> You can inspect the .sh file That's not the issue. Installing software this way means you have no automatic updates in the future. It's fine if you re-run th

> You can inspect the .sh file That's not the issue. Installing software this way means you have no automatic updates in the future. It's fine if you re-run the install script on a regular basis (eg. by recreating containers) AND you don't pin versions But OP's instructions fail both: there is no mention of updates, and they pin the pandoc version.