Image version using latest

이 제품은 선택한 Datadog 사이트에서 지원되지 않습니다. ().
이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

Id: dockerfile-image-version-using-latest

Platform: Dockerfile

Severity: Medium

Category: Best Practices

Learn More

Description

Using the :latest tag for base images makes builds non-reproducible and can silently introduce unreviewed or vulnerable changes from upstream, increasing supply-chain and runtime risk.

Check the Dockerfile FROM instruction: the image reference must use an explicit version tag or an immutable digest (for example, nginx:1.21.6 or nginx@sha256:...) rather than ...:latest. scratch base images are exempt.

This rule flags FROM lines that contain :latest (excluding scratch). Update them to a specific semantic version tag or pin to a digest to ensure consistent, auditable images.

Secure examples:

FROM nginx:1.21.6

FROM nginx@sha256:03a1c7c8f9e2d5b6a7c8e9f0a1b2c3d4e5f67890123456789abcdef0123456789

Compliant Code Examples

FROM alpine:3.5
RUN apk add --update py2-pip
RUN pip install --upgrade pip
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5000
CMD ["python", "/usr/src/app/app.py"]

FROM 923847651029.dkr.ecr.eu-west-1.amazonaws.com/echo/echo-fips:latest@sha256:a1f3c2e9b0d74682f5a3c1e8b2d09f47c6e1a3b8d2f04c7e9a1b3d5f7c2e4a6b8
RUN apk add --update py2-pip
RUN pip install --upgrade pip
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5001
CMD ["python", "/usr/src/app/app.py"]

Non-Compliant Code Examples

FROM alpine:latest
RUN apk add --update py2-pip
RUN pip install --upgrade pip
COPY requirements.txt /usr/src/app/
RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
COPY app.py /usr/src/app/
COPY templates/index.html /usr/src/app/templates/
EXPOSE 5000
CMD ["python", "/usr/src/app/app.py"]