Dockerfile base image is not pinned to a digest

What it detects

Dockerfile base image is not pinned to a digest: an infrastructure as code check run by the textscan analyzer.

Evidence

The matching source path, line, and bounded code observation produced by the native rule.

Remediation

Pin the base image by digest: `FROM python:3.14-slim@sha256:…`. Keep the tag alongside it for readability — the digest is what makes the build reproducible, and a tool like Renovate or Dependabot can bump both together.

Limitations

This check is limited to the applicability and evidence delivered by textscan. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions