# X_IMAGE_GUARD_MISSING

## Means

the final stage of any Dockerfile in the tree declares an `ENTRYPOINT` that no `RUN` in that same stage executes

## Typical cause

the guard sits in an earlier stage, or is absent. Proving the binary runs on the **build** image proves nothing about what ships, and the Dockerfile that shipped the libc mismatch above did carry a guard — in the wrong stage. A stage with no `ENTRYPOINT` has nothing to guard and is not reported

## Fix

`bun run scripts/image-contract.ts --json` — the `fix` carries the exact `RUN ["<entrypoint>", "--version"]` to add to the final stage

[CLI and verify](/error-codes#cli-and-verify)