Dockerfile Security: Avoid Missing or ‘latest’ Version Tags

Using latest or unpinned image tags makes builds non-deterministic and risky. Pin tags or digests to control supply-chain updates.

Problem

Docker images without a version tag or with the “latest” tag use unpredictable versions.

Description

Unpinned image references allow upstream changes to alter your build without a Dockerfile change. That weakens reproducibility and can introduce unexpected behavior or vulnerabilities during routine rebuilds.

Pinning by explicit tag or digest gives deterministic inputs and improves incident response. When issues occur, teams can identify exactly which base image was used and roll forward or back with controlled dependency changes.

Examples

  • The image version is not controlled.
  • An attacker can push a malicious image as the latest tag.
  • Updates may break your application due to incompatibility.

Related rules: avoid ARG vars in RUN commands, avoid multiple CMD or ENTRYPOINT, avoid self-referencing COPY –from.

Solution

Always specify a version tag or digest. This practice ensures that you use a fixed and known image version.

Problematic code

ARG version=latest
FROM ubuntu as u1
FROM ubuntu:latest as u2
FROM ubuntu:$version as u3
FROM u3
USER nobody

Verified code

FROM ubuntu:noble as u1
FROM ubuntu@sha256:72297848456d5d37d1262630108ab308d3e9ec7ed1c3286a32fe09856619a782 as u2
FROM u2
USER nobody

Source of the description

Dockerfile best practices