tally/platform-mismatch

​

Description

• Only fires when --platform is explicitly set on the FROM instruction
• Never compares against the host platform, so results are deterministic across machines
• Skips automatic build args ($BUILDPLATFORM, $TARGETPLATFORM, etc.) which are dynamic

​

When it fires

​

Examples

​

Bad

# python:3.12 is only published for linux/arm64 but linux/amd64 is requested
FROM --platform=linux/amd64 python:3.12
RUN pip install flask

​

Good

# No --platform: builder picks the right platform at build time
FROM python:3.12
RUN pip install flask

# Correct platform that the image actually provides
FROM --platform=linux/arm64 python:3.12
RUN pip install flask

# Dynamic platform via build arg
FROM --platform=$BUILDPLATFORM golang:1.22 AS builder
RUN go build -o /app

​

Relationship to other rules

• buildkit/InvalidBaseImagePlatform (default: Off) — the BuildKit rule compares against the host platform even without --platform, producing non-deterministic results. This rule supersedes it with a stricter, deterministic approach.
• buildkit/FromPlatformFlagConstDisallowed (default: Off) — the BuildKit rule warns on any constant --platform value. This is too strict: hardcoded --platform is legitimate for ARM-only services, Windows containers, and cross-compilation. The new rule validates the platform against the registry instead of discouraging it.