# L1 fixture: a minimal ServiceDefinition. Any onboarded service — regardless of its
# dependencies — must render the namespaced default-deny baseline (R-NET-01). This fixture
# declares NO dependencies, so its render must still carry the deny-all + DNS-only baseline.
# Validates against schemas/servicedefinition.schema.json.
name: baseline-demo
kind: container
source:
  image: nginx:1.27