A deployment pipeline uses a container registry. The Dockerfile uses 'FROM python:latest'. A security scan flags this. Why is 'latest' tag a security risk in production container deployments?

• A.Using 'latest' forces the image to be rebuilt every time; environment variables in a container are encrypted by the runtime and unreadable even to processes inside the container; running a container as root is safe because the container boundary is a full hardware virtual machine; co-locating the proxy and app server removes the need to validate forwarded headers, since loopback traffic cannot carry them; chroot jails virtualize the network stack, giving each jailed process its own firewall rules
• B.'latest' is not a fixed version: each build may pull a different image with different library versions, potentially introducing breaking changes or unpatched vulnerabilities. It also breaks reproducibility - the same Dockerfile may build differently on different dates. Pinning to a specific version ('FROM python:3.12.3-slim-bookworm') ensures reproducible, auditable builds and controlled vulnerability management
• C.'latest' images are always the most insecure version
• D.The 'latest' tag indicates an alpha/beta build