Choosing a base image¶
Gate G5 requires the FROM line to reference the approved registry. The Base images page in the console lists every image in that registry, every tag, and which containers currently build on each.
Reading the page¶
Each image lists its tags with stable releases first, newest at the top. Three markers matter.
| Marker | Meaning |
|---|---|
| newest stable | The tag to pin for a new build. |
| prerelease | Not a release you ship on. |
| moving tag | latest. Pin a version instead. |
Beside each tag are the containers built on it, so you can see what else moves if a tag changes. A container marked with a DENY verdict is one that fails on that tag today.
Copy the FROM line¶
Every tag row has a control that copies the complete FROM line to the clipboard. Paste it into your Dockerfile and rebuild.
When you open the page from a container's own page, the image and tag that container currently uses are highlighted, so the comparison to the newest stable is immediate.
Base images and vulnerabilities¶
Base images are not scanned as a fleet. What is scanned is your built image, which includes everything the base brought in. Moving to a newer base tag is often the single update that closes the most CVEs at once, and the worklist row for a package will say when the fix is in the base rather than in your own dependency list.
Pin a version rather than using latest¶
The latest tag passes the registry check, but it makes builds hard to reproduce. Two builds a week apart from the same Dockerfile can produce two different images with two different scan results. Pinning a version means the scan record describes the image you actually shipped.