Base Image Not Pinned

Why it matters

An unpinned image is a moving target: today's build and next month's rebuild can be different operating systems. Pinning a major version (and, for the strictest setups, a digest) makes builds repeatable and lets you upgrade on purpose.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

FROM node:latest
CMD ["node", "server.js"]

The smallest fix

# Before
FROM node:latest
# After: pin the major and the variant
FROM node:20-alpine

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

# Pin to a digest for fully repeatable builds, and let Dependabot or
# Renovate open a PR when a new digest is published:
FROM node:20-alpine@sha256:<digest>

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Build the image and confirm it succeeds with the pinned tag.
2. Run the app's smoke test against the new image.

Further reading

• https://cwe.mitre.org/data/definitions/1104.html