Base image not pinned (ARCH10002)

Key config.docker.unpinned-base-image · Severity warning · Category quality

Without a version the base image changes under the build without anyone deciding it: two builds of the same commit can differ, and a broken or compromised upstream release reaches production on the next build.

Incorrect

FROM python:latest
WORKDIR /app
COPY . .
USER 10001
CMD ["python", "main.py"]

Correct

FROM python:3.12.7-slim
WORKDIR /app
COPY . .
USER 10001
CMD ["python", "main.py"]

Fix

Pin a version tag (image:1.2.3) or a digest (image@sha256:...), and move it on purpose.

Not flagged

• An image pinned by digest, scratch, an earlier stage of the same Dockerfile, and an image given by a build argument (FROM ${BASE}).