I like circle, and Sean does a lot of great work, but I'll have to stick to more pedestrian code generation for now. It might seem too picky to some, but I nee

I like circle, and Sean does a lot of great work, but I'll have to stick to more pedestrian code generation for now. It might seem too picky to some, but I need to have good control over the inputs into my build processes. There are the obvious concerns regarding reproducibility and security which, again, maybe some don't care about. But there are also implications for distributed building and caching workflows. Circle doesn't practically drop in for C++ while it is allowed to do arbitrary I/O (even off the machine!) at build time. It seems like it should be a solvable problem at the expense of restricting what can happen at compile time, at least as an opt-in feature. The usual response is "well, don't do that kind of thing!", but at scale, manually maintaining that kind of design standard isn't practical. But I'm sure you all audit all the source that feeds into each one of your container base images.