DL3006: Always tag the version of an image explicitly
Warning Security
Why This Matters
Untagged images default to :latest, which can change without warning. A deployment that worked yesterday can break today because the base image was updated upstream. Pin to a specific tag (e.g., node:20-alpine) so your builds are reproducible and behave the same across environments.
How to Fix
Pin the base image to a specific version tag or digest
Before (incorrect)
FROM ubuntuAfter (correct)
FROM ubuntu:22.04Rule Details
- Rule Code
- DL3006
- Severity
- Warning
- Category
- Security