CyberCertPrepWeb App FundamentalsWeb Servers & DeploymentEASYFree question
A deployment pipeline uses a container registry. The Dockerfile uses 'FROM python:latest'. A security scan flags this. Why is 'latest' tag a security risk in production container deployments?
- A.'latest' is not a fixed version: each build may pull a different image with different library versions, potentially introducing breaking changes or unpatched vulnerabilities. It also breaks reproducibility - the same Dockerfile may build differently on different dates. Pinning to a specific version ('FROM python:3.12.3-slim-bookworm') ensures reproducible, auditable builds and controlled vulnerability management
- B.The 'latest' tag indicates an alpha/beta build
- C.Using 'latest' forces the image to be rebuilt every time
- D.'latest' images are always the most insecure version
Why A is correct
Container image tags are mutable references. 'latest' is updated whenever a new version is published - your build today may pull python:3.12 while next month it pulls python:3.13 with potentially breaking changes or new vulnerabilities. Pin to specific versions (and optionally also pin by image digest 'sha256:...' for absolute immutability). Use a dependency update tool (Dependabot, Renovate) to automatically propose version bump PRs with controlled review.
Know someone studying for Web App Fundamentals? Send them this one.