Description
Ensure cron jobs that run from a Docker image use a fixed image digest (for example image@sha256:...) or an immutable version tag, and not a moving tag such as latest. Render pulls the image again before every run, so a moving tag can change what runs without review.
Rationale
If a cron job uses latest, anyone who can push to that tag can change the code that runs on the next schedule, with no deploy or review in Render. A pinned digest or immutable version makes sure the job only runs the image you approved, and changes happen through a deliberate update.
Impact
The cron job always runs the approved image
Prevents silent changes through moving tags
Image updates require changing the image reference
Default Value
Render uses whatever image reference you configure, including moving tags such as latest.
Pre-Requisites
Admin or Developer role on the cron job
The digest or immutable tag of the approved image
Remediation
Test Plan
Sign in to the Render Dashboard at https://dashboard.render.com.
From your workspace home (or project), click the cron job to open it.
Open the cron job's Settings page and check the image URL.
If it uses latest or another moving tag, follow the implementation steps.
Implementation Steps
Find the digest of the approved image (for example with docker buildx imagetools inspect <image>:<tag>) or publish an immutable version tag.
Sign in to the Render Dashboard at https://dashboard.render.com.
From your workspace home (or project), click the cron job to open it.
Open the cron job's Settings page and update the image URL to <registry>/<image>@sha256:<digest> (or the immutable tag), or run: render services update <cron-job> --image <registry>/<image>@sha256:<digest>
Save the changes.
Backout Plan
Sign in to the Render Dashboard at https://dashboard.render.com.
From your workspace home (or project), click the cron job to open it.
Open the cron job's Settings page and restore the previous image URL.
Reference