It makes sense to package and isolate the base system since it avoids any "hidden state" that could influence the behaviour of your program and introduce hard-t

It makes sense to package and isolate the base system since it avoids any "hidden state" that could influence the behaviour of your program and introduce hard-to-debug errors. And it's not packed into a single opaque block: You can specify an image to derive your image from and Docker will overlay-mount your image on top of the base image, avoiding the need to store multiple copies of a base image.