Semgrep found 6 dockerfile-should-pin-to-hash findings:

• 3Dockerfile: L9, L21, L27, L33, L3, L15

Images referenced from a Dockerfile FROM should always be pinned to an
exact SHA-256 hash. This gives us confidence that builds are repeatable
and changes to base images are always obvious in CI. This is essentially
Docker's equivalent of a "lockfile".

To fix, run docker pull $IMG:$TAG, then change FROM $IMG:$TAG to
FROM $IMG:$TAG@sha256[...] based on the current SHA-256 hash.