A Dockerfile release preflight for mutable image tags

A Dockerfile can look unchanged while the image it builds changes beneath it. The usual cause is a mutable image reference.

The small release-review question

Before a release, identify each FROM reference and answer one question: does it identify exactly the image you intended to run?

FROM node:latest
FROM postgres:16
FROM ghcr.io/acme/service@sha256:abc

Those are three different review choices:

• latest is deliberately floating.
• a major tag is easier to understand, but may still move as new builds are published.
• a digest identifies a specific image artifact.

There is no universal rule that every dependency must be digest-pinned. The useful practice is to make the choice visible before the build, especially for base images that control the execution environment.

A lightweight preflight

1. List each FROM reference in the Dockerfile you are about to ship.
2. Flag floating or broad tags.
3. Decide which ones need an immutable reference for this release.
4. Preserve any exceptions beside the release notes.

For a quick deterministic pass, I published a free browser-local Docker Tag Checker. Paste a Dockerfile; the text stays in the browser and the tool highlights mutable references.

If a team needs a timestamped shareable record of the exact check, the same page offers a one-time downloadable report for €7. There is no account or subscription.

This is a narrow release-review aid, not a security certification. The full example checklist is also available in the public repository.