Summary

Dockerfile.dev uses golang:1.25.4-alpine3.21 as its base image without a SHA256 digest pin. The production Dockerfile is correctly pinned to a digest for all three stages. The dev Dockerfile even has a TODO comment acknowledging this:

# TODO: Pin to SHA256 digest for reproducible builds:
FROM golang:1.25.4-alpine3.21 AS development

Risk

While the dev image is not used in production, it is used by all developers running the local dev environment and in any CI steps that build or test against the dev image. A compromised Docker Hub account or a malicious image with the same tag could introduce backdoors into developer workstations or exfiltrate secrets from the dev environment.

Remediation

Follow the same pattern as the production Dockerfile:

# Before
FROM golang:1.25.4-alpine3.21 AS development

# After (refresh digest via: docker pull golang:1.25.4-alpine3.21 && docker inspect --format='{{index .RepoDigests 0}}' golang:1.25.4-alpine3.21)
FROM golang:1.25.4-alpine3.21@sha256:<digest> AS development

Remove the TODO comment once pinned.

References

• Dockerfile.dev:1
• Dockerfile - correctly pinned production example