This is why I build containers using Nix (plus the reproducibility, caching, etc.): since everything has a path containing an unguessable hash, all dependencies

This is why I build containers using Nix (plus the reproducibility, caching, etc.): since everything has a path containing an unguessable hash, all dependencies must be referred to by their absolute path (either directly, or indirectly via an env var, etc.). That makes it trivial to find all the dependencies of a file (whether they're dynamic libraries, interpreter packages, image files, etc.), transitively, and tar them all up into a self-contained container :)