A deployment pipeline uses a container registry. The Dockerfile uses 'FROM python:latest'. A security scan flags this. Why is 'latest' tag a security risk in production container deployments?

• A.'latest' is an alias for the stable branch - each build may pull a release the vendor has not yet tested, a risk that mainly affects beta images. Pinning the digest (FROM python@sha256:...) locks the exact image and removes the need for a vulnerability scanner in the later stages of the pipeline
• B.'latest' is not a fixed version: each build may pull a different image with different library versions, potentially introducing breaking changes or unpatched vulnerabilities. It also breaks reproducibility - the same Dockerfile may build differently on different dates. Pinning to a specific version ('FROM python:3.12.3-slim-bookworm') ensures reproducible, auditable builds and controlled vulnerability management
• C.'latest' downgrades the runtime on each pull - the registry may serve the oldest image under that name for compatibility, and builds then ship unpatched libraries (OpenSSL, zlib). Pinning to a major tag ('FROM python:3') guarantees the same patch level on each date, a result that makes scans unnecessary