Dockerfiles using unpinned or :latest base images build differently over time, breaking reproducibility and silently pulling in untested (or vulnerable) versions.
Fix: Pin base images to a specific version tag (and ideally digest) in every Dockerfile, e.g. node:24-alpine rather than node:latest, so builds are reproducible and upgrades are deliberate, reviewed changes.
infrastructuredockerreproducibility
References
- https://docs.docker.com/build/building/best-practices/ — Recommends pinning base image versions/digests for reproducible builds instead of relying on floating tags.