Will It Vibe?Base image has no tag (implicit latest)
Part of Architecture & Best Practices, which counts for 15% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A FROM instruction names an image with no tag or digest, which Docker resolves to :latest, so the build is not reproducible.
Why it matters
An untagged base image is treated by Docker as :latest, so the build is not reproducible and can change under you when the upstream image moves. Nothing records which version your image was actually built from.
How to fix it
Add an explicit version tag to every FROM (for example python:3.12-slim instead of python). Optionally pin the digest too for byte-for-byte reproducibility. Update the pinned version deliberately, not implicitly.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo