{"record":{"id":"df4a07c632d3fdbe","repo":"GoogleContainerTools/jib","slug":"base-image-image-does-not-use-a-specific-imag","errorCode":null,"errorMessage":"Base image '${image}' does not use a specific image digest - build may not be reproducible","messagePattern":"Base image '(.+?)' does not use a specific image digest - build may not be reproducible","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"jib-core/src/main/java/com/google/cloud/tools/jib/configuration/BuildContext.java","lineNumber":318,"sourceCode":"        missingFields.add(\"target image configuration\");\n      }\n      if (containerConfiguration == null) {\n        missingFields.add(\"container configuration\");\n      }\n      if (baseImageLayersCacheDirectory == null) {\n        missingFields.add(\"base image layers cache directory\");\n      }\n      if (applicationLayersCacheDirectory == null) {\n        missingFields.add(\"application layers cache directory\");\n      }\n\n      switch (missingFields.size()) {\n        case 0: // No errors\n          Preconditions.checkNotNull(baseImageConfiguration);\n          if (!baseImageConfiguration.getImage().getDigest().isPresent()\n              && !baseImageConfiguration.getImage().isScratch()) {\n            eventHandlers.dispatch(\n                LogEvent.warn(\n                    \"Base image '\"\n                        + baseImageConfiguration.getImage()\n                        + \"' does not use a specific image digest - build may not be reproducible\"));\n          }\n\n          return new BuildContext(\n              baseImageConfiguration,\n              Verify.verifyNotNull(targetImageConfiguration),\n              additionalTargetImageTags,\n              Verify.verifyNotNull(containerConfiguration),\n              Cache.withDirectory(Preconditions.checkNotNull(baseImageLayersCacheDirectory)),\n              Cache.withDirectory(Preconditions.checkNotNull(applicationLayersCacheDirectory)),\n              targetFormat,\n              offline,\n              layerConfigurations,\n              toolName,\n              toolVersion,\n              eventHandlers,","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/GoogleContainerTools/jib/blob/fb949e2676afbbd7dd7a1ef61e20251931325654/jib-core/src/main/java/com/google/cloud/tools/jib/configuration/BuildContext.java#L300-L336","documentation":"Jib logs this warning when the configured base image reference does not pin a digest (e.g. 'openjdk:17' instead of 'openjdk@sha256:...'), meaning the build can pull a different image later and is not reproducible. The build proceeds; this is informational rather than fatal.","triggerScenarios":"BuildContext.build() checks baseImageConfiguration.getImage(): if neither a digest nor scratch base is present, it dispatches this LogEvent.warn during any build using a mutable tag reference.","commonSituations":"Using image tags like 'latest' or version tags that may be re-pushed; teams with reproducibility/compliance requirements; CI builds that break when an upstream tag is overwritten.","solutions":["Pin the base image by digest: pull once and set the from image to name@sha256:<digest>","Use a tool like `crane digest` or `docker pull` + `docker inspect` to obtain the digest","Accept the warning if reproducibility is not required"],"exampleFix":"// before\n<jib.from><image>eclipse-temurin:17</image></jib.from>\n// after\n<jib.from><image>eclipse-temurin@sha256:2c2aef52...</image></jib.from>","handlingStrategy":"validation","validationCode":"// Verify the base image reference pins a digest before building\nString image = \"eclipse-temurin:17\";\nif (!image.contains(\"@sha256:\")) {\n  throw new IllegalStateException(\"Base image \" + image + \" is not digest-pinned; build will not be reproducible\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pin base images by digest (name@sha256:...) in CI","Automate digest refresh with dependabot/renovate digest pinning","Treat this warning as a reproducibility signal in build logs"],"tags":["jib","reproducibility","base-image"],"backgroundTag":"invalid-config-value","analyzedSha":"fb949e2676afbbd7dd7a1ef61e20251931325654","analyzedAt":"2026-09-06T14:04:09.491Z","contentChangedAt":"2026-09-06T14:04:09.491Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}