This misses the most important security step of all: when you specify an exact tag, instead find the hash of the specific image and use that instead, e.g.:

    FROM ubuntu@sha256:01234567...