flags
-      echo "Error: Unsupported flag $1" >&2
-      exit 1
-      ;;
-    *) # preserve positional arguments
-      PARAMS="$PARAMS $1"
-      shift
-      ;;
-  esac
-done
+# Define long options
+LONGOPTS="force,help,install-hooks,list-versions,python-version:,venv-name:"
+
+# Define short options for getopt
+SHORTOPTS="fhilp:v:"
+
+# Check for GNU getopt by matching a specific pattern ("getopt from util-linux")
+# in its version output. This approach presumes the output format remains stable.
+# Be aware that format changes could invalidate this check.
+if [[ $(getopt --version 2> /dev/null) != *"getopt from util-linux"* ]]; then
+  cat << 'END_OF_LINE'
 
-# set positional arguments in their proper place
-eval set -- "$PARAMS"
+  Please note, this script requires GNU getopt due to its enhanced
+  functionality and compatibility with certain script features that
+  are not supported by the POSIX getopt found in some systems, particularly
+  those with a non-GNU version of getopt. This distinction is crucial
+  as a system might have a non-GNU version of getopt installed by default,
+  which could lead to unexpected behavior.
+
+  On macOS, we recommend installing brew (https://brew.sh/).  Then installation
+  is as simple as `brew install gnu-getopt` and adding this to your
+  profile:
+
+  export PATH="$(brew --prefix)/opt/gnu-getopt/bin:$PATH"
+
+  GNU getopt must be explicitly added to the PATH since it
+  is keg-only (https://docs.brew.sh/FAQ#what-does-keg-only-mean).
+
+END_OF_LINE
+  exit 1
+fi
 
 # Check to see if pyenv is installed
 if [ -z "$(command -v pyenv)" ] || { [ -z "$(command -v pyenv-virtualenv)" ] && [ ! -f "$(pyenv root)/plugins/pyenv-virtualenv/bin/pyenv-virtualenv" ]; }; then
@@ -70,7 +132,7 @@ if [ -z "$(command -v pyenv)" ] || { [ -z "$(command -v pyenv-virtualenv)" ] &&
   if [[ "$OSTYPE" == "darwin"* ]]; then
     cat << 'END_OF_LINE'
 
-  On the Mac, we recommend installing brew, https://brew.sh/.  Then installation
+  On macOS, we recommend installing brew, https://brew.sh/.  Then installation
   is as simple as `brew install pyenv pyenv-virtualenv` and adding this to your
   profile:
 
@@ -81,7 +143,7 @@ END_OF_LINE
 
   fi
   cat << 'END_OF_LINE'
-  For Linux, Windows Subsystem for Linux (WSL), or on the Mac (if you don't want
+  For Linux, Windows Subsystem for Linux (WSL), or macOS (if you don't want
   to use "brew") you can use https://github.com/pyenv/pyenv-installer to install
   the necessary tools. Before running this ensure that you have installed the
   prerequisites for your platform according to the pyenv wiki page,
@@ -100,16 +162,72 @@ END_OF_LINE
   exit 1
 fi
 
-set +o nounset
+# Use GNU getopt to parse options
+if ! PARSED=$(getopt --options $SHORTOPTS --longoptions $LONGOPTS --name "$0" -- "$@"); then
+  echo "Error parsing options"
+  exit 1
+fi
+eval set -- "$PARSED"
+
+while true; do
+  case "$1" in
+    -f | --force)
+      FORCE=1
+      shift
+      ;;
+    -h | --help)
+      echo "$USAGE"
+      exit 0
+      ;;
+    -i | --install-hooks)
+      INSTALL_HOOKS=1
+      shift
+      ;;
+    -l | --list-versions)
+      LIST_VERSIONS=1
+      shift
+      ;;
+    -p | --python-version)
+      PYTHON_VERSION="$2"
+      shift 2
+      # Check the Python version being passed in.
+      check_python_version "$PYTHON_VERSION"
+      ;;
+    -v | --venv-name)
+      VENV_NAME="$2"
+      shift 2
+      ;;
+    --)
+      shift
+      break
+      ;;
+    *)
+      # Unreachable due to GNU getopt handling all options
+      echo "Programming error"
+      exit 64
+      ;;
+  esac
+done
+
 # Determine the virtual environment name
-if [ "$1" ]; then
+if [ -n "$VENV_NAME" ]; then
   # Use the user-provided environment name
-  env_name=$1
+  env_name="$VENV_NAME"
 else
   # Set the environment name to the last part of the working directory.
   env_name=${PWD##*/}
 fi
-set -o nounset
+
+# List Python versions and select one interactively.
+if [ $LIST_VERSIONS -ne 0 ]; then
+  echo Available Python versions:
+  python_versions
+  # Read the user's desired Python version.
+  # -r: treat backslashes as literal, -p: display prompt before input.
+  read -r -p "Enter the desired Python version: " PYTHON_VERSION
+  # Check the Python version being passed in.
+  check_python_version "$PYTHON_VERSION"
+fi
 
 # Remove any lingering local configuration.
 if [ $FORCE -ne 0 ]; then
@@ -118,7 +236,7 @@ if [ $FORCE -ne 0 ]; then
 elif [[ -f .python-version ]]; then
   cat << 'END_OF_LINE'
   An existing .python-version file was found.  Either remove this file yourself
-  or re-run with --force option to have it deleted along with the associated
+  or re-run with the --force option to have it deleted along with the associated
   virtual environment.
 
   rm .python-version
@@ -128,10 +246,18 @@ END_OF_LINE
 fi
 
 # Create a new virtual environment for this project
-if ! pyenv virtualenv "${env_name}"; then
+#
+# If $PYTHON_VERSION is undefined then the current pyenv Python version will be used.
+#
+# We can't quote ${PYTHON_VERSION:=} below since if the variable is
+# undefined then we want nothing to appear; this is the reason for the
+# "shellcheck disable" line below.
+#
+# shellcheck disable=SC2086
+if ! pyenv virtualenv ${PYTHON_VERSION:=} "${env_name}"; then
   cat << END_OF_LINE
   An existing virtual environment named $env_name was found.  Either delete this
-  environment yourself or re-run with --force option to have it deleted.
+  environment yourself or re-run with the --force option to have it deleted.
 
   pyenv virtualenv-delete ${env_name}
 
diff --git a/src/Pipfile b/src/Pipfile
new file mode 100644
index 0000000..fdd19e6
--- /dev/null
+++ b/src/Pipfile
@@ -0,0 +1,13 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+# List any Python dependencies for the image here
+[packages]
+# This should match the version of the image
+example = {file = "https://github.com/cisagov/skeleton-python-library/archive/v0.2.0.tar.gz"}
+
+# This version should match the version of Python in the image
+[requires]
+python_full_version = "3.13.1"
diff --git a/src/Pipfile.lock b/src/Pipfile.lock
new file mode 100644
index 0000000..408d508
--- /dev/null
+++ b/src/Pipfile.lock
@@ -0,0 +1,45 @@
+{
+  "_meta": {
+    "hash": {
+      "sha256": "8a376df6f25cf8583d5da89da420c5e51660f33a081c1f85236643ef31601833"
+    },
+    "pipfile-spec": 6,
+    "requires": {
+      "python_full_version": "3.13.1"
+    },
+    "sources": [
+      {
+        "name": "pypi",
+        "url": "https://pypi.org/simple",
+        "verify_ssl": true
+      }
+    ]
+  },
+  "default": {
+    "docopt": {
+      "hashes": [
+        "sha256:49b3a825280bd66b3aa83585ef59c4a8c82f2c8a522dbe754a8bc8d08c85c491"
+      ],
+      "version": "==0.6.2"
+    },
+    "example": {
+      "file": "https://github.com/cisagov/skeleton-python-library/archive/v0.2.0.tar.gz"
+    },
+    "schema": {
+      "hashes": [
+        "sha256:5d976a5b50f36e74e2157b47097b60002bd4d42e65425fcc9c9befadb4255dde",
+        "sha256:7da553abd2958a19dc2547c388cde53398b39196175a9be59ea1caf5ab0a1807"
+      ],
+      "version": "==0.7.7"
+    },
+    "setuptools": {
+      "hashes": [
+        "sha256:8199222558df7c86216af4f84c30e9b34a61d8ba19366cc914424cdbd28252f6",
+        "sha256:ce74b49e8f7110f9bf04883b730f4765b774ef3ef28f722cce7c273d253aaf7d"
+      ],
+      "markers": "python_version >= '3.9'",
+      "version": "==75.6.0"
+    }
+  },
+  "develop": {}
+}
diff --git a/src/version.txt b/src/version.txt
index 485f44a..0a98ae4 100644
--- a/src/version.txt
+++ b/src/version.txt
@@ -1 +1,5 @@
+<<<<<<< HEAD
 __version__ = "0.1.1"
+=======
+0.2.0
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
diff --git a/tag.sh b/tag.sh
index e1f7447..0a0e607 100755
--- a/tag.sh
+++ b/tag.sh
@@ -4,6 +4,6 @@ set -o nounset
 set -o errexit
 set -o pipefail
 
-version=$(./bump_version.sh show)
+version=$(./bump-version show)
 
 git tag "v$version" && git push --tags
diff --git a/tests/conftest.py b/tests/conftest.py
index 9f5a806..dae5469 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -2,12 +2,15 @@
 
 https://docs.pytest.org/en/latest/writing_plugins.html#conftest-py-plugins
 """
+
 # Third-Party Libraries
 import pytest
 from python_on_whales import docker
 
 MAIN_SERVICE_NAME = "postfix"
 
+VERSION_FILE = "src/version.txt"
+
 
 @pytest.fixture(scope="session")
 def dockerc():
@@ -24,6 +27,27 @@ def main_container(dockerc):
     return dockerc.compose.ps(services=[MAIN_SERVICE_NAME], all=True)[0]
 
 
+<<<<<<< HEAD
+=======
+@pytest.fixture(scope="session")
+def version_container(dockerc):
+    """Return the version container from the Docker composition.
+
+    The version container should just output the version of its underlying contents.
+    """
+    # find the container by name even if it is stopped already
+    return dockerc.compose.ps(services=[VERSION_SERVICE_NAME], all=True)[0]
+
+
+@pytest.fixture(scope="session")
+def project_version():
+    """Return the version of the project."""
+    with open(VERSION_FILE) as f:
+        project_version = f.read().strip()
+    return project_version
+
+
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 def pytest_addoption(parser):
     """Add new commandline options to pytest."""
     parser.addoption(
diff --git a/tests/container_test.py b/tests/container_test.py
index 19f6a0c..a4f6b85 100644
--- a/tests/container_test.py
+++ b/tests/container_test.py
@@ -1,5 +1,9 @@
+<<<<<<< HEAD
 #!/usr/bin/env pytest -vs
 """Tests for postfix container."""
+=======
+"""Tests for example container."""
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 
 # Standard Python Libraries
 from email.message import EmailMessage
@@ -11,6 +15,7 @@
 # Third-Party Libraries
 import pytest
 
+<<<<<<< HEAD
 ARCHIVE_PW = "foobar"
 ARCHIVE_USER = "mailarchive"
 DOMAIN = "example.com"
@@ -19,6 +24,13 @@
 This is a test message sent during the unit tests.
 """
 READY_MESSAGE = "daemon started"
+=======
+ENV_VAR = "ECHO_MESSAGE"
+ENV_VAR_VAL = "Hello World from docker compose!"
+READY_MESSAGE = "This is a debug message"
+DIVISION_MESSAGE = "8 / 2 == 4.000000"
+SECRET_QUOTE = "Three may keep a secret, if two of them are dead."  # nosec
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 RELEASE_TAG = os.getenv("RELEASE_TAG")
 TEST_SEND_PW = "lemmy is god"
 TEST_SEND_USER = "testsender1"
@@ -60,6 +72,7 @@ def test_sending_mail(port, to_user):
         s.send_message(msg)
 
 
+<<<<<<< HEAD
 @pytest.mark.parametrize(
     "username,password",
     [
@@ -156,28 +169,46 @@ def test_imap_messages_cleared(username, password):
         message_count = int(data[0])
         print(f"inbox message count: {message_count}")
         assert message_count == 0, "Expected the inbox to be empty"
+=======
+def test_output(dockerc, main_container):
+    """Verify the container had the correct output."""
+    # make sure container exited if running test isolated
+    dockerc.wait(main_container.id)
+    log_output = main_container.logs()
+    assert DIVISION_MESSAGE in log_output, "Division message not found in log output."
+    assert SECRET_QUOTE in log_output, "Secret not found in log output."
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
 
 
 @pytest.mark.skipif(
     RELEASE_TAG in [None, ""], reason="this is not a release (RELEASE_TAG not set)"
 )
-def test_release_version():
+def test_release_version(project_version):
     """Verify that release tag version agrees with the module version."""
-    pkg_vars = {}
-    with open(VERSION_FILE) as f:
-        exec(f.read(), pkg_vars)  # nosec
-    project_version = pkg_vars["__version__"]
     assert (
         RELEASE_TAG == f"v{project_version}"
     ), "RELEASE_TAG does not match the project version"
 
 
+<<<<<<< HEAD
 def test_container_version_label_matches(main_container):
+=======
+def test_log_version(dockerc, project_version, version_container):
+    """Verify the container outputs the correct version to the logs."""
+    # make sure container exited if running test isolated
+    dockerc.wait(version_container.id)
+    log_output = version_container.logs().strip()
+    assert (
+        log_output == project_version
+    ), f"Container version output to log does not match project version file {VERSION_FILE}"
+
+
+@pytest.mark.skipif(
+    RELEASE_TAG in [None, ""], reason="this is not a release (RELEASE_TAG not set)"
+)
+def test_container_version_label_matches(project_version, version_container):
+>>>>>>> 0d48ebd47a28a887868ea3093e675e95f3843561
     """Verify the container version label is the correct version."""
-    pkg_vars = {}
-    with open(VERSION_FILE) as f:
-        exec(f.read(), pkg_vars)  # nosec
-    project_version = pkg_vars["__version__"]
     assert (
         main_container.config.labels["org.opencontainers.image.version"]
         == project_version