SyntaxShelf

Pin version

2 snippets in Docker

Also written as pin versions

DKDocker

Pin All Versions

DK · Best Practices
Syntax
FROM <image>:<specific_version>
RUN apt-get install -y <package>=<version>
Example
FROM node:20.11.1-alpine3.19
RUN apk add --no-cache dumb-init=1.2.5-r3

Note Unpinned versions mean your builds are not reproducible. node:20-alpine could be 20.10 today and 20.12 tomorrow. Pin the full version for critical images. Even apk/apt packages should be pinned in production Dockerfiles.

Not Pinning Image Versions

DK · Common Mistakes
Syntax
# Problem:
FROM node:latest
FROM python
FROM nginx
Example
# Fix - pin to specific versions:
FROM node:20.11.1-alpine3.19
FROM python:3.12.2-slim-bookworm
FROM nginx:1.25.4-alpine

Note An image tag like :latest or :20 can change at any time. Your build might work today and fail tomorrow because the base image was updated. In CI, a non-reproducible build means you cannot investigate a production issue with the exact same image.

Frequently asked questions

How does Docker handle pin version?
Docker covers this with 2 copy-ready snippets on this page. The "Pin All Versions" snippet in Docker uses `FROM <image>:<specific_version>`.
Which command does the Docker example use?
The "Pin All Versions" snippet uses `FROM <image>:<specific_version>`, from the Best Practices section of the Docker cheat sheet.
What other Docker snippets are shown for "pin version"?
Besides "Pin All Versions", this page also shows "Not Pinning Image Versions".
Is there anything to watch out for?
Yes. For "Pin All Versions": Unpinned versions mean your builds are not reproducible. node:20-alpine could be 20.10 today and 20.12 tomorrow. Pin the full version for critical images. Even apk/apt packages should be pinned in production Dockerfiles.

Browse all tasks by intent