lintai docs

Appearance

Rule Reference

SEC750lintai-ai-securitysupply-chainhardeningstabledocker-composewarn

Docker Compose: mutable service image

Docker Compose service image uses a mutable registry reference without a digest pin

Public lane
supply-chain
Category
hardening
Provider
lintai-ai-security
Scope
per-file
Surface
docker-compose
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message only
How to read this lane

Reproducibility, provenance, and dependency hardening review.

How to read this category

Least-privilege, provenance, or operational hygiene signal.

Activation Model

Preset Activation

These presets explain where this rule appears in the product experience.

supply-chainsidecar lane

Lifecycle

Stable Lifecycle Contract

State

stable

Graduation rationale

Checks committed Docker Compose services for registry-distributed image references that are not digest pinned.

Deterministic signal basis

DockerComposeSignals combines semantic confirmation of `services.*.image` values with indentation-aware line matching and conservative registry-image plus digest-pin detection.

Malicious corpus
docker-compose-mutable-image
Benign corpus
docker-compose-digest-pinned-image
structured evidence required remediation reviewed
Canonical note

Structural stable rule positioned as a supply-chain hardening control: high-precision and actionable, but not a blanket claim of direct repository compromise.

Nearby Signals

Related Rules

SEC752Docker Compose: latest or implicit-latest service image tagDocker Compose service image uses a latest or implicit-latest tagsupply-chainhardeningdocker-compose
SEC748Docker Compose: privileged service runtimeDocker Compose service enables privileged container runtime or host namespace accessthreat-reviewsecuritydocker-compose

Why It Matters ​

Mutable service-image tags in committed Compose files reduce reproducibility and make incident review harder, because the deployed bytes can change without any config diff in the repository.

What Triggers ​

SEC750 matches services.*.image values in semantic Docker Compose files when the image is a registry-distributed reference without a digest pin.

False Positives ​

The rule is kept intentionally narrow and uses conservative image matching plus digest-pin detection. It does not fire on digest-pinned service images.

Remediation ​

Pin service images by digest instead of relying on mutable tags.