Metadata

Id: dockercompose-image-uses-latest-or-no-tag

Platform: DockerCompose

Severity: Medium

Category: Build Process

Learn More

• Provider Reference

Description

Using the latest tag or omitting a tag entirely causes Docker to pull whatever image is currently tagged as latest in the registry on each docker compose pull. This creates non-reproducible deployments where re-deploying the same Compose file can silently change the running software version, introducing unexpected behavior or unreviewed security fixes. Service image fields should specify an explicit, immutable version tag or a SHA digest.

Compliant Code Examples

services:
  versioned:
    image: nginx:1.25-alpine
  digest_pinned:
    image: nginx@sha256:3c4c1f42a89e343c7f9f9c4c5e8b33e0e2b85b43a23d2f4a6c5e0e9d7b3a1c2d
  registry_versioned:
    image: registry.example.com:5000/myapp:2.1.0
  interpolated_image:
    image: ${IMAGE}
  short_interpolated_image:
    image: $IMAGE
  required_interpolated_image:
    image: ${IMAGE:?image must be set}
  interpolated_tag:
    image: nginx:${TAG}

Non-Compliant Code Examples

services:
  no_tag:
    image: nginx
  latest_tag:
    image: nginx:latest
  registry_no_tag:
    image: registry.example.com/myapp