All Dockerfile FROM statements use official base images with SHA-256 digest pinning

Floating tags like latest are mutable — the same tag can silently deliver a different, compromised image on the next build. An attacker who poisons an upstream image layer (CWE-1357, supply-chain attack) gains code execution in your container without triggering any diff in your repository. NIST 800-53 CM-14 and SLSA L3 both require provenance guarantees that floating tags cannot provide. CIS Docker Benchmark 5.31 flags this as a supply-chain control. SHA-256 digest pinning is the only mechanism that makes each build deterministic and independently verifiable.

Pin every Dockerfile FROM statement to a SHA-256 digest. Retrieve the digest from Docker Hub's tag detail page or with docker inspect --format='{{index .RepoDigests 0}}' <image>. Update Dockerfile:

# Before
FROM node:20-alpine

# After
FROM node:20-alpine@sha256:d4b15b3d48f42059a15bd659be60afe21762aed87f80a581e029b26d60e0e0e0

For minimal attack surface, prefer distroless bases: FROM gcr.io/distroless/nodejs20-debian12@sha256:.... Automate digest refresh with Dependabot or Renovate so pins stay current without manual tracking.