IEBP005: sandbox_image_pinning

Registry images in compose files use an immutable tag or digest.

Category: best_practices · Applies to: eval, helper · Allowlist: [tool.inspect-evals-lint.allowlists.sandbox_image_pinning]

What it does

Reads every compose*.y*ml under the package and flags each service whose image is untagged or :latest. Services built locally (build:) and ${VAR} interpolated references are skipped. Each diagnostic is keyed by the image reference, which is what an allowlist entry names.

Why is this bad?

A floating reference resolves to whatever the registry holds today. A push upstream silently changes the evaluation environment, and results stop being comparable across runs without anything in the repository changing.

Example

services:
  default:
    image: aisiuk/inspect-tool-support

Use instead:

services:
  default:
    image: aisiuk/inspect-tool-support:1.4.2
    # or: aisiuk/inspect-tool-support@sha256:...

Options

• allowlists.sandbox_image_pinning: { package = ["image/ref"] } entries reported as warnings while they are pinned.

Suppress on a line with # inspect-evals-lint: ignore[IEBP005] or ignore[sandbox_image_pinning]; select or ignore it in configuration by either, or by the prefix IEBP.