Skip to main content
Always tag the version of an image explicitly.
PropertyValue
SeverityWarning
CategoryBest Practice
DefaultEnabled

​
Description

You can never rely that the latest tag is a specific version. Always tag the version of an image explicitly to ensure reproducible builds.

​
Examples

​
Problematic code

FROM debian

​
Correct code

FROM debian:jessie

​
Exception

When the image name refers to a previously defined alias, tagging is not required: 
FROM debian:jessie as build
RUN build_script

FROM build as tests
RUN test_script

FROM debian:jessie
COPY --from=build foo .

​
Reference