diff --git a/Dockerfile b/Dockerfile
index 3bbc25712b..ec45ee64c3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,8 +15,13 @@
 # 8334  Mainet RPC port
 
 ARG ARCH=amd64
-
-FROM golang:1.14-alpine3.12 AS build-container
+# using the SHA256 instead of tags
+# https://github.com/opencontainers/image-spec/blob/main/descriptor.md#digests
+# https://cloud.google.com/architecture/using-container-images
+# https://github.com/google/go-containerregistry/blob/main/cmd/crane/README.md
+# ➜  ~ crane digest golang:1.16-alpine3.12
+# sha256:db2475a1dbb2149508e5db31d7d77a75e6600d54be645f37681f03f2762169ba
+FROM golang@sha256:db2475a1dbb2149508e5db31d7d77a75e6600d54be645f37681f03f2762169ba AS build-container
 
 ARG ARCH
 ENV GO111MODULE=on