Base Image EOL Lint - Dockerfile and CI end-of-life check

Five images in the snippet below have already stopped getting security patches or stop before 13 November 2026, and Base Image EOL Lint marks all five the moment a platform engineer opens the file:

FROM node:20-alpine
# api/Dockerfile
FROM python:3.10-slim
# .github/workflows/ci.yml
    runs-on: ubuntu-20.04
# docker-compose.yml
    image: postgres:14
# services/report/Dockerfile
FROM mcr.microsoft.com/dotnet/aspnet:8.0

Line 2 pins Node.js 20, which reached end-of-life on 30 April 2026. Line 6 pins the Ubuntu 20.04 runner, which left standard support on 31 May 2025 and now needs a paid Ubuntu Pro subscription to receive anything. Those two are already unpatched.

The other three are worse, because they are still fine today. Python 3.10 reached end-of-life on 1 October 2026. Alpine 3.21, which keeps a branch for two years, ends on 1 November 2026. .NET 8 and .NET 9 both reach end of support on 10 November 2026 - the LTS release dies on the same day as the short-term one. PostgreSQL 14 follows on 12 November 2026. Debian 11 bullseye already went on 31 August 2026, so every -bullseye variant of every language image went with it.

That is four vendors retiring five runtimes inside a fortnight, and nothing in your monitoring will go red on any of those days. The container keeps starting. The build keeps passing. What stops is the flow of patches, and you find out at the next CVE.

The second failure is the one nobody plans for: the model wrote it. A code assistant trained before those dates will hand you FROM node:20-bullseye and FROM python:3.10-slim without hesitation, because both were the sensible answer when it learned them. Base images are the one place where a suggestion silently ages, and the year in the training data becomes the year in your Dockerfile.

Image scanners do not catch this. They test an image that has already been built and pushed, and they report the vulnerable packages inside it - a real job, and a different one. None of them opens the file on your screen and tells you that the FROM line names a runtime whose last security release is seven weeks away. By the time a scanner can see the image, you have already built it, tagged it and pushed it.

Base Image EOL Lint ships 21 rules covering Node.js, Python, Debian, Ubuntu, Alpine, .NET, PostgreSQL, MySQL, PHP, CentOS, the deprecated openjdk official image and floating :latest tags. It runs per line, in the editor, with no network call, no account and no build step. Each finding carries a severity - error for an image that is already unpatched, warn for one with a date on the calendar - and the exact tag that replaces it: node:20-alpine becomes node:24-trixie, python:3.10-slim becomes python:3.13-trixie, postgres:14 becomes postgres:17.

Checking the file you have open is free and complete: all 21 rules, every finding, every replacement, no watermark and no run limit. The licence changes the scope, not the answer - it walks every Dockerfile, compose file and workflow in the repository, writes a dated CSV, JSON or HTML report you can attach to a change ticket, and prints JSON that lets CI fail the build before an unpatched base image reaches production.

The first of those dates was 1 October 2026. Grep your repository for -bullseye today, or open the file and let 21 rules do it.