"a dockerfile seems so useful for having an easily readable declaration of what exactly is inside the container" I wish this was the case, but unfortunately it

"a dockerfile seems so useful for having an easily readable declaration of what exactly is inside the container" I wish this was the case, but unfortunately it doesn't tell you what's in the base/parent image. It also doesn't ensure you get bit-exact reproduceable builds. You need something like Guix/Nix for that.