Will It Vibe?Base image pinned to the :latest tag
Part of Architecture & Best Practices, which counts for 15% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A FROM instruction uses the :latest tag, so rebuilds silently pull whatever image happens to be current, making builds non-reproducible.
Why it matters
A base image pinned to :latest resolves to whatever version is current at build time, so two builds of the same Dockerfile can produce different images. That makes failures hard to reproduce and lets an upstream change break or alter your image without any commit on your side.
How to fix it
Replace :latest with a specific version tag (for example node:20.11.1-slim). For stronger reproducibility, add the image digest as well (node:20.11.1-slim@sha256:...). Keep the tag updated deliberately through your dependency process rather than implicitly on every build.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo