Dockerfile pins to :latest (or no tag at all)

What it detects

Dockerfile pins to :latest (or no tag at all): an infrastructure as code check run by the textscan analyzer.

Evidence

The matching source path, line, and bounded code observation produced by the native rule.

Remediation

Pin to a specific tag or digest (e.g. `python:3.11.7-slim` or `python@sha256:…`). `:latest` makes builds unreproducible AND ships unreviewed upstream changes.

Limitations

This check is limited to the applicability and evidence delivered by textscan. Review the evidence in context; a match is a finding input, while confidence and policy determine its disposition.

Related reference

Analyzer Registry · Findings and release decisions · Policy and confidence

Remediation guidance: Remediation and fix verification · Baselines and suppressions