# Ensure Docker-based cron jobs use a pinned image version

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876666603176-ensure-docker-based-cron-jobs-use-a-pinned-image-version
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure cron jobs that run from a Docker image use a fixed image digest (for example image@sha256:...) or an immutable version tag, and not a moving tag such as latest. Render pulls the image again before every run, so a moving tag can change what runs without review.

**Rationale**

If a cron job uses latest, anyone who can push to that tag can change the code that runs on the next schedule, with no deploy or review in Render. A pinned digest or immutable version makes sure the job only runs the image you approved, and changes happen through a deliberate update.

**Impact**

-   The cron job always runs the approved image
    
-   Prevents silent changes through moving tags
    
-   Image updates require changing the image reference
    

**Default Value**

Render uses whatever image reference you configure, including moving tags such as latest.

**Pre-Requisites**

-   Admin or Developer role on the cron job
    
-   The digest or immutable tag of the approved image
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the cron job to open it.
    
3.  Open the cron job's Settings page and check the image URL.
    
4.  If it uses latest or another moving tag, follow the implementation steps.
    

**Implementation Steps**

1.  Find the digest of the approved image (for example with docker buildx imagetools inspect <image>:<tag>) or publish an immutable version tag.
    
2.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
3.  From your workspace home (or project), click the cron job to open it.
    
4.  Open the cron job's Settings page and update the image URL to <registry>/<image>@sha256:<digest> (or the immutable tag), or run: render services update <cron-job> --image <registry>/<image>@sha256:<digest>
    
5.  Save the changes.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the cron job to open it.
    
3.  Open the cron job's Settings page and restore the previous image URL.
    

**Reference**

-   [https://render.com/docs/cronjobs](https://render.com/docs/cronjobs)
    
-   [https://render.com/docs/deploying-an-image](https://render.com/docs/deploying-an-image)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.