Base image '${image}' does not use a specific image digest -

Error message

Base image '${image}' does not use a specific image digest - build may not be reproducible

What it means

Jib logs this warning when the configured base image reference does not pin a digest (e.g. 'openjdk:17' instead of 'openjdk@sha256:...'), meaning the build can pull a different image later and is not reproducible. The build proceeds; this is informational rather than fatal.

Source

Thrown at jib-core/src/main/java/com/google/cloud/tools/jib/configuration/BuildContext.java:318

        missingFields.add("target image configuration");
      }
      if (containerConfiguration == null) {
        missingFields.add("container configuration");
      }
      if (baseImageLayersCacheDirectory == null) {
        missingFields.add("base image layers cache directory");
      }
      if (applicationLayersCacheDirectory == null) {
        missingFields.add("application layers cache directory");
      }

      switch (missingFields.size()) {
        case 0: // No errors
          Preconditions.checkNotNull(baseImageConfiguration);
          if (!baseImageConfiguration.getImage().getDigest().isPresent()
              && !baseImageConfiguration.getImage().isScratch()) {
            eventHandlers.dispatch(
                LogEvent.warn(
                    "Base image '"
                        + baseImageConfiguration.getImage()
                        + "' does not use a specific image digest - build may not be reproducible"));
          }

          return new BuildContext(
              baseImageConfiguration,
              Verify.verifyNotNull(targetImageConfiguration),
              additionalTargetImageTags,
              Verify.verifyNotNull(containerConfiguration),
              Cache.withDirectory(Preconditions.checkNotNull(baseImageLayersCacheDirectory)),
              Cache.withDirectory(Preconditions.checkNotNull(applicationLayersCacheDirectory)),
              targetFormat,
              offline,
              layerConfigurations,
              toolName,
              toolVersion,
              eventHandlers,

View on GitHub (pinned to fb949e2676)

Solutions

Pin the base image by digest: pull once and set the from image to name@sha256:<digest>
Use a tool like `crane digest` or `docker pull` + `docker inspect` to obtain the digest
Accept the warning if reproducibility is not required

Example fix

// before
<jib.from><image>eclipse-temurin:17</image></jib.from>
// after
<jib.from><image>eclipse-temurin@sha256:2c2aef52...</image></jib.from>

Defensive patterns

Strategy: validation

Validate before calling

// Verify the base image reference pins a digest before building
String image = "eclipse-temurin:17";
if (!image.contains("@sha256:")) {
  throw new IllegalStateException("Base image " + image + " is not digest-pinned; build will not be reproducible");
}

Prevention

Pin base images by digest (name@sha256:...) in CI
Automate digest refresh with dependabot/renovate digest pinning
Treat this warning as a reproducibility signal in build logs

When it happens

Trigger: BuildContext.build() checks baseImageConfiguration.getImage(): if neither a digest nor scratch base is present, it dispatches this LogEvent.warn during any build using a mutable tag reference.

Common situations: Using image tags like 'latest' or version tags that may be re-pushed; teams with reproducibility/compliance requirements; CI builds that break when an upstream tag is overwritten.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of GoogleContainerTools/jib@fb949e2676 (2026-09-06). Data as JSON: /api/errors/df4a07c632d3fdbe. Report an issue: GitHub.