This is what I think is the most practical approach. Pinning down ALL your dependencies to the exact version is much harder than it sounds. What you’re descri

This is what I think is the most practical approach. Pinning down ALL your dependencies to the exact version is much harder than it sounds. What you’re describing sound like the way Jib [1] does it. The pictures in this [2] blog post help visualize it. The reason I like the approach you describe is because it keeps things simpler at the start of a project and consistent across most projects. I also think it makes sense to have those support containers build on a schedule. For example, you build your build/CI container weekly and that’s the CI container for the week. On demand project builds use that CI container which has all dependencies, etc. baked in. It would be nice if CI systems would let me explicitly tag builds as (non)reproducible. 1. https://github.com/GoogleContainerTools/jib https://github.com/GoogleContainerTools/jib 2. https://phauer.com/2019/no-fat-jar-in-docker-image/ https://phauer.com/2019/no-fat-jar-in-docker-image/