Why should you pin the base image version in a Dockerfile?
FROM python without a version or with latest can change between builds, so a rebuild may break or introduce new vulnerabilities. Pinning a specific tag or digest gives repeatable builds you update on purpose.
Explain it simply
If a recipe says 'use rice' and one day the shop gives basmati and the next day sticky rice, the dish changes. 'Use basmati rice, brand X, 1 kg pack' gives the same result every time.
FROM node means node:latest, which jumped from one major version to another over the years. A build that worked on Monday can fail on Friday with no code change. Pin at least the version: FROM node:20.11-slim. For maximum safety pin the digest: FROM node:20.11-slim@sha256:.... The trade-off is that you no longer get security patches automatically, so schedule updates, using a tool like Dependabot or Renovate to open pull requests when a new base version appears, and let CI test them.
Example
# unpredictable
FROM node
# repeatable
FROM node:20.11-slim
# strongest
FROM node:20.11-slim@sha256:0123456789abcdef...What to say in the interview
"Unpinned bases change under you, breaking builds or adding vulnerabilities. I pin a specific tag, or a digest for strict reproducibility, and use Renovate or Dependabot with CI to update it deliberately."
Common mistakes
- Pinning once and never updating, so known vulnerabilities pile up.