Runtime EOL and Deploy-Block Audit for Docker, CI and AWS Lambda

Five lines in a US fintech team's repository will stop deploying before April 2027 — and an AI assistant wrote every one of them.

That is not a hypothetical. Here is the shape it takes in a real service:

FROM node:20-alpine          # Node.js 20 went EOL 2026-04-30
runs-on: ubuntu-22.04        # deprecation begins 2026-09-17
runtime: nodejs20.x          # Lambda blocks updates 2027-03-03
<TargetFramework>net8.0      # .NET 8 EOL 2026-11-10
FROM debian:11-slim          # Debian 11 EOL 2026-08-31

Every one of those was correct advice at some point. That is exactly the problem. A model trained while Node.js 20 was the safe LTS choice will keep suggesting node:20 long after 2026-04-30, and it will do it confidently, because nothing in the text of a Dockerfile marks a version as expired. The date lives somewhere else entirely — on a vendor page you have to know to go and read.

The sharpest edge is AWS Lambda, because it is the one that removes your ability to respond. Lambda's published table gives nodejs20.x, nodejs18.x, python3.9, python3.8, dotnet6, ruby3.2, go1.x and provided.al2 the same block-function-update date: 2027-03-03. After that date you cannot push code to those functions at all. Not a feature, not a hotfix, not a patch for whatever CVE lands that week. The function keeps running and you keep being responsible for it, which is the worst of both.

GitHub Actions does something similar with less finality but more surprise. The ubuntu-22.04 runner image begins deprecation on 2026-09-17, and GitHub schedules brownouts — 2027-03-23, 2027-03-30, 2027-04-06 and 2027-04-13 — where jobs on that label simply fail, before the image goes fully unsupported on 2027-04-17. A brownout arrives as a red build on a Tuesday in a repository nobody has touched in months.

None of this is secret. The dates are all published. The gap is that nobody looks, because looking means opening every Dockerfile, every workflow, every serverless.yml and every .csproj in the repository and cross-checking each pinned version against a different vendor's page.

That is a job for a regular expression and a table, so we made one. Runtime EOL Guard carries 54 rules covering Docker base images, GitHub Actions runner labels and setup-* pins, AWS Lambda runtime identifiers, and project manifests for .NET, Python, Django, Rails, Ruby, Spring Boot and Kubernetes. Every rule states the real date it is asserting and the version it wants instead, so you can check our homework.

The free version checks the open file — all 54 rules, no key, no cap, nothing hidden. Paste a file into the web version and you get the same answer from the same rule set. What the licence buys is a different job: one pass over the whole workspace, a dated report you can hand to a security review, CI output that fails a build on a crossed block date, and your own internal deadline rules.

A US platform engineer averages $63.95/hour (ZipRecruiter, September 2026). Runtime EOL Guard is $29 once, with a seven-day full refund.