Design a containerized CI/CD pipeline for a microservices platform with 20+ services, balancing build speed, security, and cost.

A strong answer covers: immutable image tagging by git SHA; layer-cache-friendly Dockerfiles with shared base images across services to maximize cross-service cache hits; a daemonless or carefully-scoped builder (Kaniko/Buildah, or socket-mounting with strict runner isolation) appropriate to the CI platform's multi-tenancy needs; a blocking vulnerability-scan gate with an agreed severity threshold; registry-based or platform-native build cache (since ephemeral runners lose local cache between runs); and a deployment stage using progressive rollout (canary or blue-green) with automated rollback