The Dockerfile uses registry.access.redhat.com/ubi10/ubi:latest — a mutable tag with no SHA256 digest pin. A supply-chain attack on the base image registry would be silently pulled into builds.
|
FROM registry.access.redhat.com/ubi10/ubi:latest AS packager |
Suggested Fix
Pin to a specific SHA digest: ubi10/ubi@sha256:<digest> and update via automated tooling (e.g. Renovate, Dependabot).
From code inspection (2026-07-05, main @ 86fac7a). Severity: 🟠 Medium
The Dockerfile uses
registry.access.redhat.com/ubi10/ubi:latest— a mutable tag with no SHA256 digest pin. A supply-chain attack on the base image registry would be silently pulled into builds.sail-operator/Dockerfile
Line 1 in 86fac7a
Suggested Fix
Pin to a specific SHA digest:
ubi10/ubi@sha256:<digest>and update via automated tooling (e.g. Renovate, Dependabot).From code inspection (2026-07-05, main @ 86fac7a). Severity: 🟠 Medium