October 15, 2026 路 #29
The base image that changed underneath
Two builds from the same commit produced different scanners results. What moved?
FROM node:22
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm ci --omit=dev
COPY . .
USER node
CMD ["node", "server.js"]Next puzzle in UTC
One try. The first answer sticks.
How to fix it
A tag points at whatever the publisher last pushed. Pin FROM to a digest, and bump it on purpose when you want new OS packages.
node:22 is a nickname. The Node maintainers move it when they publish a new 22.x image, which includes a new Debian snapshot and a new set of OS vulnerabilities. Your lockfile did not change. The scanner did, because the base layers did. Rebuilding "the same commit" is not a reproducible build if the first line can move.
Digests are the same idea as pinning a GitHub Action to a SHA. The tag can stay in a comment so a human can see which release you meant.
Fix
FROM node:22-bookworm-slim@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
Use the digest of the release you just scanned, not a placeholder. Let Dependabot or Renovate bump it. Prefer a slim image so the bump has less in it, and fail the pipeline when the base digest changes without a pull request.